Search / io.github.pipeworx-io/mitre-attck
Mitre Attck
R0· no sign-inMITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.
v0.1.2 · active · repository · website · descriptor JSON · versions
Search / io.github.pipeworx-io/mitre-attck
R0· no sign-inMITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.
v0.1.2 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"mitre-attck": {
"type": "http",
"url": "https://gateway.pipeworx.io/mitre-attck/mcp"
}
}
}claude mcp add --transport http mitre-attck https://gateway.pipeworx.io/mitre-attck/mcp[mcp_servers.mitre-attck]
url = "https://gateway.pipeworx.io/mitre-attck/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mitre-attck": {
"type": "remote",
"url": "https://gateway.pipeworx.io/mitre-attck/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"mitre-attck": {
"type": "http",
"url": "https://gateway.pipeworx.io/mitre-attck/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=mitre-attck&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZ2F0ZXdheS5waXBld29yeC5pby9taXRyZS1hdHRjay9tY3AifQ%3D%3D"
}{
"servers": {
"mitre-attck": {
"type": "http",
"url": "https://gateway.pipeworx.io/mitre-attck/mcp"
}
}
}{
"mcpServers": {
"mitre-attck": {
"httpUrl": "https://gateway.pipeworx.io/mitre-attck/mcp"
}
}
}extensions:
"mitre-attck":
enabled: true
name: "mitre-attck"
type: streamable_http
uri: "https://gateway.pipeworx.io/mitre-attck/mcp"
timeout: 300
Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.
protocol.modernnewest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)stability.changes, stability.rug_pulltool list unknowndeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packagepipeworx_trendingremovedWhat other AI agents are calling on Pipeworx right now. Returns the top tools, top packs, and total call volume over a recent window (24h, 7d, or 30d). Useful for: (1) discovering what data sources are hot for current events, (2) confirming a popular tool is the canonical choice before asking your own question, (3) seeing whether your use case aligns with what most agents need. Self-aggregating signal — derived from CF analytics-engine, no PII, just (pack, tool, count). Cached 5min-1h depending on window.
research_rowremovedClaygent-style per-row research: answer ONE question about ONE company and return a JSON object matching your output_schema, with every field wrapped in its own evidence — {value, evidence_url, quote, status}. status is NEVER self-reported by the model: "found" means this code independently verified the model's quote is a VERBATIM substring of text actually fetched; "inferred" means a value was given but the quote could not be verified; "not_established" means no source answered the field, and its value is always null — never guessed, never a blended score. Sources: "web" fetches the company's own site (entity.domain required — homepage, /about, /leadership) via fetch_url; "catalog" checks entity_profile (SEC EDGAR; resolved:false for a private company is expected, not a failure); "both" (default) tries both. max_cost (USD, default 0.02, max 0.50) scales how many pages are fetched and refuses up front if it is too small to pay for even one extraction call (floor $0.002) — never silently overspends. A row where every source comes back empty costs nothing: every field is mechanically not_established with NO model call made. For a boolean/derived field (e.g. "does this company sell to healthcare"), the quote only has to SUPPORT the value — a descriptive sentence about customers/products counts, the source need not state the answer verbatim. leadership_page_status ("fetched"|"not_found"|"not_attempted", plus leadership_note) says plainly whether a leadership/team page was actually read, so a named-person field (head_of_sales) coming back not_established is distinguishable from "this company just doesn't publish one" vs. "we never checked". model_output_empty:true means the model returned nothing usable (a transport/budget problem) — every field is not_established for THAT reason, never read as 20 individual "no" judgments. Use with a fixed question + schema across many rows for "Claygent over N companies with a hard cost cap" (composes with batch callers). For picking from a fixed label list instead of extracting open fields, use classify_row (cheaper, one model call).
