What is attAck-mcp-server?
attAck-mcp-server is an MCP (Model Context Protocol) server that provides tools to query the MITRE ATT&CK knowledge base for adversary techniques, tactics, mitigations, and detections. It is designed for security analysts, threat researchers, and AI agents integrated via MCP clients.
How to use attAck-mcp-server?
Clone the repository, install dependencies with pip install -r requirements.txt, and ensure enterprise-attack.json is in the project root. Then run python main.py for local stdio mode, or python main.py --mode http --host 0.0.0.0 --port 8081 for HTTP mode. Configure your MCP client to connect using the chosen transport and tool names.
Key features of attAck-mcp-server
- Query techniques by ID or name (fuzzy search).
- Retrieve full technique details including sub-techniques.
- Look up mitigations and detections for a technique.
- List all ATT&CK tactics.
- Return server version and dataset information.
- Supports both local stdio and HTTP/Streamable transports.
Use cases of attAck-mcp-server
- A security analyst queries a technique ID to get its description and platform.
- A threat researcher performs a fuzzy name search for "phishing" to find related techniques.
- An incident responder looks up mitigations and detections for a detected technique.
- A developer retrieves the full list of ATT&CK tactics to integrate into a dashboard.
コメント