io.github.cyanheads/mitre-cwe-mcp-server

Retrieve CAPEC attack patterns, categories, and views by ID, such as CAPEC-66, CAPEC66, or 66, including Deprecated and Obsolete records; each entry’s type says which. Processes up to 20 distinct IDs within a 24,000-byte response budget and discloses deferred IDs; a CWE ID or an item that is no ID returns in notFound with recovery guidance; only an item holding a control character other than whitespace, or a non-ID item over 150 characters, rejects the whole call. Patterns default to summary, prerequisites, execution, mitigations, and mappings; categories and views default to summary (the category summary or view objective) and relations (members in source order, or a filter-defined view’s source XPath filterDefinition). Views CAPEC-1000 (Mechanisms of Attack) and CAPEC-3000 (Domains of Attack) are entry points for browsing patterns by category. A default section that does not fit the budget is omitted whole and named with its size and a re-call (kind partial). The notes section, outside the defaults, returns recorded MITRE notes. Explicit sections remain complete, including one oversized record with disclosure; an empty array requests an outline. Recorded CWE and ATT&CK mappings are incomplete and do not establish current ATT&CK validation.

Navigate live CWE parents, children, ancestors, or descendants for a weakness, category, grouping, or view. Discover IDs with cwe_search_weaknesses or cwe_list_reference topic views. The default view is 1000; set viewId all for every view. primaryOnly applies only to ancestors. Edges point from parent to child and retain view identity; follow nextCursor for more edges. Continuations re-fetch the traversal and reject changed topology. Empty relations are successful; upstream failures remain errors. Node names come from the loaded catalog and may lag live IDs.

Read a CWE view objective, audience, status, source filter, recorded notes, and direct members in published order. Navigation views list top-level members rather than every descendant; use cwe_get_hierarchy for navigation or cwe_search_weaknesses with viewId for weakness membership closure. A filter-defined (Implicit) view lists no members: its filterDefinition is the source XPath that defines membership, and cwe_search_weaknesses with its viewId returns the weaknesses that filter selects; when the filter has a part this server does not evaluate, the guidance says so and that search returns none with a disclosure. Unknown and non-view IDs return a structured miss. Follow nextCursor for remaining direct members.

Retrieve CWE weaknesses, categories, or groupings by ID, such as CWE-79, CWE79, or 79. Processes up to 20 distinct IDs within a 24,000-byte response budget and discloses deferred IDs; a view, a CAPEC ID, or an item that is no ID returns in notFound with recovery guidance; only an item holding a control character other than whitespace, or a non-ID item over 150 characters, rejects the whole call. Defaults to summary, consequences, mitigations, and relations; a default section that does not fit the budget is omitted whole and named with its size and a re-call (kind partial). Summary carries recorded alternate terms such as XSS, ordinalities (Primary, Resultant, Indirect), and background details; the notes section, outside the defaults, returns every note MITRE records, such as Relationship, Maintenance, Terminology, and Research Gap notes. Explicit sections remain complete, including one oversized record with disclosure; an empty sections array requests an outline. exampleLanguage, exampleOffset, and exampleLimit select a complete source-ordered page of section examples: with sections omitted, setting any of them to a non-default value adds examples after the defaults, filled last and outlined with its page size and a re-call when it does not fit; explicit sections without examples ignore them, and guidance gives the re-call that adds examples. Categories and groupings are organizational entries, not vulnerability root causes.

List loaded CWE/CAPEC vocabulary, every CWE view, workflow guidance, or catalog versions and refresh health. Filter requires every whitespace-separated token in an item label, each at a word start or camelCase hump (script finds JavaScript). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Omit filter to browse. Platforms distinguishes example code languages from platform names and classes. Follow nextCursor for complete lists; limits above 100 are capped with disclosure.

Search CAPEC attack patterns by every whitespace-separated text token, recorded CWE or ATT&CK mapping, abstraction, severity, or likelihood. Text tokens match at word starts or camelCase humps; tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (config finds misconfiguration), with possible spelling coincidences. Search other compounds such as deserialization as written. Parent ATT&CK techniques include recorded subtechniques; CWE mappings are exact without hierarchy expansion. Omit filters to browse. Deprecated and Obsolete patterns are excluded by default. Mappings are incomplete and do not validate current ATT&CK coverage. Results order by all tokens in the name or in one recorded alternate term such as MITM, then all in the description, then any other match, then numeric ID; use cwe_get_attack_pattern for complete sections and follow nextCursor for remaining matches.

Search CWE weaknesses by all text tokens, exact platform or consequence vocabulary, abstraction, status, mapping usage, view membership, a recorded taxonomy mapping (taxonomy name or entry ID such as CERT C ARR30-C), or a CVE that MITRE cites as an observed example. Text tokens match at word starts or camelCase humps; tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted), with possible spelling coincidences. Search other compounds such as deserialization as written; text never matches an entry ID or CVE. Omit filters to browse; categories and groupings are excluded. Each result carries MITRE’s mapping usage, which says whether the entry may be used to map a vulnerability, and, under a taxonomy or CVE filter, every mapping or observed example that matched. Results order by all tokens in the name or in one recorded alternate term such as XSS, then all in the description, then any other match, then numeric ID. Description previews contain the first sentence; use cwe_get_weakness for complete sections. Follow nextCursor for remaining matches.