Frequently Asked Questions (FAQ) about the UBOS ATT&CK MCP Server

Q: What is the MITRE ATT&CK framework? A: MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s attack lifecycle and the platforms they are known to target.

Q: What is an MCP Server? A: An MCP (Model Context Protocol) server acts as a bridge, allowing AI models to access and interact with external data sources and tools. In this case, it provides access to the MITRE ATT&CK database.

Q: What tools does the ATT&CK MCP Server provide? A: The server offers tools to query ATT&CK techniques by ID or name (query_technique), query mitigations for a technique (query_mitigations), query detections for a technique (query_detections), and list all ATT&CK tactics (list_tactics).

Q: How do I install the ATT&CK MCP Server? A: Clone the repository, install the required dependencies using pip install -r requirements.txt, and configure your MCP client to connect to the server.

Q: What are the deployment options for the server? A: You can deploy the server in local stdio mode (recommended for Smithery/local integration) or in HTTP/SSE mode (for remote access and development).

Q: How do I query a specific ATT&CK technique by ID? A: Use the query_technique tool with the technique_id argument. For example: {"technique_id": "T1059.001"}

Q: Can I search for techniques by name? A: Yes, use the query_technique tool with the tech_name argument to perform a fuzzy search by name. For example: {"tech_name": "phishing"}

Q: How do I retrieve the mitigations for a specific technique? A: Use the query_mitigations tool with the technique_id argument. For example: {"technique_id": "T1059.001"}

Q: How do I retrieve the detection methods for a specific technique? A: Use the query_detections tool with the technique_id argument. For example: {"technique_id": "T1059.001"}

Q: How do I get a list of all ATT&CK tactics? A: Use the list_tactics tool with no arguments. For example: {}

Q: What is UBOS, and how does it relate to the ATT&CK MCP Server? A: UBOS is a full-stack AI Agent Development Platform. The ATT&CK MCP Server is designed to enhance the power of UBOS AI agents. UBOS helps orchestrate AI Agents, connect them with enterprise data, build custom AI Agents with your LLM model, and Multi-Agent Systems. This allows security teams to build more effective automated security workflows and threat detection systems.

Q: Can I use the ATT&CK MCP Server to build custom AI agents for security? A: Yes, the ATT&CK MCP Server is specifically designed to provide AI agents with access to threat intelligence data, enabling them to perform tasks like threat hunting, incident response, and vulnerability management prioritization.

Q: What kind of client is expected to connect to the MCP server? A: Any MCP-compatible client. Smithery and Cursor are specifically called out. Generic HTTP clients will work as well when the server is in HTTP/SSE mode.