mitre-attack-mcp-server — Claude Code MCP server: MITRE ATT&CK access
Gives your agent tools to query MITRE ATT&CK: techniques, groups, software and mitigations. Handy when you need to work through TTPs or map coverage.
claude mcp add mitre-attack-mcp-server -- npx -y @imouiche/mitre-attack-mcp-serverWhat mitre-attack-mcp-server does
The server exposes official MITRE ATT&CK STIX data to an agent in a structured form. It ships more than 65 tools: look up a technique by ID or name, walk from a parent technique to its subtechniques and back, pull tactics and platforms, find groups by name or alias, and build ATT&CK Navigator layers. A couple of tools report download stats and the ATT&CK release version.
On the first run the data downloads itself and lands in ~/.mitre-mcp-server/data/. After that queries are served from memory. Nothing is scraped and no third-party API sits in the middle — the source is MITRE's own data.
Startup goes through npx, so Node.js has to be present. In Claude a single claude mcp add line is enough; Cursor and GitHub Copilot take a JSON block you paste into their config. That first run pulls roughly 59 MB, so a machine with no outbound network will not get past it.
What it helps with
- find the techniques a given group uses, by name or alias
- expand a technique into its subtechniques and related tactics
- list techniques that target a specific platform
- build an ATT&CK Navigator layer to show coverage
- check which techniques were revoked so you stop citing them
Example prompts for the agent
- Which techniques does APT29 use for initial access?
- Build an ATT&CK Navigator layer for ransomware-related techniques
- List every Windows persistence technique
How to install mitre-attack-mcp-server
Platform CLI
claude mcp add mitre-attack-mcp-server -- npx -y @imouiche/mitre-attack-mcp-serverPlatform CLI
codex mcp add mitre-attack-mcp-server -- npx -y @imouiche/mitre-attack-mcp-serverConfig file
{
"mcpServers": {
"mitre-attack-mcp-server": {
"command": "npx",
"args": [
"-y",
"@imouiche/mitre-attack-mcp-server"
]
}
}
}Config file
{
"servers": {
"mitre-attack-mcp-server": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@imouiche/mitre-attack-mcp-server"
]
}
}
}Platform CLI
gemini mcp add mitre-attack-mcp-server npx -y @imouiche/mitre-attack-mcp-serverStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about mitre-attack-mcp-server
How do I install mitre-attack-mcp-server in Claude Code?
Run claude mcp add mitre-attack-mcp-server -- npx -y @imouiche/mitre-attack-mcp-server. The server then shows up in your Claude MCP list.
What does mitre-attack-mcp-server do?
It hands the agent a toolset over the MITRE ATT&CK knowledge base: techniques, subtechniques, tactics, groups, software and mitigations. It also generates ATT&CK Navigator layers.
What do I need before running it?
Node.js, since the server starts through npx. The first launch downloads about 59 MB of ATT&CK data into ~/.mitre-mcp-server/data/.
