Mitre Attck

io.github.pipeworx-iov0.1.2更新于 Oct 1, 2026

MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.

已验证Streamable HTTP可网页运行Security & MonitoringKnowledge & Memory

概览

AI 生成的概览

让助手从官方 STIX 数据包中查询 MITRE ATT&CK 的战术、技术、威胁组织、软件与缓解措施。

功能
提供来自 MITRE 官方 STIX 2.1 数据包的 MITRE ATT&CK 数据，并在包内缓存一小时。工具包括 technique(id)、tactic(id_or_short_name)、group(id)、software(id)、mitigation(id)、search(query, type?) 以及用于 enterprise、mobile、ics 数据包的 domains()。既可作为远程端点访问，也可在本地以 stdio 方式运行。
适用场景
适合助手在安全分析与报告中把威胁活动映射到 ATT&CK 编号、解释某项技术或组织，或检索 ATT&CK 语料。需要结构化 ATT&CK 查询而非通用网页搜索时选用。
运行要求
可使用网关上的远程 streamable HTTP 端点，或使用 Node.js 与 npx 运行本地 stdio 包。基本调用未声明需要账户、API 密钥或环境变量；获取上游 STIX 数据包需要网络访问。
安装前请注意
远程包端点还会暴露共享的网关元工具，例如 ask_pipeworx、discover_tools、search_within 以及 remember/recall，这些会增加 schema，并可能把问题路由到本包之外。本地 stdio 包只列出本包工具。数据为只读参考资料，依赖前请对照 MITRE 核实 ATT&CK 编号。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Mitre Attck，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "mitre-attck": {
      "type": "http",
      "url": "https://gateway.pipeworx.io/mitre-attck/mcp"
    }
  }
}

README

@pipeworx/mitre-attck

MITRE ATT&CK MCP — adversary tactics, techniques, and procedures (TTPs). Sources the official STIX 2.1 bundles from MITRE's GitHub. Cached 1h in-pack.

Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.

Tools

  • technique(id) — technique by ATT&CK id (e.g. T1190, T1059.001)
  • tactic(id_or_short_name) — tactic record
  • group(id) — threat group (e.g. G0007 APT28)
  • software(id) — software/malware (e.g. S0002 Mimikatz)
  • mitigation(id) — mitigation
  • search(query, type?) — substring search across the bundle
  • domains() — list loaded STIX bundles (enterprise, mobile, ics)

Data source

https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json (and mobile + ics).

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):

json
{  "mcpServers": {    "mitre-attck": {      "url": "https://gateway.pipeworx.io/mitre-attck/mcp"    }  }}

What this endpoint actually serves

tools/list at https://gateway.pipeworx.io/mitre-attck/mcp returns the tools in the table above plus the shared Pipeworx meta-tools — ask_pipeworx, discover_tools, search_within, remember/recall and the rest of the gateway-wide set. So the tool count you see is larger than this table: a single-pack endpoint currently lists roughly 30 shared tools alongside the pack's own. The connection's initialize response states its exact scope, and is the authoritative answer for a given day.

This is deliberate, not multiplexing by accident. The meta-tools are what let a scoped connection answer a question this pack does not cover — via ask_pipeworx, which routes across the whole catalog — without you adding a second MCP server. There is currently no way to mount a pack endpoint without them; if the extra schemas cost you more context than the routing is worth, connect to the full gateway once rather than to several pack endpoints.

Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:

json
{  "mcpServers": {    "pipeworx": {      "url": "https://gateway.pipeworx.io/mcp"    }  }}

Both URLs reach the same gateway and the same 1683+ data sources. The only difference is which pack's tools are listed directly; ask_pipeworx reaches all of them from either one.

No MCP client? Call it over HTTP

bash
curl -X POST https://gateway.pipeworx.io/v1/tools/technique \  -H 'Content-Type: application/json' \  -d '{"id":"T1566"}'

No account needed for the first calls. Inspect any tool: GET https://gateway.pipeworx.io/v1/tools/technique. Find one: POST https://gateway.pipeworx.io/v1/tools/search_packs with {"query":"..."}.

Standalone (no gateway account)

This package also runs as a local stdio MCP server — no Pipeworx account, no gateway round-trip:

json
{  "mcpServers": {    "mitre-attck": {      "command": "npx",      "args": ["-y", "@pipeworx/mcp-mitre-attck"]    }  }}

Or run it directly to confirm it starts:

bash
npx -y @pipeworx/mcp-mitre-attck

It speaks MCP over stdin/stdout and answers initialize/tools/list/tools/call for only this pack's tools — none of the shared meta-tools the gateway connection above adds. Same source, same tools, no ask_pipeworx routing.

Using with ask_pipeworx

Instead of calling tools directly, you can ask questions in plain English — this works on the pack endpoint above as well as on the full gateway:

ask_pipeworx({ question: "your question about Mitre Attck data" })

The gateway picks the right tool and fills the arguments automatically.

More

License

MIT

来源：README.md，提交 cd4330e

工具

0
工具元数据尚未被收录。

版本历史

3
  1. v0.1.2最新Sep 27, 2026
  2. v0.1.1Sep 25, 2026
  3. v0.1.0Sep 16, 2026