release_calendar_marketsremovedJOIN of the official release calendar (econ data, the FOMC, FDA decisions, SEC rules) against LIVE Polymarket/Kalshi markets — which scheduled releases land in the next N hours, and which live markets resolve on them. This is a POSITIONING tool, not a speed product: results are cached like every other pack (≤ 60s TTL) and there is no push/webhook — do not use this to try to beat a release, use it to see what is coming and what is already priced. CATEGORIES: econ (CPI, Employment Situation/jobs report, GDP, PCE, PPI, retail sales, housing starts, jobless claims — via fred_release_dates per known release_id, since FRED's own cross-release calendar mostly returns recent actuals, not future dates), fed (the next FOMC meeting's rate decision, via fomc_calendar), fda (PDUFA action dates + FDA advisory-committee meetings, via pdufa_catalysts / fda_adcom_calendar), sec (SEC final rules whose own DATES clause names an effective date in the window, via federal-register recent_rules — usually finds nothing in a short window since SEC rules typically take effect 30–60 days out, which is an accurate answer, not a bug), court (ALWAYS EMPTY today — court-listener has no forward-looking scheduled-hearing calendar, only filing/termination dates, so this category returns zero releases with unsupported:true rather than fabricate one). Omit `categories` or pass "all" for every category. MATCHING AND ITS HONESTY CONTRACT: every release is returned even when it has ZERO matched markets — a release is never dropped just because nothing on Polymarket or Kalshi resolves on it (most FDA/SEC releases will show markets:[]; that is signal, not a gap). Every matched market carries resolves_on_this_release: "true" (the venue's own close/end date sits within ~36h of the release AND the question passed a subject filter — econ and fed only), "likely" (same subject filter, but the venue closes days away from the release date), or "unclear" (a keyword hit with no date to anchor against — always true for the fda category, which has no ladder structure to check a date against). matched_by names the mechanism (a Kalshi series ticker, a Polymarket search query, or an FDA keyword probe) so a caller can judge the match rather than trust a label. scheduled_at carries both `utc` and `et`; econ releases use the standing BLS/Census 8:30am ET convention (FRED's calendar itself has no clock time), FOMC decisions use the 2:00pm ET convention, and FDA/SEC dates are date_only:true (no reliable clock time exists for either). DO NOT treat a matched market as a real arbitrage or a settled fact on its own — a market question sharing tokens with a release name is not proof it settles on that release's own published number. Call resolution_audit / resolution_diff (fleet #1909) on a specific market before sizing anything here. An empty window (zero releases across every requested category) returns the SAME shape as a populated one — release_count:0, releases:[] — plus empty_reason:"no_releases_in_window" and a `hint` telling you to widen, so you never branch on the response shape and never have to guess whether zero means "nothing is scheduled" or "the lookup failed". Econ releases especially cluster on specific dates each month, so a 48h window often straddles a dead stretch.
recent_changesremoved"What's new with X" / "latest on Y" / "what happened to Z this week / month / quarter" / "updates on Acme" / "news on Tesla recently" / "what's happening with Apple" — change feed for a company in the last N days/weeks/months in ONE parallel call. Fans out to SEC EDGAR (filings since `since`), GDELT→GNews fallback (news mentions in window — GDELT preferred, GNews when rate-limited or 5xx), USPTO (patents granted; PatentsView API sunset May 2025 so this soft-fails until reactivated). `since` accepts ISO date ("2026-04-01") or relative shorthand ("7d", "30d", "3m", "1y"). Returns structured changes[] grouped by source + total_changes count + pipeworx:// citation URIs. Use entity_profile instead when you want the static profile (filings + fundamentals + LEI + patents) regardless of window.
