How do I connect Mitre MCP Server to Claude?

Run `claude mcp add lidless-labs-mitre-mcp -- npx -y mitre-mcp` in Claude Code, or add the same command and arguments under mcpServers in Cursor's mcp.json or Claude Desktop's claude_desktop_config.json, then restart the client. The blocks above are ready to paste.

Is Mitre MCP Server free?

The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.

What can Mitre MCP Server do?

Mitre MCP Server documents 40 tools to the agent, including map-incident-to-attack, mitre_attack_path, mitre_campaign_profile. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.

Mitre MCP

Unclaimed

by lidless-labs

MCP server for the MITRE ATT&CK knowledge base: map alerts to techniques, profile threat groups, analyze detection coverage, and enrich SOC workflows from an AI client.

Set up this server

Compare servers My Stack

01 / Choose your client

02 / Before you connect

Authentication is not specified. Check the project instructions before connecting.

Install the runtime required by the project and make it available to your client.

Project instructionsEnvironment variable names (optional)

Use names from the project instructions, separated by commas. Enter names only, never secret values.

03 / Add the configuration

Source: generated from public install instructions

claude mcp add --transport stdio 'lidless-labs-mitre-mcp' -- 'npx' '-y' 'mitre-mcp'

Run in your terminal after replacing any placeholders.

04 / Check it in your client

Open your client’s MCP settings and confirm the server connects and lists its tools. A copied configuration does not confirm a working connection.

ai-agentsatt-ckcybersecuritymcpmitre-attackmodel-context-protocolthreat-modelinglidless-labsclaudemcp-server

Is this your MCP server?

This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.

Claim this server

Security profile

Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works

40 of 40 tools

Documented tools (40)

From project documentation. A server handshake does not verify each tool’s description or behavior.

map-incident-to-attack

Map incident observables to ATT&CK techniques

mitre_attack_path

Generate possible attack paths through the kill chain

mitre_campaign_profile

Build a technique profile with group/software/campaign matching

mitre_cortex_analyzer_coverage

Map Cortex analyzers to ATT&CK data sources

mitre_cortex_run_analyzers

Run analyzers on observables with ATT&CK context (write-gated)

mitre_cross_correlate

Search for techniques across Wazuh, TheHive, and MISP simultaneously

mitre_data_version

Get current data version and object counts

mitre_detection_coverage

Analyze detection coverage based on available data sources

mitre_get_campaign

Get campaign details with techniques, software, and groups

mitre_get_datasource

Get data source details with detectable techniques

mitre_get_group

Get group details including techniques and software used

mitre_get_mitigation

Get mitigation details with addressed techniques

mitre_get_software

Get software details with techniques and associated groups

mitre_get_tactic

Get tactic details with all associated techniques

mitre_get_technique

Get full details of a technique by ID (T1059, T1059.001)

mitre_list_campaigns

List all known ATT&CK campaigns

mitre_list_groups

List all known threat groups

mitre_list_tactics

List all tactics in kill-chain order

mitre_map_alert_to_technique

Map security alerts to likely ATT&CK techniques

mitre_map_wazuh_alert

Map Wazuh alerts to ATT&CK techniques by rule ID/description/groups

mitre_misp_create_event

Create events pre-tagged with ATT&CK techniques (write-gated)

mitre_misp_event_to_attack

Map MISP event attributes/galaxies to ATT&CK

mitre_misp_list_events

List events with ATT&CK enrichment

mitre_misp_search_indicators

Search MISP IOCs by technique or group

mitre_mitigations_for_technique

Get all mitigations for a specific technique

mitre_navigator_layer

Generate ATT&CK Navigator JSON layers (coverage, group, campaign, diff)

mitre_search_campaigns

Search campaigns by keyword or technique

mitre_search_groups

Search groups by keyword or technique usage

mitre_search_mitigations

Search mitigations by keyword

mitre_search_software

Search software by name, technique, or type (malware/tool)

mitre_search_techniques

Search techniques by keyword, tactic, platform, data source

mitre_soc_status

Connection status for all SOC integrations

mitre_technique_overlap

Find technique overlap between groups for attribution

mitre_thehive_create_case

Create a case pre-populated with ATT&CK context (write-gated)

mitre_thehive_enrich

Enrich a TheHive case with ATT&CK techniques and mitigations

mitre_thehive_list_cases

List cases with ATT&CK technique filtering

mitre_update_data

Force update of the local ATT&CK data cache

mitre_wazuh_alerts

Fetch recent alerts enriched with ATT&CK context

mitre_wazuh_rule_coverage

Analyze Wazuh rules mapped to ATT&CK techniques

mitre_wazuh_status

Wazuh manager status, agents, and rule stats

Tool change history

Compared across complete checks of the same configuration. Tools were listed, not invoked. Input-schema changes are not measured here.

No complete tool checks yet.

FAQ

Questions about Mitre MCP Server

How do I connect Mitre MCP Server to Claude?: Run `claude mcp add lidless-labs-mitre-mcp -- npx -y mitre-mcp` in Claude Code, or add the same command and arguments under mcpServers in Cursor's mcp.json or Claude Desktop's claude_desktop_config.json, then restart the client. The blocks above are ready to paste.
Is Mitre MCP Server free?: The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
What can Mitre MCP Server do?: Mitre MCP Server documents 40 tools to the agent, including map-incident-to-attack, mitre_attack_path, mitre_campaign_profile. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.