MITRE ATT&CK

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/luongnv89-mitre-mcp

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

9 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

Not scanned yet

Runs as

Python package

Tools (9)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• get_groupsGet Groups

  Get groups from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of groups to return (default: 20) offset: Index to start from when returning groups (for pagination) Returns: Dictionary containing a list of groups and pagination metadata

• get_mitigationsGet Mitigations

  Get mitigations from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of mitigations to return (default: 20) offset: Index to start from when returning mitigations (for pagination) Returns: Dictionary containing a list of mitigations and pagination metadata

• get_softwareGet Software

  Get software from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects software_types: Optional list of ATT&CK object types to include (e.g., ["malware"]) limit: Maximum number of software to return (default: 20) offset: Index to start from when returning software (for pagination) Returns: Dictionary containing a list of software and pagination metadata

• get_tacticsGet Tactics

  Get tactics from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of tactics to return (default: 20) offset: Index to start from when returning tactics (for pagination) Returns: Dictionary containing a list of tactics and pagination metadata

• get_technique_by_idGet Technique by ID

  Get a technique by its MITRE ATT&CK ID. Args: ctx: FastMCP request context (injected by the server) technique_id: The MITRE ATT&CK ID of the technique (e.g., 'T1055') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) Returns: Dictionary containing the technique

• get_techniquesGet Techniques

  Get techniques from the MITRE ATT&CK framework with token-optimized responses. Args: ctx: FastMCP request context (injected by the server) domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) include_subtechniques: Include subtechniques in the result remove_revoked_deprecated: Remove revoked or deprecated objects include_descriptions: Whether to include technique descriptions (uses more tokens) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Diction…

• get_techniques_by_tacticGet Techniques by Tactic

  Get techniques by tactic. Args: ctx: FastMCP request context (injected by the server) tactic_shortname: The shortname of the tactic (e.g., 'defense-evasion') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Dictionary containing a list of techniques and pagination metadata

• get_techniques_mitigated_by_mitigationGet Techniques Mitigated by Mitigation

  Get techniques mitigated by a mitigation. Args: ctx: FastMCP request context (injected by the server) mitigation_name: The name of the mitigation domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Dictionary containing the mitigation, a list of techniques and pagination metadata

• get_techniques_used_by_groupGet Techniques Used by Group

  Get techniques used by a group. Args: ctx: FastMCP request context (injected by the server) group_name: The name of the group domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination) Returns: Dictionary containing the group, a list of techniques and pagination metadata

Signals

Stars

15

Forks

2

Open issues

3

Weekly downloads

84

Last commit

Sep 30, 2026 (28 days ago)

Last release

Sep 19, 2026 (1 month ago)

Last package publish

Sep 19, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.luongnv89/mitre-mcp

Version

0.3.1

Auth

No auth

Packages

pypi mitre-mcp

License

MIT

Repository

github.com/Montimage/mitre-mcp

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql