MITRE ATT&CK — Claude Code MCP server: features and setup
Give an AI agent tools to search MITRE ATT&CK tactics, techniques, groups, software, and mitigations. Useful when investigating a technique or threat group.
claude mcp add mitre-mcp -- uvx mitre-mcpWhat MITRE ATT&CK does
The server lets an agent browse filtered technique lists, retrieve a technique by ID, or find techniques associated with a tactic or group. It can also return group, software, and mitigation records, including links between mitigations and techniques. List results support pagination.
Coverage includes the Enterprise, Mobile, and ICS domains. Enterprise data loads at startup; Mobile and ICS data load when first requested, so those results are fetched on demand. Use stdio with local clients or HTTP for web integrations. The server is built in Python with the official MCP Python SDK and the mitreattack-python library.
What it helps with
- look up an ATT&CK technique by ID
- filter techniques by tactic
- find techniques associated with a threat group
- retrieve mitigations linked to techniques
- browse ATT&CK software and tools
Example prompts for the agent
- Find technique
T1055and explain which tactic it belongs to. - Show the techniques associated with
APT29. - List mitigations and the techniques each one addresses.
How to install MITRE ATT&CK
Platform CLI
claude mcp add mitre-mcp -- uvx mitre-mcpuvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>
Platform CLI
codex mcp add mitre-attck -- uvx mitre-mcpuvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>
Config file
{
"mcpServers": {
"mitre-attck": {
"command": "uvx",
"args": [
"mitre-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>
Config file
{
"servers": {
"mitre-attck": {
"type": "stdio",
"command": "uvx",
"args": [
"mitre-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>
Platform CLI
gemini mcp add mitre-attck uvx mitre-mcpuvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about MITRE ATT&CK
How do I install MITRE ATT&CK in Claude Code?
Add the server with claude mcp add mitre-mcp -- uvx mitre-mcp.
What does MITRE ATT&CK do?
It gives an agent tools for searching ATT&CK techniques, tactics, groups, software, and mitigations. Searches can connect techniques to groups or mitigations.
Which ATT&CK domains does it support?
It covers Enterprise, Mobile, and ICS. Enterprise data loads at startup; the other two domains load on their first request.
