# mitre-attack-mcp-server

Gives your agent tools to query MITRE ATT&CK: techniques, groups, software and mitigations. Handy when you need to work through TTPs or map coverage.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 5
- Author: imouiche
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/imouiche/complete-mitre-attack-mcp-server
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/mitre-attack-mcp-server

## What it does

The server exposes official MITRE ATT&CK STIX data to an agent in a structured form. It ships more than 65 tools: look up a technique by ID or name, walk from a parent technique to its subtechniques and back, pull tactics and platforms, find groups by name or alias, and build ATT&CK Navigator layers. A couple of tools report download stats and the ATT&CK release version.

On the first run the data downloads itself and lands in `~/.mitre-mcp-server/data/`. After that queries are served from memory. Nothing is scraped and no third-party API sits in the middle — the source is MITRE's own data.

Startup goes through `npx`, so Node.js has to be present. In Claude a single `claude mcp add` line is enough; Cursor and GitHub Copilot take a JSON block you paste into their config. That first run pulls roughly 59 MB, so a machine with no outbound network will not get past it.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mitre-attack-mcp-server -- npx -y @imouiche/mitre-attack-mcp-server
```

### Codex

**Platform CLI**
```bash
codex mcp add mitre-attack-mcp-server -- npx -y @imouiche/mitre-attack-mcp-server
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mitre-attack-mcp-server": {
            "command": "npx",
            "args": [
                "-y",
                "@imouiche/mitre-attack-mcp-server"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mitre-attack-mcp-server": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@imouiche/mitre-attack-mcp-server"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mitre-attack-mcp-server npx -y @imouiche/mitre-attack-mcp-server
```

## When to use it
- find the techniques a given group uses, by name or alias
- expand a technique into its subtechniques and related tactics
- list techniques that target a specific platform
- build an ATT&CK Navigator layer to show coverage
- check which techniques were revoked so you stop citing them

## Example prompts
- Which techniques does APT29 use for initial access?
- Build an ATT&CK Navigator layer for ransomware-related techniques
- List every Windows persistence technique

## Similar
- [analyzing-threat-actor-ttps-with-mitre-attack](https://affpapa.org/en/nevibecode/skills/analyzing-threat-actor-ttps-with-mitre-attack.md) — skill · 312 installs
- [analyzing-apt-group-with-mitre-navigator](https://affpapa.org/en/nevibecode/skills/analyzing-apt-group-with-mitre-navigator.md) — skill · 531 installs
- [anthropic-cybersecurity-skills](https://affpapa.org/en/nevibecode/skills/anthropic-cybersecurity-skills.md) — skill · 1600 installs
- [attack-tree-construction](https://affpapa.org/en/nevibecode/skills/attack-tree-construction.md) — skill · 17309 installs
- [security-investigator-automation](https://affpapa.org/en/nevibecode/skills/security-investigator-automation.md) — skill · 322 installs
- [hash-attack-techniques](https://affpapa.org/en/nevibecode/skills/hash-attack-techniques.md) — skill · 3600 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md