AI导哈

ATT&CK知识图谱服务器

一个基于MITRE ATT&CK框架的图数据库服务，提供技术、组织、缓解措施等实体的关系查询和攻击路径分析功能。

  • by ipninichuck
  • Python
  • 本地部署
  • 1 星标
  • 更新于
在 GitHub 查看 ipninichuck/mcp-attack

使用说明

# MITRE ATT&CK MCP Server

A Model Context Protocol (MCP) server that provides a graph-based interface for the [MITRE ATT&CK® Framework](https://attack.mitre.org/).

This server ingests the STIX 2.1 data for ATT&CK, builds an in-memory NetworkX graph, and exposes tools for Large Language Models to search, traverse relationships, and generate ATT&CK Navigator layers.

## 🚀 Features

* **Knowledge Graph:** Queries a structured graph of Techniques, Groups, Mitigation, and Data Components.
* **Deep Relationship Traversal:** Trace links from Techniques → Detection Strategies → Analytics → Data Components.
* **Navigator Integration:** Generate valid `layer.json` files on the fly based on conversation context.
* **Secure Supply Chain:** Verifies the SHA256 hash of MITRE data to prevent tampering.
* **Fast Execution:** Uses `uv` for dependency management and caching.

## 🛠️ Tools Available

The following tools are exposed to the MCP client:

| Tool Name | Description |
| :--- | :--- |
| `search_knowledge_base` | Search for any ATT&CK object (Technique, Group, Software) by ID (e.g., T1059) or fuzzy name match. |
| `explore_relationships` | Traverse the graph from a starting entity up to a specified depth (default: 2). Useful for finding "What groups use this software?" or "How do I detect this?" |
| `get_entity_details` | Retrieves deep context for an entity. For Techniques, it returns Mitigations and Detection Analytics. For Groups, it aggregates used Software/Malware. |
| `list_techniques_in_tactic` | Lists all techniques belonging to a specific Tactic (e.g., "Persistence", "Discovery"). |
| `generate_navigator_layer` | Creates a MITRE ATT&CK Navigator JSON layer highlighting specific techniques with a score and color. |

## 📦 Installation & Setup

### Prerequisites
* **Python 3.11+**
* **[uv](https://github.com/astral-sh/uv)** (Modern Python package manager)

### 1. Clone and Sync
Navigate to the project directory and install dependencies. `uv` will automatically create a virtual environment and install the exact versions defined in `uv.lock`.

```bash
cd attack-mcp-server
uv sync

2.验证安装

运行服务器入口点以确保图形正确构建。

uv run python -m attack_mcp.main

注意：第一次运行将下载ATT&CK STIX数据。

⚙️ 配置

文件 src/attack_mcp/config.py 控制加载哪个Matrix并管理安全设置。

交换矩阵

默认情况下，服务器加载 企业ATT&CK。切换到 移动 或 工业控制系统，打开 config.py 并对相应的块进行注释/取消注释：

# Example: Switch to Mobile
# ATTACK_STIX_URL = ".../enterprise-attack.json"  <-- Comment this out
# ATTACK_DOMAIN = "enterprise-attack"

ATTACK_STIX_URL = ".../mobile-attack.json"        <-- Uncomment this
ATTACK_DOMAIN = "mobile-attack"

🔒 安全最佳实践

1.供应链完整性（哈希验证）

为了防止篡改或数据损坏，您应该“固定”STIX文件的哈希值。

  1. 开发模式（首次使用时信任）： 集 ATTACK_STIX_HASH = None 在 config.py。运行服务器。它将把检测到的下载文件的SHA256哈希打印到控制台。

  2. 安全模式： 复制该哈希并将其粘贴到 config.py:

    ATTACK_STIX_HASH = "59b2..." # Paste actual hash here

    现在，服务器将在每次启动时严格验证文件完整性。

2.文件系统安全

所有生成的文件（例如导航层）仅限于 outputs/ 目录。服务器清理文件名以防止路径遍历攻击（例如。， ../../etc/passwd).

📂 项目结构

attack-mcp-server/
├── pyproject.toml       # Dependencies & Project Config
├── uv.lock              # Lockfile for reproducible builds
├── src/
│   └── attack_mcp/
│       ├── main.py      # Entry point
│       ├── server.py    # MCP Server Initialization
│       ├── config.py    # Matrix Selection & Security Config
│       ├── core/        # Logic for STIX/NetworkX
│       └── resources/   # Tool Definitions

📝 许可证

本项目使用来自的公共数据 MITRE ATT&CK 公司®，这取决于 MITRE使用条款.

相关 MCP