MITRE ATT&CK Mapper MCP

Buy Starter — £29/mo

Signed attestations + unlimited audits + email support. 👉 Subscribe at meok.ai — instant HMAC signing key + Stripe-managed billing.

Free tier remains MIT-licensed and zero-config. Upgrade only when you need signed compliance artefacts for audit.

MITRE ATT&CK matrix lookup, tactic/technique/sub-technique mapper, and incident-to-technique correlation for cyber defenders.

Install

pip install mitre-attack-mcp

Tools

Tool	Purpose
query_technique	Query ATT&CK technique by ID (Txxxx) or name
list_tactics	All 14 enterprise tactics (TA0001-TA0040+)
map_incident	Map incident IOCs/behaviors to ATT&CK techniques
group_threat_actor	Threat actor groups (G-codes) using a technique
mitigation_lookup	Mitigations (M-codes) for a technique

Pairs with

• meok-attestation-api — POST results to https://meok-attestation-api.vercel.app/sign for cryptographically signed compliance certs
• meok-attestation-verify — public verification of any MEOK-signed cert
• Other MEOK governance MCPs via SOV3 mcp_bridge_call

Pricing

• Free: 10 calls/day. No API key required.
• Pro £79/mo: unlimited + signed attestations. Subscribe
• Enterprise £1,499/mo: white-label + on-premise + SLA. hello@meok.ai

Status

Scaffold v1.0.0 ships the MCP framework + 5 tool stubs. v1.1.0 will add real regulation data ingestion.

If your team needs this MCP fully-loaded faster, ping hello@meok.ai for sponsored development.

Wire it up — full stack

Pair this with the MEOK chain that turns one agent action into ONE signed compliance event:

1. bft-progress-council-mcp — anti-loop guardrail
2. agent-token-budget-mcp — hard spend cap
3. agent-prompt-injection-firewall-mcp — OWASP LLM01 scan
4. agent-audit-logger-mcp — hash-chained evidence
5. a2a-governance-bridge-mcp — fold N attestations → 1 signed event
6. agent-incident-relay-mcp — broadcast incidents to 5 regimes simultaneously

See meok.ai/mcp-stack for the architecture and meok.ai/mcp-stack/demo for the live in-browser demo.

License

MIT © MEOK AI Labs

<!-- mcp-name: io.github.CSOAI-ORG/mitre-attack-mcp -->