Open MCP

The technique record for an ATT&CK or ATLAS ID: description, tactics, platforms, sub-techniques, plus linked groups, software, campaigns, mitigations, data components, CAPEC patterns and ICS assets whose Purdue fields are curated from NIST SP 800-82r3 / ISA-95, not MITRE-published. Detection content is not returned here -- call get_technique_intelligence; regulatory frameworks, get_technique_compliance.

Detection and threat-intel layer for an ATT&CK or ATLAS technique: Sigma rules, Atomic Red Team tests, D3FEND countermeasures, detection strategies, plus top-N samples of threat reports, linked CVEs, IOCs and affected apps. Groups, mitigations and sub-techniques are in get_technique_detail; regulatory frameworks are not returned here -- call get_technique_compliance.

Tactic profile: description, domain and every technique under the tactic.

Malware or tool profile: type, platforms, aliases, techniques used, groups using it, campaigns. Find the ID with search_software.

Malware and tool summaries (with the malware/tool type) matching a name or description search, filterable by sector. Use get_software_detail for the full record.

Mitigation profile: description, domain and every technique it addresses. Find the ID with search_mitigations.

Mitigation summaries matching a name or description search -- no technique list. Use get_mitigation_detail for the techniques one addresses.

Data source profile: description, its data components and the techniques it can detect.

Cross-domain keyword search over ATT&CK techniques, groups, software, campaigns, mitigations and data sources plus OWASP categories and NIST CSF subcategories -- summaries only, up to 20 rows per type. Nothing else is searched, so an empty result says nothing about applications, advisories, CAPEC, Sigma, Atomic tests, external actors or ICS assets; use their own search_ tools. Prefer a dedicated search_ tool whenever the entity type is known.

ATT&CK corpus overview: entity counts, top groups, most-targeted techniques, sector breakdown and the ingested ATT&CK version. ATT&CK entities only -- no CVE, advisory or CAPEC totals.

Full threat group profile: every technique, software and campaign, plus targeted sectors and a capped list of affected applications. If you have only a name, call search_groups for the ID first. For country, motivation and state sponsor instead, use get_external_actor.

Threat group summaries matching a name or description search, filterable by sector and domain -- no technique counts. Use get_group_profile for the full record.

Campaign profile: first/last seen dates, techniques used, software deployed, groups involved. Find the ID with search_campaigns.

Campaign summaries matching a name or description search, filterable by sector, with first/last seen dates. Use get_campaign_detail for techniques, software and groups.

ETDA/ThaiCERT reference metadata for one external actor: country, motivation, state sponsor, suspected victims, MITRE group mapping. No techniques, software or campaigns -- use get_group_profile for TTPs. The lookup is an exact name match, so a miss means only that this dataset has no entry under that spelling; always try search_groups before calling an actor unknown. Browse the dataset with search_external_actors.

ETDA/ThaiCERT external actors by keyword, country or category, with motivation and MITRE group mapping. Keyword is whole-word full text over name and description, not substring, so a partial stem like lazar does not match Lazarus; country and category are exact equality. These rows are already near-complete -- get_external_actor adds only the first-seen date for one actor; for ATT&CK TTPs use search_groups.

Threat landscape for one industry sector: the groups targeting it plus their campaigns, software, top techniques and vulnerable applications. The cves field is a 4-row recent sample, not the full sector CVE set.

The most recently published threat-intelligence reports, newest first; no keyword, technique, actor or source filter exists here. For reports on one technique use get_technique_intelligence, for a group use get_group_profile.

Search indicators of compromise (IPs, domains, URLs, file hashes) from OTX, ThreatFox, MalwareBazaar and CISA KEV, newest first, with malware family and a count of linked ATT&CK techniques -- the technique IDs themselves are not returned. CVE rows are excluded unless type is cve or source is cisa_kev; use search_cves for vulnerabilities.

