# MITRE ATT&CK

Give an AI agent tools to search MITRE ATT&CK tactics, techniques, groups, software, and mitigations. Useful when investigating a technique or threat group.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 15
- Author: Montimage
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Montimage/mitre-mcp
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/mcp/mitre-attck

## What it does

The server lets an agent browse filtered technique lists, retrieve a technique by ID, or find techniques associated with a tactic or group. It can also return group, software, and mitigation records, including links between mitigations and techniques. List results support pagination.

Coverage includes the Enterprise, Mobile, and ICS domains. Enterprise data loads at startup; Mobile and ICS data load when first requested, so those results are fetched on demand. Use stdio with local clients or HTTP for web integrations. The server is built in Python with the official MCP Python SDK and the mitreattack-python library.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mitre-mcp -- uvx mitre-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add mitre-attck -- uvx mitre-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mitre-attck": {
            "command": "uvx",
            "args": [
                "mitre-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mitre-attck": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "mitre-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mitre-attck uvx mitre-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from mitre-mcp <command>

## When to use it
- look up an ATT&CK technique by ID
- filter techniques by tactic
- find techniques associated with a threat group
- retrieve mitigations linked to techniques
- browse ATT&CK software and tools

## Example prompts
- Find technique `T1055` and explain which tactic it belongs to.
- Show the techniques associated with `APT29`.
- List mitigations and the techniques each one addresses.

## Similar
- [analyzing-apt-group-with-mitre-navigator](https://affpapa.org/en/nevibecode/skills/analyzing-apt-group-with-mitre-navigator.md) — skill · 531 installs
- [analyzing-threat-actor-ttps-with-mitre-attack](https://affpapa.org/en/nevibecode/skills/analyzing-threat-actor-ttps-with-mitre-attack.md) — skill · 312 installs
- [mitre-attack-mcp-server](https://affpapa.org/en/nevibecode/mcp/mitre-attack-mcp-server.md) — MCP server · ★ 5
- [python-cybersecurity-tool-development](https://affpapa.org/en/nevibecode/skills/python-cybersecurity-tool-development.md) — skill · 969 installs
- [information-security-manager-iso27001](https://affpapa.org/en/nevibecode/skills/information-security-manager-iso27001.md) — skill · 855 installs
- [privacy-data-security](https://affpapa.org/en/nevibecode/skills/privacy-data-security.md) — skill · 698 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md