attack-query-mcp

MCP server for ATT&CK queries via AI assistants.

Overview

This package provides a Model Context Protocol (MCP) server that enables AI assistants like Claude to query MITRE ATT&CK data using natural language.

Installation

pip install attack-query-mcp

Usage

With Claude Desktop

Add to your Claude Desktop configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "attack-query": {
      "command": "attack-query-mcp"
    }
  }
}

Standalone

attack-query-mcp

Tools

The MCP server provides 8 tools for querying ATT&CK data:

Example Tool Usage

User: What techniques does APT28 use for initial access?
AI: [calls query_attack with "techniques used by APT28 for initial access"]

User: Compare APT28 and APT29
AI: [calls compare_groups with group1="APT28", group2="APT29"]

User: What mitigations address phishing?
AI: [calls get_mitigations with technique_id="T1566"]

User: What techniques did APT28 use in 2023?
AI: [calls get_group_techniques_temporal with group="APT28", year=2023]

User: What techniques did APT29 use between 2020 and 2023?
AI: [calls get_group_techniques_temporal with group="APT29", start_year=2020, end_year=2023]

Note: Temporal queries approximate group activity by cross-referencing campaign data. Results only include techniques documented in campaigns, not all techniques attributed to the group.

Resources

The MCP server exposes 6 resources for browsing ATT&CK data:

Example Resource Usage

User: Show me all APT groups in ATT&CK
AI: [reads attack://groups resource]

User: What tactics are in the kill chain?
AI: [reads attack://tactics resource]

Resource Templates

The MCP server also provides resource templates for detailed lookups:

Example Resource Template Usage

User: Tell me about APT28
AI: [reads attack://groups/APT28 resource]

User: What is technique T1566?
AI: [reads attack://techniques/T1566 resource]

User: Who is Fancy Bear?
AI: [reads attack://groups/Fancy%20Bear resource]

Requirements

• Python 3.10+
• attack-query library

License

MIT