MITRE ATLAS MCP Server

MITRE ATLAS MCP Server

17 MCP tools that threat-model AI and agentic systems against [MITRE ATLAS](https://atlas.mitre.org/)

Install · The idea · Tools · Data governance · Who owns the fix · Example

---

Describe your system's architecture - an agent with tool access over a RAG corpus, say - and get back the ATLAS techniques that apply, the mitigations that cover them, the compounding risks your specific combination of surfaces creates, and the real-world incidents that have already happened to systems shaped like yours.

This is not a lookup wrapper around the ATLAS matrix. Lookup is included, but the point is the mapping from *how you built it* to *what can be done to it*.

Pinned to ATLAS v2026.10: 16 tactics, 221 techniques, 44 mitigations, 77 case studies. Mitigations are enriched with control ownership from the CoSAI Risk Map, and techniques cross-map to ATT&CK, STRIDE, OWASP Top 10 for LLM and NIST AI RMF.

Published in the official [MCP Registry](https://registry.modelcontextprotocol.io/?q=mitre-atlas-mcp-server) as `io.github.imouiche/mitre-atlas-mcp-server`.

Install

npx -y @imouiche/mitre-atlas-mcp-server

Requires Node 18+ and Python 3.12+ on PATH. On first run it prepares a private virtualenv under ~/.mitre-atlas-mcp-server/runtime, which takes a few seconds: both datasets are already in the package, so only mcp and pyyaml are installed and nothing is downloaded. Nothing touches your system or active Python environment.

The PyPI release is not published yet, so these do not work today:

uvx mitre-atlas-mcp-server            # pending PyPI

pip install mitre-atlas-mcp-server # pending PyPI

uvx will become the recommended path once the package is on PyPI, since it needs no Node at all.

Claude Desktop / Claude Code

{

"mcpServers": { "mitre-atlas": { "command": "npx", "args": ["-y", "@imouiche/mitre-atlas-mcp-server"] } } }

The idea

ATLAS is organised by adversary intent - tactics and techniques. Engineers describe systems by architecture. That mismatch is why ATLAS is harder to apply than it should be, and it is the gap this server closes.

It defines ten surfaces, each a yes/no question about your architecture, each anchored to the ATLAS techniques that become reachable when the answer is yes:

The surfaces that matter most are the ones that combine. untrusted_input alone is a content-filtering problem. untrusted_input + tool_use is the agentic equivalent of remote code execution: injected text becomes attacker-chosen actions. profile_ai_system reports those compounds explicitly rather than leaving you to infer them from two separate lists.

ATLAS v2026.10 tags 148 of its 221 techniques as applying to Agentic AI, which is what makes this framing tractable - the agentic coverage is MITRE's, not invented here.

Tools

Threat modelling

Reference

Cross-framework

ATLAS asserts an ATT&CK parallel for 48 of 221 techniques. Every tool reports its coverage figure, so an empty result is never mistaken for "no parallel exists".

Resources: atlas://matrix (the matrix as markdown), atlas://surfaces (the taxonomy).

Prompts: threat_model_this_agent, review_mcp_tool_surface.

Who owns the fix

ATLAS tells you what to do about a technique. It does not tell you who does it.

So every mitigation this server returns is enriched from the CoSAI Risk Map (Coalition for Secure AI, an OASIS open project), which maps its engineering controls to ATLAS mitigation ids. Where a mapping exists you also get the control, the personas who own it, and the components it applies to:

AML.M0004  Limit AI Service Query Volume and Rate

CoSAI control : Agent Execution Bounds owners : Agentic Platform and Framework Providers, Application Developer, AI Platform Provider components : Agent Reasoning Core, Orchestration Input Handling, Orchestration Output Handling

That turns a ranked mitigation list into assignable work, which is the point of threat-modelling a system you are actually building.

Coverage, stated plainly. 13 of ATLAS's 44 mitigations have a CoSAI control, and all 13 cited ids resolve against the pinned ATLAS release. Per surface, roughly a quarter to a half of returned mitigations carry an owner; agent_config currently has none. Where CoSAI maps nothing, the tools say so rather than returning a silent blank.

Example

Threat-model this: a customer-support agent that reads incoming email,

retrieves from our knowledge base, and can issue refunds through our billing

API. It remembers prior conversations per customer.

That is four surfaces, so profile_ai_system(["untrusted_input", "rag", "tool_use", "agent_memory"]). Actual output, abridged:

27 techniques in scope, across 11 tactics. 18 mitigations. 5 techniques ATLAS has no mitigation for.

It leads with what the *combination* creates, not the individual techniques:

untrusted_input + tool_use

Injected content becomes attacker-chosen tool calls, the agentic equivalent of remote code execution. Treat every tool the agent can reach as callable by whoever authors the untrusted content.

rag + tool_use Anyone who can write into the indexed corpus can steer tool calls without ever interacting with the system directly.

untrusted_input + agent_memory A single injection persists across sessions and can carry a delayed trigger, so the payload outlives the request that delivered it.

Then the mitigations, ranked by how much they cover, each naming who implements it:

AML.M0020  covers 14  Generative AI Guardrails

owners: AI Model Serving, AI Platform Provider, Agentic Platform and Framework Providers AML.M0035 covers 11 AI Red Team AML.M0024 covers 7 AI Telemetry Logging and Monitoring owners: AI Model Serving, AI Platform Provider, Agentic Platform and Framework Providers

Then find_analogous_incidents for the same surfaces, ranked by how many in-scope techniques each case study actually employed:

AML.CS0063  overlap 10  Prompt-Based Attacks Against Gemini via Calendar Invitations

AML.CS0026 overlap 9 Financial Transaction Hijacking with M365 Copilot as an Insider AML.CS0066 overlap 9 ZombieAgent: Data Exfiltration Attack on ChatGPT AML.CS0024 overlap 7 Morris II Worm: RAG-Based Attack

A support agent that can move money, matched against a documented financial transaction hijack with nine techniques in common. get_case_study returns any of these as an ordered attack flow: each step's tactic, the technique used, and what the operator actually did.

Data governance

Security tooling is only as trustworthy as the data under it, and most MCP servers fetch theirs at call time from whatever the upstream API returns today. This one does not. Both datasets ship inside the package, pinned to an exact release, and the server makes no network calls while serving.

| Reviewed updates | A weekly workflow pulls upstream, runs the suite and opens a pull request only when something changed. Refreshes are merged deliberately, nev