mitre-mcp
ActiveAn LLM asked about ATT&CK from memory gives you stale, hallucinated technique IDs, and your SOC stack sits in four separate consoles. mitre-mcp hands your agent the real, versioned ATT&CK knowledge base plus live Wazuh, TheHive, Cortex, and MISP, so it maps an alert to a technique and finds the coverage gap in one conversation.
See it workrepresentative session
Representative session. Illustrative values, RFC 5737 addresses. SOC writes dry-run by default; your data never leaves the hosts you configure.
What it does
mitre-mcp is an MCP server that serves the official MITRE ATT&CK knowledge base (techniques, tactics, groups, software, mitigations, data sources, campaigns) from MITRE's STIX 2.1 bundles, cached locally so it works offline after first run. It exists because asking an LLM about adversary techniques gives you confident, made-up technique IDs and last year's data, while a SOC analyst needs the versioned truth and the alerts in front of them. Unlike a plain ATT&CK lookup tool, it ships the analysis layer (alert-to-technique mapping, detection coverage, attribution, Navigator layer export) and optional live integrations for Wazuh, TheHive, Cortex, and MISP in one server, so an agent can map a real alert to a technique and cross-correlate it across the whole stack without leaving the chat. With no credentials configured it is a pure read-only ATT&CK server.
Capabilities39 tools across ATT&CK and your SOC stack
Core ATT&CK
19 toolsLook up and search techniques, tactics, groups, software, mitigations, and data sources; map alerts, analyze coverage, build attack paths.
Campaigns
4 toolsProfile campaigns, fetch and list them, and search by keyword or technique for attribution work.
Navigator export
1 toolEmit ATT&CK Navigator JSON layers for coverage, group, campaign, and diff heatmaps.
Wazuh integration
4 toolsManager status, map rules and alerts to techniques, rule coverage, and ATT&CK-enriched alert fetch.
TheHive & Cortex
5 toolsEnrich, create, and list TheHive cases with ATT&CK context; map and run Cortex analyzers (writes gated).
MISP & cross-stack
6 toolsMap events, search IOCs, create and list MISP events; SOC connection status and one-shot correlation across Wazuh, TheHive, and MISP.
Setup
claude mcp add mitre-attack --env MITRE_MATRICES=enterprise -- npx -y mitre-mcp
Core ATT&CK needs no credentials. Add WAZUH_*, THEHIVE_*, CORTEX_*, or MISP_* env vars to enable the optional SOC integrations; MITRE_MATRICES selects enterprise, mobile, or ics.
{ "mcpServers": { "mitre-attack": { "command": "npx", "args": ["-y", "mitre-mcp"], "env": { "MITRE_MATRICES": "enterprise" } } } }