Explore MITRE CWE weaknesses, CAPEC attack patterns, mitigations, code examples, and mappings.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Retrieve CAPEC attack patterns, categories, and views by ID, such as CAPEC-66, CAPEC66, or 66, including Deprecated and Obsolete records; each entry’s type says which. Processes up to 20 distinct IDs within a 24,000-byte response budget and discloses deferred IDs; a CWE ID or an item that is no ID returns in notFound with recovery guidance; only an item holding a control character other than whitespace, or a non-ID item over 150 characters, rejects the whole call. Patterns default to summary, prerequisites, execution, mitigations, and mappings; categories and views default to summary (the category summary or view objective) and relations (members in source order, or a filter-defined view’s source XPath filterDefinition). Views CAPEC-1000 (Mechanisms of Attack) and CAPEC-3000 (Domains of Attack) are entry points for browsing patterns by category. A default section that does not fit the budget is omitted whole and named with its size and a re-call (kind partial). The notes section, outside the defaults, returns recorded MITRE notes. Explicit sections remain complete, including one oversized record with disclosure; an empty array requests an outline. Recorded CWE and ATT&CK mappings are incomplete and do not establish current ATT&CK validation.
One to 200 submitted IDs; up to 20 distinct items are processed within the response budget.
Selected sections; omit for defaults, or pass an empty array for an outline.
Retrieve CAPEC attack patterns, categories, and views by ID, such as CAPEC-66, CAPEC66, or 66, including Deprecated and Obsolete records; each entry’s type says which. Processes up to 20 distinct IDs within a 24,000-byte response budget and discloses deferred IDs; a CWE ID or an item that is no ID returns in notFound with recovery guidance; only an item holding a control character other than whitespace, or a non-ID item over 150 characters, rejects the whole call. Patterns default to summary, prerequisites, execution, mitigations, and mappings; categories and views default to summary (the category summary or view objective) and relations (members in source order, or a filter-defined view’s source XPath filterDefinition). Views CAPEC-1000 (Mechanisms of Attack) and CAPEC-3000 (Domains of Attack) are entry points for browsing patterns by category. A default section that does not fit the budget is omitted whole and named with its size and a re-call (kind partial). The notes section, outside the defaults, returns recorded MITRE notes. Explicit sections remain complete, including one oversized record with disclosure; an empty array requests an outline. Recorded CWE and ATT&CK mappings are incomplete and do not establish current ATT&CK validation.
| Argument | Type | Description |
|---|---|---|
| ids* | array | One to 200 submitted IDs; up to 20 distinct items are processed within the response budget. |
| sections | array | Selected sections; omit for defaults, or pass an empty array for an outline. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"ids"
],
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string",
"description": "A CAPEC ID such as CAPEC-66 or a positive bare integer. An item that is no CAPEC ID is reported per item; an item holding a control character other than whitespace, or over 150 characters and no CWE or CAPEC ID, rejects the call."
},
"maxItems": 200,
"minItems": 1,
"description": "One to 200 submitted IDs; up to 20 distinct items are processed within the response budget."
},
"sections": {
"type": "array",
"items": {
"enum": [
"summary",
"prerequisites",
"execution",
"skills",
"consequences",
"mitigations",
"examples",
"relations",
"mappings",
"notes"
],
"type": "string",
"description": "A supported CAPEC detail section."
},
"description": "Selected sections; omit for defaults, or pass an empty array for an outline."