Search SigmaHQ detection rules: rule ID, title, severity level, log source and mapped ATT&CK technique. Keyword matches titles and rule IDs only, not rule logic, so a miss is not proof no rule covers it.

Search Atomic Red Team emulation tests: test name, platforms, executor type, the run and cleanup commands, and the ATT&CK technique covered. Keyword matches test names and technique IDs only.

CVE summary rows by keyword, severity, date or product: CVSS, EPSS, CWE, linked ATT&CK IDs and affected apps, ordered newest first, not worst first. get_cve_detail has the full record. version matches text in an affected range, not a verdict that the version is vulnerable; say so.

Full record for one CVE: CWEs, CVSS, EPSS, affected apps, OWASP categories, KEV status, GHSA alias, and osvAdvisories -- the distro and kernel advisories aliasing it, which answer which distros are affected. CAPEC patterns and ATT&CK techniques are inferred from shared CWEs, not published per-CVE; attribute them that way. version matches text in an affected range, not a verdict that the version is vulnerable; say so. Find a CVE ID with search_cves.

Open-source packages affected by one CVE via its GHSA alias, with vulnerable and fixed ranges. An empty list means no GHSA alias or a failed lookup, never proof that no package is affected -- check osvAdvisories in get_cve_detail.

Summary rows for the 615 CAPEC attack patterns by keyword, abstraction, severity or likelihood, with CWE refs and mapped technique and mitigation counts; get_capec_detail has the full record. The keyword matches name and ID only, never description text.

Full record for one CAPEC attack pattern: prerequisites, skills and resources needed, consequences, linked CWEs, mapped ATT&CK techniques, mitigations and related patterns. search_capec finds an ID.

Security posture for one vendor and product: CVEs, CWE profile, reachable ATT&CK techniques and threat groups; search_applications finds the exact vendor and product pair. version narrows the CVE list by text in an affected range, not a verdict that the version is vulnerable; say so.

Application summary rows by name: vendor, product, CVE count; get_application_security has the full posture. version (requires search) keeps only products with an advisory whose range text mentions it -- not a verdict that the version is vulnerable; say so.

Unified summary rows over GHSA (OSS packages) and OSV (OS, distro, kernel), each tagged with its source; the two sets are disjoint, so no duplicates. Filter by source, severity, ecosystem, date or CVE-alias presence; rows are severity-ranked, then newest. Full record: get_ghsa_detail or get_osv_detail. This is the unified GHSA+OSV view; search_ghsa queries the GHSA corpus directly, returns more rows for the same query and adds techniqueCount and withdrawnAt, so prefer it when ATT&CK linkage or withdrawal status matters.

GHSA-only summary rows (OSS packages) by keyword, severity, ecosystem or date, newest first; get_ghsa_detail has the full record. For OS, distro and kernel advisories or a combined view use search_advisories; to narrow by package version use get_package_vulnerabilities.

Full record for one GitHub Security Advisory: summary, CVSS v3 and v4, CWEs, affected packages with vulnerable and fixed ranges. CAPEC patterns and ATT&CK techniques are inferred from shared CWEs, not published by GitHub; attribute them that way. version matches text in an affected range, not a verdict that the version is vulnerable; say so. Find an ID with search_ghsa.

Full record for one OSV advisory by native ID (DSA-, USN-, RLSA-, ALAS-): summary, aliases (CVE and GHSA), CVSS, affected packages by ecosystem with vulnerable ranges. Distro, kernel and OS ecosystems only -- use get_ghsa_detail for OSS packages, search_advisories to find an ID.

Every advisory affecting one package in one ecosystem (exact name match). GHSA ecosystems (npm, pypi, go, maven...) carry vulnerable and fixed ranges and linked ATT&CK techniques; OSV distro ones (Debian, Ubuntu, Alpine...) carry neither, and their null ranges mean not modelled, never no fix. version applies to GHSA only, is ignored for OSV, and matches text in an affected range, not a verdict that the version is vulnerable; say so.