company_factsremovedTYPED, DETERMINISTIC financial facts for a US public company for an EXPLICITLY NAMED reporting period — "Apple revenue for fiscal 2023", "Walmart net income FY2026 Q3", "Microsoft cash at the end of fiscal 2024". PREFER OVER entity_profile / get_company_financials whenever the period matters: those answer "the most recent figures" and will happily hand back FY2025 when you asked about FY2019, and neither separates a discrete quarter from a year-to-date figure. This one refuses instead — it NEVER substitutes the latest period for the period requested, NEVER returns 0 for missing data, NEVER lets a 9-month YTD number answer a quarterly question, and NEVER converts a currency. Every answer carries the exact us-gaap concept it came from, what that concept MEASURES (NetIncomeLoss excludes non-controlling interests, ProfitLoss includes them — not synonyms), the accession number and a link to the filing on sec.gov, the restatement trail of any superseded figures, and a contract + derivation version to pin against. Fiscal periods are the FILER'S OWN, anchored on their fiscal-year end, so Walmart's year ending 2026-01-31 is FY2026 and Apple's ending 2025-09-27 is FY2025. Attributes: revenue, net_income, cash, gross_profit, operating_income, eps_diluted, capex, operating_cash_flow, long_term_debt, shares_outstanding (the dei COVER-PAGE share count, so its period end is the cover date, after the quarter closed — that is the most current count the filing carries). Units are not all USD: shares_outstanding is in `shares` with currency null, eps_diluted in `USD/shares`. A discrete quarter the filer never filed — every Q4, and Q2/Q3 of cash-flow lines, which are filed year-to-date — is DERIVED as YTD(q) minus YTD(q-1) and comes back with `reported: false`, the subtraction named in `derivation` (fy_minus_9m / ytd_9m_minus_6m / ytd_6m_minus_3m) and both legs with their filings in `derived_from`; test `reported` if you will only accept a figure lifted from a filing. Per-share and balance-sheet figures are NEVER derived. Every non-answer is a named status — `unavailable` (the filer did not report it for that period; the periods that DO exist are listed, without values), `unsupported` (outside what v1 covers — a non-us-gaap filer, an unknown attribute, a non-USD unit), `ambiguous` (the company name matched two filers equally well; both are named), `conflicting` (two filings the same day disagree; both are returned and neither is picked), `partial` (a value with no accession behind it). Source: SEC EDGAR, XBRL financial facts, one publisher read once — see `corroboration`. Same response is served at POST https://gateway.pipeworx.io/v1/facts for non-MCP callers.
kalshi_weather_edgeremovedPrices Kalshi daily high-temperature markets against the NWS forecast for the market's OWN settlement station, and measures whether that forecast actually beats the market. Two modes. LIVE (default): returns the full strike ladder for one city and settlement date with market_prob (mid), forecast_prob, and edge_pp per strike, plus the settlement clause verbatim. BACKTEST (`backtest_days: N`): scores an archived gridded forecast against the market on settled days and returns brier_market vs brier_forecast with a plain-English `verdict`, so the edge is MEASURED rather than asserted. READ THE WARNINGS — they are not boilerplate. (1) These markets DO NOT settle on the NWS. They settle on The Weather Company (weather.com) at a Kalshi station code such as CLINYC, which the response quotes verbatim; so part of every edge_pp is NWS-vs-Weather-Company disagreement about the same day at the same station, which is not mispricing and not tradeable. `settlement_vs_forecast_basis_f` from backtest mode is that part as a number. (2) The station is DERIVED from the settlement clause, never from the city name: Chicago settles at MIDWAY and New York at CENTRAL PARK, so a city-centre forecast would misprice a whole ladder. A station that cannot be resolved yields rows with no forecast and a reason, never a guessed coordinate. (3) forecast_prob assumes a normal distribution around the NWS high whose width is ASSUMED, not fitted (stated in `distribution_assumption`) — run backtest mode to see whether it is calibrated. (4) edge_pp is gross: no Kalshi fees, no bid-ask. MEASURED RESULT, AND IT IS NOT THE FLATTERING ONE: on the first backtest (KXHIGHNY, 13 settled days to 2026-09-11, 58 market observations) the MARKET beat the forecast — Brier 0.1008 for the market against 0.1594 for the archived gridded forecast, lower being better. So on that sample there is NO forecast edge to sell, and a large edge_pp is more likely to be the model disagreeing with a better-informed market than an opportunity. The measured settlement-vs-forecast basis was 1.7F mean absolute over 8 pinnable days, slightly warm-biased, which is a big share of a typical edge_pp on a 2-degree bracket. Re-run backtest_days before believing any edge; if a later sample reverses this, the numbers say so. NWS is US-only, so the ~30 international Kalshi weather series (London, Paris, Tokyo) return market prices with forecast_unavailable rather than a forecast. Precipitation series are listed but not yet priced. Cities: nyc, chicago, los angeles, miami, austin, houston, denver, philadelphia — or pass `series_ticker` for any other (e.g. "KXHIGHTBOS").
recent_alertsremovedPull fired events from your subscription feed. Returns the most recent alerts the evaluator has written to your persisted feed — each carries source, citation_uri (pipeworx:// when available), and the raw event payload. Filter by type (e.g. "sec_8k") and/or since (ISO timestamp). Set mark_read:true to flag returned events read so the next call only shows newer ones. Polls work fine; the same feed is also at GET registry.pipeworx.io/alerts.json for scripts and dashboards.