}
},
"additionalProperties": false
}Navigate live CWE parents, children, ancestors, or descendants for a weakness, category, or view. Discover IDs with cwe_search_weaknesses or cwe_list_reference topic views. The default view is 1000; set viewId all for every view. primaryOnly applies only to ancestors. Edges point from parent to child and retain view identity; follow nextCursor for more edges. Continuations re-fetch the traversal and reject changed topology. Empty relations are successful; upstream failures remain errors. Node names come from the loaded catalog and may lag live IDs.
| Argument | Type | Description |
|---|---|---|
| id* | string | CWE ID such as CWE-79 or 79, for a weakness, category, or view. |
| limit | integer | Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure. |
| cursor | string | Opaque continuation returned by this tool. |
| viewId | string | CWE view ID such as CWE-1000 or 1000, or all; discover with cwe_list_reference topic views. Blank means the default. |
| direction* | string | Live hierarchy direction. |
| primaryOnly | boolean | Restrict ancestors to primary parents; invalid for other directions when true. |
Read a CWE view objective, audience, status, source filter, recorded notes, and direct members in published order. Navigation views list top-level members rather than every descendant; use cwe_get_hierarchy for navigation or cwe_search_weaknesses with viewId for weakness membership closure. A filter-defined (Implicit) view lists no members: its filterDefinition is the source XPath that defines membership, and cwe_search_weaknesses with its viewId returns the weaknesses that filter selects; when the filter has a part this server does not evaluate, the guidance says so and that search returns none with a disclosure. Unknown and non-view IDs return a structured miss. Follow nextCursor for remaining direct members.
| Argument | Type | Description |
|---|---|---|
| id* | string | CWE view ID such as CWE-1000 or 1000; discover with cwe_list_reference topic views. |
| limit | integer | Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure. |
| cursor | string | Opaque continuation returned by this tool. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"pattern": "^\\s*(?:[Cc][Ww][Ee](?:[-_]|\\s+)?)?0*([1-9]\\d*)\\s*$",
"description": "CWE view ID such as CWE-1000 or 1000; discover with cwe_list_reference topic views."
},
"limit": {
"type": "integer",
"default": 20,
"maximum": 1000,
"minimum": 1,
"description": "Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."
},
"cursor": {
"type": "string",
"description": "Opaque continuation returned by this tool."
}
},
"additionalProperties": false
}Retrieve CWE weaknesses or categories by ID, such as CWE-79, CWE79, or 79. Processes up to 20 distinct IDs within a 24,000-byte response budget and discloses deferred IDs; a view, a CAPEC ID, or an item that is no ID returns in notFound with recovery guidance; only an item holding a control character other than whitespace, or a non-ID item over 150 characters, rejects the whole call. Defaults to summary, consequences, mitigations, and relations; a default section that does not fit the budget is omitted whole and named with its size and a re-call (kind partial). Summary carries recorded alternate terms such as XSS, ordinalities (Primary, Resultant, Indirect), and background details; the notes section, outside the defaults, returns every note MITRE records, such as Relationship, Maintenance, Terminology, and Research Gap notes. Explicit sections remain complete, including one oversized record with disclosure; an empty sections array requests an outline. exampleLanguage, exampleOffset, and exampleLimit select a complete source-ordered page of section examples: with sections omitted, setting any of them to a non-default value adds examples after the defaults, filled last and outlined with its page size and a re-call when it does not fit; explicit sections without examples ignore them, and guidance gives the re-call that adds examples. Categories are organizational entries, not vulnerability root causes.
