MITRE ATT&CK MCP Server

Example Use Cases

• 1

  Query the MITRE ATT&CK knowledge base for details on techniques, tactics, malware, and threat actors.

• 2

  Generate ATT&CK Navigator layers to visualize technique usage and map detections or incidents.

• 3

  Analyze technique overlap, attribute tools/malware to actors, and discover campaign relationships.

Description

This MCP server exposes 50+ tools for querying the MITRE ATT&CK knowledge base, generating ATT&CK Navigator layers, and analyzing relationships between threat actors, malware, and techniques. It simplifies producing visualizations and performing technique-overlap and attribution analysis for threat intelligence workflows. The server is installable via pipx and can be integrated with Claude's MCP-enabled clients for interactive agent use.