Threatkb runs on your own machine — the client starts it, so there is no endpoint to ping. 285 installs a week from npm. Last commit 2 Nov 2026.
Local MITRE ATT&CK queries: techniques, tactics, mitigations, and detections from a STIX file.
Nothing serious here today
Today is the operative word: we check Threatkb every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add threatkb -- npx -y @reneturcios/threatkb{
"mcpServers": {
"threatkb": {
"command": "npx",
"args": [
"-y",
"@reneturcios/threatkb"
]
}
}
}[mcp_servers.threatkb]
command = "npx"
args = ["-y", "@reneturcios/threatkb"]{
"mcpServers": {
"threatkb": {
"command": "npx",
"args": [
"-y",
"@reneturcios/threatkb"
]
}
}
}{
"servers": {
"threatkb": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@reneturcios/threatkb"
]
}
}
}Alternatives to Threatkb
same job, measured the same wayMCP server: MITRE ATT&CK® -> NIST 800-53r5 -> DISA STIG fix/check steps, mitigations and detections
MCP server providing 50+ tools for MITRE ATT&CK techniques, groups, and mitigations
Search the MITRE ATT&CK enterprise knowledge base for adversary techniques and tactics.
MITRE ATLAS — Adversarial Threat Landscape for AI Systems. Tactics + techniques for attacking AI...
MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.
Local-first PHI detection for source code, LLM prompts, logs, and analytics
NASA FIRMS MCP — active-fire / thermal-anomaly detections from MODIS and VIIRS.
Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev
Threatkb — questions
Answers built from our own checks of this server.