Mitre Attack MCP

MITRE ATT&CK MCP

MCP（模型上下文协议）服务器，提供对MITRE ATT&CK框架的访问，并生成用于覆盖可视化的ATT&CK导航层。


特性

• 完整的ATT&CK框架访问权限 -查询技术、策略、组、软件、缓解措施和数据源
• 导航图层生成 -创建ATT&CK Navigator图层以实现覆盖可视化
• 覆盖分析 -分析您的检测覆盖范围并找出差距
• 基于威胁的差距分析 -将您的覆盖范围与特定威胁组进行比较
• 全文检索 -SQLite FTS5支持跨技术名称和描述的搜索
• 自动索引 -首次运行时自动下载ATT&CK数据并建立索引
• 与安全检测mcp配合使用 -将您的检测规则与ATT&CK技术进行交叉引用

快速开始

选项1:npx（推荐）

无需安装：

npx -y mitre-attack-mcp

选项2：克隆和构建

git clone https://github.com/MHaggis/mitre-attack-mcp.git
cd mitre-attack-mcp
npm install
npm run build

配置

光标IDE

添加到MCP配置(~/.cursor/mcp.json 或 .cursor/mcp.json):

{
  "mcpServers": {
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-attack-mcp"],
      "env": {
        "ATTACK_DOMAIN": "enterprise-attack"
      }
    }
  }
}

克劳德桌面版

添加到 ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-attack-mcp"],
      "env": {
        "ATTACK_DOMAIN": "enterprise-attack"
      }
    }
  }
}

环境变量

有效域： enterprise-attack, mobile-attack, ics-attack

MCP工具

技术查询

威胁情报

防御性语境

导航图层生成

分析

示例工作流

分析您的检测覆盖范围

You: "I have these technique IDs from my detection rules: T1059.001, T1059.003, T1547.001, T1053.005. 
      What's my coverage like?"

LLM uses: analyze_coverage(covered_ids=["T1059.001", "T1059.003", "T1547.001", "T1053.005"])

Returns:
{
  "total_techniques": 625,
  "covered_techniques": 4,
  "coverage_percentage": 0.6,
  "by_tactic": {
    "execution": { "total": 45, "covered": 2, "percentage": 4 },
    "persistence": { "total": 52, "covered": 2, "percentage": 4 },
    ...
  },
  "gaps": ["T1059.002", "T1059.004", ...]
}

生成覆盖导航层

You: "Generate a Navigator layer showing my coverage"

LLM uses: generate_coverage_layer(
  covered_ids=["T1059.001", "T1059.003", "T1547.001"],
  name="My Detection Coverage"
)

Returns: Navigator layer JSON (paste into https://mitre-attack.github.io/attack-navigator/)

与威胁组进行比较

You: "What APT29 techniques am I missing?"

LLM uses: 
1. get_group_techniques(group_id="G0016")  
2. find_group_gaps(group_id="G0016", covered_ids=[your techniques])

Returns: List of technique IDs APT29 uses that you don't have coverage for

生成差距分析层

You: "Show me a visual of my gaps against APT29"

LLM uses: generate_gap_layer(
  covered_ids=[your techniques],
  target_ids=[APT29 techniques],
  name="APT29 Gap Analysis"
)

Returns: Navigator layer showing green=covered, red=gaps

🔗 与安全检测MCP一起使用

此MCP与 安全检测mcp 创建完整的威胁检测工作流程：

组合工作流示例

You: "What's my MITRE coverage based on my Splunk detections?"

LLM workflow:
1. Query detections-mcp → get_stats() to see total detections with MITRE mappings
2. Query detections-mcp → list_by_mitre_tactic("execution") to get technique coverage
3. Query mitre-attack-mcp → analyze_coverage(covered_ids) to analyze gaps
4. Query mitre-attack-mcp → generate_coverage_layer() to visualize

Result: Full coverage analysis with visual Navigator layer

两者一起安装

将两者都添加到您的 ~/.cursor/mcp.json:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/path/to/sigma/rules",
        "SPLUNK_PATHS": "/path/to/security_content/detections",
        "ELASTIC_PATHS": "/path/to/detection-rules/rules"
      }
    },
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-attack-mcp"],
      "env": {
        "ATTACK_DOMAIN": "enterprise-attack"
      }
    }
  }
}

导航器图层输出

JSON层与 ATT&CK 导航器:

{
  "name": "My Detection Coverage",
  "versions": { "attack": "18", "navigator": "5.1.0", "layer": "4.5" },
  "domain": "enterprise-attack",
  "techniques": [
    { "techniqueID": "T1059.001", "score": 100, "color": "#31a354", "comment": "Covered" },
    { "techniqueID": "T1059.003", "score": 0, "color": "#ff6666", "comment": "Gap" }
  ],
  "gradient": { "colors": ["#ff6666", "#fdae6b", "#31a354"], "minValue": 0, "maxValue": 100 }
}

要可视化：

1. 首选https://mitre-attack.github.io/attack-navigator/
2. 点击“打开现有图层”→ “从本地上传”
3. 粘贴JSON

数据库

ATT&CK指数存储在 ~/.cache/mitre-attack-mcp/attack.sqlite.

• 首次运行时自动从MITRE下载STIX数据
• 缓存7天
• 使用 rebuild_index() 强制刷新

统计数据（企业ATT&CK v18）

发展

npm install
npm run build
npm start

# Or with watch mode
npm run dev

许可证

Apache 2.0