Direct per-technique control mappings for one ATT&CK technique: NIST 800-53, NIST CSF v2 subcategories, MITRE Engage, VERIS, AWS/Azure/GCP cloud controls and OWASP categories. For regulatory regimes (NIS2, DORA, PCI DSS, ISO 27002, HIPAA, GDPR, CMMC, ...) use get_technique_compliance instead -- those come from the SCF crosswalk, not from here.

Lists the OWASP Top 10 categories for Web 2021, ML 2023 and LLM 2025 with per-category CWE, ATT&CK technique, ATLAS and CVE counts. Use get_owasp_category for one category in full.

Full record for one OWASP category: CWEs, mapped ATT&CK and ATLAS techniques, top CVEs, affected applications, and related categories in the other OWASP frameworks. get_owasp_top10 lists the categories.

Lists the compliance and regulatory frameworks bridged to ATT&CK through the Secure Controls Framework (SCF), each with its framework_key slug and coverage counts (SCF controls, techniques referenced, techniques referenced by 2 or more controls). Default is the curated 21 Tier 1+2 set; include_all adds the Tier 3 long tail. Call this first to confirm a slug, then get_compliance_framework for one framework in full.

Full record for one framework by framework_key: every ATT&CK technique it references, grouped by article or section with the ref_id that cites each, plus the frameworks it overlaps most. Returns 404 for an unknown key -- never invent a slug; call list_compliance_frameworks to confirm it.

Which compliance frameworks reference a single ATT&CK technique, with the SCF control count per framework and up to 8 of the article or section ref_ids that cite it -- a sample, not the full citation list. Takes T-IDs only -- ATLAS AML IDs are rejected. An empty frameworks array is authoritative not-covered for the tiers queried (Tier 1+2 unless include_all): do not infer or invent a mapping. For direct ATT&CK mappings (800-53, Engage, VERIS, cloud controls) use get_framework_mappings.

Search the ATT&CK for ICS asset catalogue -- A0001-A0018: PLCs, RTUs, safety controllers, historians, HMIs, engineering workstations, field I/O -- by name, Purdue level, zone, sector or IT/OT boundary; returns summary rows, while get_asset_detail returns one full record and get_purdue_model the level and flow definitions. Every Purdue field (primaryLevel, zone, spansLevels, isBoundary, rationale) is CURATED from NIST SP 800-82r3 and ISA-95, not published by MITRE -- attribute it that way. MITRE publishes assets for the ICS domain only, so an empty result for a non-ICS question is expected, not missing data.

Full record for one ATT&CK for ICS asset (A0001-A0018): description, sectors, platforms, related assets, every ICS technique that targets it, and its Purdue placement. Use search_assets to find the ID. The Purdue placement (primary level, spans, boundary flag, rationale) is CURATED from NIST SP 800-82r3 and ISA-95, not MITRE-published -- say so when citing it.

The Purdue model (ISA-95 / PERA) as data: the seven levels L0 to L5 including L3.5 the industrial DMZ with per-level asset and technique counts, every ICS asset placed on them, and the full 42-pair flow matrix -- use it for lateral-movement and IT/OT pivot questions. directAllowed means the two levels are topologically ADJACENT, not that either side may initiate: read the note field for directionality (l3_5 to l3 is directAllowed, yet the OT side initiates and a DMZ host must not open sessions inward), and a pair carrying brokerLevel is reachable only by terminating a session at that level, never adjacency. Placement is curated from NIST SP 800-82r3 and ISA-95, not MITRE-published; MITRE publishes assets and techniques for the ICS domain only, so L4/L5 carrying no assets is by design, not missing data.

Loads the usage guide for this server: how to choose between similar tools, data provenance and how to report it honestly, pagination, controlled vocabularies (sectors, framework keys, OWASP frameworks) and the ICS Purdue model semantics. Call it once when you need detail that individual tool descriptions do not carry. Takes no arguments.