mitre-mcp

Active

An LLM asked about ATT&CK from memory gives you stale, hallucinated technique IDs, and your SOC stack sits in four separate consoles. mitre-mcp hands your agent the real, versioned ATT&CK knowledge base plus live Wazuh, TheHive, Cortex, and MISP, so it maps an alert to a technique and finds the coverage gap in one conversation.

GitHub repo → npm: mitre-mcp →

39 tools3 resources4 promptsread-only by defaultNode 20+MIT

See it work

one question, the tools it calls, the answer

representative session · claude + mitre-mcp

We got Wazuh rule 5710 firing on a DMZ host with sshd auth failures. What ATT&CK technique is that, and does the rest of my stack know about it?

mitre_map_wazuh_alert{ rule_id: 5710, groups: ["sshd", "authentication_failed"] }

T1110.001 Brute Force: Password Guessing (tactic: Credential Access) confidence: high data source: Logon Session / Authentication Logs

mitre_cross_correlate{ techniques: ["T1110.001"] }

Wazuh: 14 alerts (dmz-web-01 198.51.100.24, last 1h) TheHive: 0 open cases MISP: 2 events tag attack-pattern:T1110.001 (APT28-linked infra)

That is T1110.001 password guessing. Wazuh has 14 hits on dmz-web-01, MISP already ties this technique to APT28 infra, but no TheHive case exists yet. I would open one and pivot on the MISP indicators.

Representative session. Illustrative values, RFC 5737 addresses. SOC writes dry-run by default; your data never leaves the hosts you configure.

What it does

mitre-mcp is an MCP server that serves the official MITRE ATT&CK knowledge base (techniques, tactics, groups, software, mitigations, data sources, campaigns) from MITRE's STIX 2.1 bundles, cached locally so it works offline after first run. It exists because asking an LLM about adversary techniques gives you confident, made-up technique IDs and last year's data, while a SOC analyst needs the versioned truth and the alerts in front of them. Unlike a plain ATT&CK lookup tool, it ships the analysis layer (alert-to-technique mapping, detection coverage, attribution, Navigator layer export) and optional live integrations for Wazuh, TheHive, Cortex, and MISP in one server, so an agent can map a real alert to a technique and cross-correlate it across the whole stack without leaving the chat. With no credentials configured it is a pure read-only ATT&CK server.

Capabilities

39 tools across ATT&CK and your SOC stack

Core ATT&CK19 tools

Look up and search techniques, tactics, groups, software, mitigations, and data sources; map alerts, analyze coverage, build attack paths.

Campaigns4 tools

Profile campaigns, fetch and list them, and search by keyword or technique for attribution work.

Navigator export1 tool

Emit ATT&CK Navigator JSON layers for coverage, group, campaign, and diff heatmaps.

Wazuh integration4 tools

Manager status, map rules and alerts to techniques, rule coverage, and ATT&CK-enriched alert fetch.

TheHive & Cortex5 tools

Enrich, create, and list TheHive cases with ATT&CK context; map and run Cortex analyzers (writes gated).

MISP & cross-stack6 tools

Map events, search IOCs, create and list MISP events; SOC connection status and one-shot correlation across Wazuh, TheHive, and MISP.

Full reference on GitHub →

Set it up

claude mcp add mitre-attack --env MITRE_MATRICES=enterprise -- npx -y mitre-mcp

Core ATT&CK needs no credentials. Add WAZUH_*, THEHIVE_*, CORTEX_*, or MISP_* env vars to enable the optional SOC integrations; MITRE_MATRICES selects enterprise, mobile, or ics.

MCP client config

{ "mcpServers": { "mitre-attack": { "command": "npx", "args": ["-y", "mitre-mcp"], "env": { "MITRE_MATRICES": "enterprise" } } } }

[ shield ]

With no credentials configured, mitre-mcp is a pure read-only ATT&CK server. State-changing SOC tools (mitre_thehive_create_case, mitre_misp_create_event, mitre_cortex_run_analyzers) dry-run by default and return the action they would take unless the call passes confirm: true or MITRE_SOC_ALLOW_WRITES=true is set. IDs passed to SOC tools are validated against a strict allow-list and URL-encoded, and relaxed TLS (VERIFY_SSL=false) is scoped per request so other hosts stay protected.

MCP tools

SOC integrations

writes by default

STIX 2.1

ATT&CK source

MIT

license