- Conduid
- Marketplace
- #mitre-attack
MCP servers tagged mitre-attack
39 live MCP servers tagged "mitre-attack", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with mitre-attack.
Traildiscover
An evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real-world incidents, references and security implications
Anthropic Cybersecurity Skills
Accelerate AI security workflows with 817 open-source skills across 29 domains for six leading agent frameworks.
Kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scannin…
AiSOC
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
Stride Gpt
An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.
Attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tail…
Mitre MCP
MCP server for the MITRE ATT&CK knowledge base: map alerts to techniques, profile threat groups, analyze detection coverage, and enrich SOC workflows from an AI client.
ZettelForge
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
SecuritySkills
Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Codex CLI, OpenClaw, Kiro.
Sectinel
Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any…
Mitre Attack MCP
🔌 Exposes MITRE ATT&CK matrix lookup + tactic/technique mapper over MCP — MIT
Threat Hunting MCP Server
A minimal, modular MCP server that equips your AI with practical capabilities for real-world threat hunting workflows.
Malware Sandbox MCP
Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhaus, Feodo, URLScan & VirusTotal — straig…
Agentmetry
Local-first flight recorder for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.
Dfir Threat Intel Platform
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
Claudera
MCP server for Apache Caldera adversary emulation software, enabling control from inside your desktop AI client
Atr
Rust loader and matcher for Agent Threat Rules YAML. Vendors the upstream ATR ruleset (MIT, ATR Contributors).
SOC Sentinel Splunk
Agentic SOC analyst for Splunk — Claude investigates via the Splunk MCP Server; a deterministic 3-layer validator verifies every finding against real data. An anti-hallucination t…
ThreatIntelMCP
A production-oriented Threat Intelligence platform that collects, enriches, and serves cybersecurity intelligence using Python, PostgreSQL, AI, and the Model Context Protocol (MCP…
Threat Intelligence Pipeline
Correlates every NVD CVE with CWE, CAPEC, ATT&CK, D3FEND, OWASP, CISA KEV, Vulnrichment SSVC, and EPSS, with APT links only where MITRE ATT&CK cites the CVE. Search-first web app,…
Splunkology
Autonomous SOC triage agent for Splunk — live SPL, MITRE ATT&CK verdicts, tamper-evident audit log, pluggable orchestration over a Splunk MCP server.
SOCLOOM
SOC operations woven with 800+ security skills, ML detection & MITRE ATT&CK — open-source AI-native SOC platform
Ovogo
Ovogo: Autonomous Red Team Coordination Engine. 基于 AI Agent 的自动化渗透测试与红队协同引擎（专为靶场环境设计），支持 MITRE ATT&CK 攻击链生成、多节点并行利用与 Flag 自动化收集。
Nsauditor AI
NSAuditor AI — Open-source, AI-powered network security scanner. 27 plugins, CVE matching, MITRE ATT&CK mapping, verified vulnerabilities, continuous monitoring, MCP integration.…
WRG-11/wrg-sigma-rules
rule production corpus across 11 MITRE ATT&CK tactic categories. Standalone server + Claude Code plugin distribution.
Tenable Attack Mapper
MCP server that maps Tenable Security Center findings to the MITRE ATT&CK framework, then lets you ask your LLM (Claude Code) to analyze exposure by specific tactic or technique i…
Prescryb
MCP server for CVE/config remediation orchestration: SSH inventory, OSV/NVD lookups, CIS/DISA STIG-mapped Ansible playbook suggestions.
Agentic Dfir
Agentic-DFIR — autonomous digital forensics & incident response agent. Architecture-first, not prompt-first: typed read-only MCP tool surface, SHA-256 audit chain, senior-analyst…
Hermes Pentest Lab
AI-orchestrated, Kali-native pentesting lab: an MCP tool-server with scope/VPN/rate/audit enforced in code, independent finding verification, MITRE ATT&CK + OWASP mapping, a reusa…
Nsauditor AI Agent Skill
AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows. Works with Claude Code, Cu…
Secnews
v0.8.1: 面向 AI + 安全从业者的单人本地工作站 · Sentinel Terminal 三层工作流 (Data/Judge/Action) · llm-wiki-2.0 wiki-first 知识库 · CodeGarden 项目全生命周期 · 七 gate 开闸 + 运行时弹性层 + graceful shutdown · MCP 开放 19…
Secops Agent Triage
Tool-calling SOC triage agent with multi-format alert ingestion, threat-intelligence enrichment, and structured NIST/MITRE assessments.
Agent Security
AI agent security scanner — 176 detection patterns with taint analysis, auto-classification, and context flow tracing. OWASP ASI + MCP security.
Splunk SOAR Playbook Lab
Validate SOAR playbooks against BOTS v3 evidence using Splunk MCP, MITRE ATT&CK, VirusTotal, and approval-gated dry runs.
Copilot MCP Soc Pack
Community SOC Pack for Microsoft Security Copilot. Free-API MCP server and OpenAPI plugin bundle (KEV, EPSS, MITRE ATTACK, Abuse.ch, GreyNoise, AbuseIPDB, crt.sh, ransomware.live,…
Cti Glossary
MCP server for CTI and cyber jargon disambiguation — MITRE ATT&CK, OFAC SDN, and a hand-curated cross-vendor threat-actor alias map, with FTS5 full-text search across sources
Threat Dashboard
SOC desktop app in Zig + Vulkan: triage/hunt/detect/intel workspaces, YARA rules-as-code with CI quality gates, ATT&CK coverage mapping, dbt-style pipelines, and an embedded Claud…
Payload Entropy Studio
Multi-Vector Threat Analyzer, Shannon Entropy Profiler, Recursive De-obfuscator, and Studio (design influenced by Material 3)
Soc Watchfloor
No description published.