MITRE ATT&CK

`list_mitre_techniques`

Returns MITRE ATT&CK Enterprise techniques, optionally filtered by tactic shortname (e.g. initial-access). Results are sorted by technique ID and capped by limit. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

tacticstringoptional

Tactic shortname to filter by. Max 60 characters, pattern ^[a-z0-9-]+$. Examples: initial-access, execution, lateral-movement, privilege-escalation. Omit to return techniques across all tactics.

limitintegeroptionaldefault: 100

Maximum number of techniques to return. Accepted range: 1–200.

Example invocation

Ask your agent: "List all MITRE ATT&CK techniques under the execution tactic."

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_mitre_techniques","arguments":{"tactic":"execution","limit":50}}}'

Response

The full MCP envelope is described in Response Format. Parse result.content[0].text to obtain the structured payload.

result.content[0].text (parsed)

{
  "count": 14,
  "tactic": "execution",
  "limit": 50,
  "items": [
    {
      "technique_id": "T1059",
      "name": "Command and Scripting Interpreter",
      "platforms": ["Linux", "Windows", "macOS"],
      "phases": ["execution"],
      "is_subtechnique": false,
      "parent_technique": null
    },
    {
      "technique_id": "T1059.001",
      "name": "PowerShell",
      "platforms": ["Windows"],
      "phases": ["execution"],
      "is_subtechnique": true,
      "parent_technique": "T1059"
    }
  ],
  "generated_at": "2026-05-18T10:24:31.118Z"
}

Errors

Code	Message	When
`-32602`	`invalid_params: tactic: pattern`	`tactic` contains characters outside `^[a-z0-9-]+$`
`-32602`	`invalid_params: tactic: max:60`	`tactic` exceeds 60 characters
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:200`	`limit` exceeds 200
`-32001`	`unauthorized`	API key is invalid, revoked, or not permitted from this IP
`-32002`	`insufficient_credits`	Account has no credits remaining