company_register_searchremovedSearch the NATIONAL BUSINESS REGISTERS by company name and get the register's own id back — a Companies House number, a Norwegian organisasjonsnummer, a Finnish business id, a SIREN, a Japanese corporate number, an Estonian registry code, a CNPJ, or an LEI. Use this when you want the OFFICIAL REGISTERED ENTITY and the country is not the US, or when you do not know which country it is. Registers searched: Companies House (GB), Enhetsregisteret (NO), PRH/YTJ (FI), Sirene (FR), 法人番号公表サイト (JP), RIK e-Business Register (EE), and the GLEIF LEI crosswalk, which reaches jurisdictions we have no register pack for (DE, SE, AU, SG...). THIS TOOL REFUSES TO GUESS, and that is its point: when two different companies match a name equally well it answers `match_status: "ambiguous"` with BOTH, rather than naming one. A one-word trading name usually IS ambiguous — "Bolt", "Apple", "Next", "Sea", "DNB" each match a well-known group AND unrelated micro-entities whose registered name is exactly that word — so pass `country` when you know it. Every response names EVERY register it asked under `searched[]`, with that register's own as-of date and row count, and a register that could not be reached carries an `error` there rather than reading as zero rows: "we could not ask Companies House" is never the same answer as "this company is not in Britain". `related[]` holds entities that collapsed INTO the match — the same company seen through another register, or another country's arm sharing its LEI — so a multinational returns one answer rather than tying with itself. NOT A PEOPLE SEARCH: sole traders and other natural persons are excluded on the publisher's own legal-form field, never guessed from the shape of a name. For US public companies prefer resolve_entity (CIK + ticker + FIGI); the two share this same matcher, and resolve_entity returns these register fields too.
polymarket_fill_riskremovedRealizable-vs-theoretical edge check against live CLOB order-book depth. REQUIRES one of `market` (single-market mode) or `event` (basket/partition mode). SINGLE-MARKET: pass a market slug/URL + side (buy_yes|sell_yes|buy_no|sell_no, default buy_yes) + size_usd (default 1000 — max spend on buys, target proceeds on sells); walks the ladder and returns top_of_book, vwap_fill_price, slippage_pp, shares_filled, max_fillable_usd, and a verdict (clean|degraded|cannot_fill). BASKET: pass an event slug/URL + side (sell_yes = capture overround by selling every leg, buy_yes = capture underround; default auto from partition sum) + size_usd interpreted as settlement notional S (shares per leg; each share pays $1); returns theoretical_sum vs realizable_sum (top-of-book vs VWAP across all legs), capture_ratio, profit_usd at executed size, per-leg fill detail, thin_legs[], max_clean_notional_usd, and forced_directional_risk naming the legs most likely to strand you unhedged. USE THIS before acting on any polymarket_arbitrage SELL/BUY-EVERY-LEG signal or any polymarket_edges trade above ~$500 — theoretical overround on thin books is not capturable, and partial basket fills convert an arb into an unhedged directional position (the dominant loss mode in real arb-bot P&L). FEES ARE NOT MODELLED HERE: vwap_fill_price/profit_usd are GROSS of Polymarket's own taker fee (rate 0.04-0.07 by category — see polymarket_edges/fees.ts), on top of which this tool prices depth-crossing cost; a thin-margin fill that looks clean here can still be net-negative after the fee.
mitigationremovedMitigation.
Showing the latest 10. Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-97% +updated-24d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://gateway.pipeworx.io/mitre-attck/mcp streamable-http | none | yes | 97% | 33 ms | 2025-03-26 | 2026-10-20 |
No tools observed. Tools appear once a credential-free probe can list them.
Schemas: list_tools.
And 1,855 more from this publisher.
{
"name": "io.github.pipeworx-io/mitre-attck",
"title": "Mitre Attck",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://gateway.pipeworx.io/mitre-attck/mcp",
"type": "streamable-http"
}
],
"version": "0.1.2",
"repository": {
"url": "https://github.com/pipeworx-io/mcp-mitre-attck",
"source": "github"
},
"websiteUrl": "https://pipeworx.io/packs/mitre-attck",
"description": "MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti."
}