{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_jrmkrbh926en","handle":"attack-query-mcp","url":"https://wellknown.network/agents/attack-query-mcp","links":{"self":"https://wellknown.network/agents/attack-query-mcp/record.json","html":"https://wellknown.network/agents/attack-query-mcp","markdown":"https://wellknown.network/agents/attack-query-mcp/record.md","api":"https://wellknown.network/api/v1/agents/attack-query-mcp","status":"https://wellknown.network/api/v1/agents/attack-query-mcp/status","claim":"https://wellknown.network/agents/attack-query-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/attack-query-mcp/claim.json","badge":"https://wellknown.network/agents/attack-query-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:attack-query-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"attack-query-mcp","summary":"MCP server for ATT&CK queries via AI assistants","description":"# attack-query-mcp\n\n[![PyPI version](https://img.shields.io/pypi/v/attack-query-mcp.svg)](https://pypi.org/project/attack-query-mcp/)\n[![PyPI downloads](https://img.shields.io/pypi/dm/attack-query-mcp.svg)](https://pypi.org/project/attack-query-mcp/)\n[![Python 3.10+](https://img.shields.io/pypi/pyversions/attack-query-mcp.svg)](https://pypi.org/project/attack-query-mcp/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n\nMCP server for ATT&CK queries via AI assistants.\n\n## Overview\n\nThis package provides a [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that enables AI assistants like Claude to query MITRE ATT&CK data using natural language.\n\n## Installation\n\n```bash\npip install attack-query-mcp\n```\n\n## Usage\n\n### With Claude Desktop\n\nAdd to your Claude Desktop configuration (`claude_desktop_config.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"attack-query\": {\n      \"command\": \"attack-query-mcp\"\n    }\n  }\n}\n```\n\n### Standalone\n\n```bash\nattack-query-mcp\n```\n\n## Tools\n\nThe MCP server provides 8 tools for querying ATT&CK data:\n\n| Tool | Description |\n|------|-------------|\n| `query_attack` | Natural language queries (e.g., \"techniques used by APT28\") |\n| `get_technique` | Get technique details by ID (e.g., T1566) |\n| `get_group` | Get group info by name, ID, or alias |\n| `compare_groups` | Compare techniques between two groups with similarity metrics |\n| `find_similar_groups` | Find groups with similar technique profiles |\n| `get_mitigations` | Get mitigations for a technique |\n| `export_navigator_layer` | Export techniques as Navigator layer JSON |\n| `get_group_techniques_temporal` | Get techniques used by a group during a specific time period |\n\n### Example Tool Usage\n\n```\nUser: What techniques does APT28 use for initial access?\nAI: [calls query_attack with \"techniques used by APT28 for initial access\"]\n\nUser: Compare APT28 and APT29\nAI: [calls compare_groups with group1=\"APT28\", group2=\"A…","publisher":{"name":"Stephen Wood","url":null},"homepage":"https://github.com/swoodeng/attack-query#readme","repository":"https://github.com/swoodeng/attack-query#readme","version":"0.4.1","license":"MIT","protocols":["mcp"],"tags":["ai","attack","claude","llm","mcp","mitre","threat-intelligence"],"pricing":null,"endpoints":[{"url":"pypi:attack-query-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"data.database","name":"Databases","confidence":1,"provenance":"derived"},{"slug":"dev.package-management","name":"Packages & Dependencies","confidence":0.768,"provenance":"derived"}],"categories":["data","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"attack-query-mcp","registry":"pypi","observedAt":"2026-09-09T09:25:15.977Z","publishedAt":"2026-01-13T01:04:47.296453Z","latestVersion":"0.4.1"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"attack-query-mcp","url":"https://pypi.org/project/attack-query-mcp/","firstSeenAt":"2026-09-09T09:24:16.682Z","fetchedAt":"2026-09-09T09:24:16.682Z","normalizedAt":"2026-09-09T09:24:16.682Z"}]},"firstSeenAt":"2026-09-09T09:24:16.682Z","updatedAt":"2026-09-09T09:25:15.977Z"}