Mitre Attck

io.github.pipeworx-iov0.1.2更新於 Oct 1, 2026

MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.

已驗證Streamable HTTP可網頁執行Security & MonitoringKnowledge & Memory

概覽

AI 產生的概覽

讓助理從官方 STIX 資料包查詢 MITRE ATT&CK 的戰術、技術、威脅組織、軟體與緩解措施。

功能
提供來自 MITRE 官方 STIX 2.1 資料包的 MITRE ATT&CK 資料，並在套件內快取一小時。工具包括 technique(id)、tactic(id_or_short_name)、group(id)、software(id)、mitigation(id)、search(query, type?) 以及用於 enterprise、mobile、ics 資料包的 domains()。可作為遠端端點存取，也可在本機以 stdio 方式執行。
適用情境
適合助理在安全分析與報告中把威脅活動對應到 ATT&CK 編號、說明某項技術或組織，或檢索 ATT&CK 語料。需要結構化 ATT&CK 查詢而非一般網頁搜尋時選用。
執行需求
可使用閘道上的遠端 streamable HTTP 端點，或使用 Node.js 與 npx 執行本機 stdio 套件。基本呼叫未宣告需要帳號、API 金鑰或環境變數；取得上游 STIX 資料包需要網路存取。
安裝前請注意
遠端套件端點還會暴露共享的閘道中繼工具，例如 ask_pipeworx、discover_tools、search_within 以及 remember/recall，這些會增加 schema，並可能把問題路由到本套件之外。本機 stdio 套件只列出本套件工具。資料為唯讀參考資料，依賴前請對照 MITRE 核實 ATT&CK 編號。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Mitre Attck，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "mitre-attck": {
      "type": "http",
      "url": "https://gateway.pipeworx.io/mitre-attck/mcp"
    }
  }
}

README

@pipeworx/mitre-attck

MITRE ATT&CK MCP — adversary tactics, techniques, and procedures (TTPs). Sources the official STIX 2.1 bundles from MITRE's GitHub. Cached 1h in-pack.

Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.

Tools

  • technique(id) — technique by ATT&CK id (e.g. T1190, T1059.001)
  • tactic(id_or_short_name) — tactic record
  • group(id) — threat group (e.g. G0007 APT28)
  • software(id) — software/malware (e.g. S0002 Mimikatz)
  • mitigation(id) — mitigation
  • search(query, type?) — substring search across the bundle
  • domains() — list loaded STIX bundles (enterprise, mobile, ics)

Data source

https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json (and mobile + ics).

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):

json
{  "mcpServers": {    "mitre-attck": {      "url": "https://gateway.pipeworx.io/mitre-attck/mcp"    }  }}

What this endpoint actually serves

tools/list at https://gateway.pipeworx.io/mitre-attck/mcp returns the tools in the table above plus the shared Pipeworx meta-tools — ask_pipeworx, discover_tools, search_within, remember/recall and the rest of the gateway-wide set. So the tool count you see is larger than this table: a single-pack endpoint currently lists roughly 30 shared tools alongside the pack's own. The connection's initialize response states its exact scope, and is the authoritative answer for a given day.

This is deliberate, not multiplexing by accident. The meta-tools are what let a scoped connection answer a question this pack does not cover — via ask_pipeworx, which routes across the whole catalog — without you adding a second MCP server. There is currently no way to mount a pack endpoint without them; if the extra schemas cost you more context than the routing is worth, connect to the full gateway once rather than to several pack endpoints.

Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:

json
{  "mcpServers": {    "pipeworx": {      "url": "https://gateway.pipeworx.io/mcp"    }  }}

Both URLs reach the same gateway and the same 1683+ data sources. The only difference is which pack's tools are listed directly; ask_pipeworx reaches all of them from either one.

No MCP client? Call it over HTTP

bash
curl -X POST https://gateway.pipeworx.io/v1/tools/technique \  -H 'Content-Type: application/json' \  -d '{"id":"T1566"}'

No account needed for the first calls. Inspect any tool: GET https://gateway.pipeworx.io/v1/tools/technique. Find one: POST https://gateway.pipeworx.io/v1/tools/search_packs with {"query":"..."}.

Standalone (no gateway account)

This package also runs as a local stdio MCP server — no Pipeworx account, no gateway round-trip:

json
{  "mcpServers": {    "mitre-attck": {      "command": "npx",      "args": ["-y", "@pipeworx/mcp-mitre-attck"]    }  }}

Or run it directly to confirm it starts:

bash
npx -y @pipeworx/mcp-mitre-attck

It speaks MCP over stdin/stdout and answers initialize/tools/list/tools/call for only this pack's tools — none of the shared meta-tools the gateway connection above adds. Same source, same tools, no ask_pipeworx routing.

Using with ask_pipeworx

Instead of calling tools directly, you can ask questions in plain English — this works on the pack endpoint above as well as on the full gateway:

ask_pipeworx({ question: "your question about Mitre Attck data" })

The gateway picks the right tool and fills the arguments automatically.

More

License

MIT

來源：README.md，提交 cd4330e

工具

0
工具後設資料尚未被收錄。

版本歷史

3
  1. v0.1.2最新Sep 27, 2026
  2. v0.1.1Sep 25, 2026
  3. v0.1.0Sep 16, 2026