attAck MCP Server is an interface to the MITRE ATT&CK framework, providing access to a curated knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real-world cyber attacks. It enables security teams to research attack behaviors, understand platforms at risk, and identify defensive countermeasures. Key capabilities include: - Query techniques by MITRE ID (such as T1059.001) or partial-name fuzzy search to quickly find relevant attack methods. - Retrieve comprehensive attack profiles including affected platforms, kill chain phases, data sources, and external references. - Access mitigation strategies and detection methods for each technique to support defensive planning. - Browse all ATT&CK tactics spanning the cyber attack lifecycle from Initial Access to Exfiltration.

attAck-mcp-server

This project is an MCP (Model Context Protocol) server for querying ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) techniques and tactics. It provides a way to access and retrieve information about various attack techniques and tactics used by adversaries.

Tools

The server provides the following tools:

        {
          "technique_id": "T1059.001"
        }
        

        {
          "tech_name": "phishing"
        }
        

        {
          "technique_id": "T1059.001"
        }
        

        {
          "tech_name": "phishing"
        }
        

        {
          "technique_id": "T1059.001"
        }
        

        {
          "technique_id": "T1059.001"
        }
        

        {}
        

Usage

To use this MCP server, you need to have an MCP client configured to connect to it. Once connected, you can use the provided tools to query ATT&CK techniques and tactics.

MCP Client 配置说明

1. 本地 stdio 方式（推荐 Smithery/本地集成）

  python main.py
  

2. HTTP/Streamable 方式（远程/开发/调试）

  python main.py --mode http --host 0.0.0.0 --port 8081 --log-level info
  

  export ATTACK_MCP_MODE=http
  export ATTACK_MCP_HOST=0.0.0.0   # 可选，默认 0.0.0.0 或 $HOST
  export ATTACK_MCP_PORT=8081      # 可选，默认 8081 或 $PORT
  export ATTACK_MCP_LOG_LEVEL=info # 可选，默认 info
  python main.py
  

    {
      "technique_id": "T1059.001"
    }
    

    {
      "tech_name": "phishing"
    }
    

    {
      "tech_name": "phishing"
    }
    

    {
      "technique_id": "T1059.001"
    }
    

    {
      "technique_id": "T1059.001"
    }
    

    {}
    

    {}
    

> 具体的客户端配置方式请参考您的 MCP 客户端文档，将上述服务地址和工具名称填入对应位置即可。

Installation

1. Clone this repository. 2. Install the required dependencies using pip install -r requirements.txt. 3. Configure the MCP server in your MCP client.

ATT&CK

ATT&CK is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary's attack lifecycle and the platforms they are known to target. ATT&CK is useful for understanding security risks against any specific technology or organization.

快速启动

方式一：直接用 Python 脚本运行（开发/调试推荐）

1. 安装依赖（建议在虚拟环境中）：

   pip install -r requirements.txt
   

   python main.py
   

   python main.py --mode http --host 127.0.0.1 --port 8081
   

方式二：生产环境推荐（Docker 部署）

#### Docker 1. 构建镜像：

   docker build -t attack-mcp-server .
   

   docker run -p 8081:8081 attack-mcp-server