# MITRE ATT&CK MCP Server
A Model Context Protocol (MCP) server that provides a graph-based interface for the [MITRE ATT&CK® Framework](https://attack.mitre.org/).
This server ingests the STIX 2.1 data for ATT&CK, builds an in-memory NetworkX graph, and exposes tools for Large Language Models to search, traverse relationships, and generate ATT&CK Navigator layers.
## 🚀 Features
* **Knowledge Graph:** Queries a structured graph of Techniques, Groups, Mitigation, and Data Components.
* **Deep Relationship Traversal:** Trace links from Techniques → Detection Strategies → Analytics → Data Components.
* **Navigator Integration:** Generate valid `layer.json` files on the fly based on conversation context.
* **Secure Supply Chain:** Verifies the SHA256 hash of MITRE data to prevent tampering.
* **Fast Execution:** Uses `uv` for dependency management and caching.
## 🛠️ Tools Available
The following tools are exposed to the MCP client:
| Tool Name | Description |
| :--- | :--- |
| `search_knowledge_base` | Search for any ATT&CK object (Technique, Group, Software) by ID (e.g., T1059) or fuzzy name match. |
| `explore_relationships` | Traverse the graph from a starting entity up to a specified depth (default: 2). Useful for finding "What groups use this software?" or "How do I detect this?" |
| `get_entity_details` | Retrieves deep context for an entity. For Techniques, it returns Mitigations and Detection Analytics. For Groups, it aggregates used Software/Malware. |
| `list_techniques_in_tactic` | Lists all techniques belonging to a specific Tactic (e.g., "Persistence", "Discovery"). |
| `generate_navigator_layer` | Creates a MITRE ATT&CK Navigator JSON layer highlighting specific techniques with a score and color. |
## 📦 Installation & Setup
### Prerequisites
* **Python 3.11+**
* **[uv](https://github.com/astral-sh/uv)** (Modern Python package manager)
### 1. Clone and Sync
Navigate to the project directory and install dependencies. `uv` will automatically create a virtual environment and install the exact versions defined in `uv.lock`.
cd attack-mcp-server uv sync
### 2.验证安装
运行服务器入口点以确保图形正确构建。
uv run python -m attack_mcp.main
*注意：第一次运行将下载ATT&CK STIX数据。*
## ⚙️ 配置
文件 `src/attack_mcp/config.py` 控制加载哪个Matrix并管理安全设置。
### 交换矩阵
默认情况下，服务器加载 **企业ATT&CK**。切换到 **移动** 或 **工业控制系统**，打开 `config.py` 并对相应的块进行注释/取消注释：
Example: Switch to Mobile
ATTACK_STIX_URL = ".../enterprise-attack.json" <-- Comment this out
ATTACK_DOMAIN = "enterprise-attack"
ATTACK_STIX_URL = ".../mobile-attack.json" <-- Uncomment this ATTACK_DOMAIN = "mobile-attack"
## 🔒 安全最佳实践
### 1.供应链完整性（哈希验证）
为了防止篡改或数据损坏，您应该“固定”STIX文件的哈希值。
1. **开发模式（首次使用时信任）：**
集 `ATTACK_STIX_HASH = None` 在 `config.py`。运行服务器。它将把检测到的下载文件的SHA256哈希打印到控制台。
1. **安全模式：**
复制该哈希并将其粘贴到 `config.py`:
ATTACK_STIX_HASH = "59b2..." # Paste actual hash here
现在，服务器将在每次启动时严格验证文件完整性。
### 2.文件系统安全
所有生成的文件（例如导航层）仅限于 `outputs/` 目录。服务器清理文件名以防止路径遍历攻击（例如。， `../../etc/passwd`).
## 📂 项目结构
attack-mcp-server/ ├── pyproject.toml # Dependencies & Project Config ├── uv.lock # Lockfile for reproducible builds ├── src/ │ └── attack_mcp/ │ ├── main.py # Entry point │ ├── server.py # MCP Server Initialization │ ├── config.py # Matrix Selection & Security Config │ ├── core/ # Logic for STIX/NetworkX │ └── resources/ # Tool Definitions
## 📝 许可证
本项目使用来自的公共数据 [MITRE ATT&CK 公司®](https://attack.mitre.org/)，这取决于 [MITRE使用条款](https://attack.mitre.org/resources/terms-of-use/).