| Argument | Type | Description |
|---|---|---|
| ids* | array | One to 200 submitted IDs; up to 20 distinct items are processed within the response budget. |
| sections | array | Selected sections; omit for defaults, or pass an empty array for an outline. |
| exampleLimit | integer | Complete examples per entry in section examples; no upper bound beyond the finite source array. With sections omitted, a value other than 3 adds examples to the defaults. |
List loaded CWE/CAPEC vocabulary, every CWE view, workflow guidance, or catalog versions and refresh health. Filter requires every whitespace-separated token in an item label, each at a word start or camelCase hump (script finds JavaScript). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Omit filter to browse. Platforms distinguishes example code languages from platform names and classes. Follow nextCursor for complete lists; limits above 100 are capped with disclosure.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure. |
| topic* | string | views lists CWE view IDs; abstraction_levels explains CWE and CAPEC levels; mitigation_phases lists prevention phases; platforms lists platform dimensions and exampleLanguages; relationship_natures lists relation labels; filter_values lists statuses, consequence impacts, CWE mapping usage, CWE taxonomy names, severity, and likelihood; workflow explains navigation; versions reports catalog freshness and refresh health. |
| cursor | string | Opaque continuation returned by this tool. |
| filter | string | All-token case-insensitive label filter; each token matches at a word start or camelCase hump. Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Blank means unset. |
Search CAPEC attack patterns by every whitespace-separated text token, recorded CWE or ATT&CK mapping, abstraction, severity, or likelihood. Text tokens match at word starts or camelCase humps; tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (config finds misconfiguration), with possible spelling coincidences. Search other compounds such as deserialization as written. Parent ATT&CK techniques include recorded subtechniques; CWE mappings are exact without hierarchy expansion. Omit filters to browse. Deprecated and Obsolete patterns are excluded by default. Mappings are incomplete and do not validate current ATT&CK coverage. Results order by all tokens in the name or in one recorded alternate term such as MITM, then all in the description, then any other match, then numeric ID; use cwe_get_attack_pattern for complete sections and follow nextCursor for remaining matches.
| Argument | Type | Description |
|---|---|---|
| cweId | string | Exact recorded CWE mapping, a CWE ID such as CWE-79 or 79 from cwe_search_weaknesses; blank means unset. |
| limit | integer | Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure. |
| cursor | string | Opaque continuation returned by this tool. |
| filter | string | All-token case-insensitive filter over the name, recorded alternate terms, and description; each token matches at a word start or camelCase hump (path finds XPath). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Blank means unset. |
Search CWE weaknesses by all text tokens, exact platform or consequence vocabulary, abstraction, status, mapping usage, view membership, a recorded taxonomy mapping (taxonomy name or entry ID such as CERT C ARR30-C), or a CVE that MITRE cites as an observed example. Text tokens match at word starts or camelCase humps; tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted), with possible spelling coincidences. Search other compounds such as deserialization as written; text never matches an entry ID or CVE. Omit filters to browse; categories are excluded. Each result carries MITRE’s mapping usage, which says whether the entry may be used to map a vulnerability, and, under a taxonomy or CVE filter, every mapping or observed example that matched. Results order by all tokens in the name or in one recorded alternate term such as XSS, then all in the description, then any other match, then numeric ID. Description previews contain the first sentence; use cwe_get_weakness for complete sections. Follow nextCursor for remaining matches.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure. |
| cursor | string | Opaque continuation returned by this tool. |
| filter | string | All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted); spelling coincidences can match. Other compounds such as deserialization must be searched as written. Blank means unset. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id",
"direction"
],
"properties": {
"id": {
"type": "string",
"pattern": "^\\s*(?:[Cc][Ww][Ee](?:[-_]|\\s+)?)?0*([1-9]\\d*)\\s*$",
"description": "CWE ID such as CWE-79 or 79, for a weakness, category, or view."
},
"limit": {
"type": "integer",
"default": 20,
"maximum": 1000,
"minimum": 1,
"description": "Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."
},
"cursor": {
"type": "string",
"description": "Opaque continuation returned by this tool."
},
"viewId": {
"type": "string",
"default": "1000",
"pattern": "^\\s*(?:(?:(?:[Cc][Ww][Ee](?:[-_]|\\s+)?)?0*([1-9]\\d*)|([Aa][Ll][Ll]))\\s*)?$",
"description": "CWE view ID such as CWE-1000 or 1000, or all; discover with cwe_list_reference topic views. Blank means the default."
},
"direction": {
"enum": [
"parents",
"children",
"ancestors",
"descendants"
],
"type": "string",
"description": "Live hierarchy direction."
},
"primaryOnly": {
"type": "boolean",
"default": false,
"description": "Restrict ancestors to primary parents; invalid for other directions when true."
}
},
"additionalProperties": false
}| exampleOffset | integer | Offset in each entry’s language-filtered examples (section examples). With sections omitted, a value above 0 adds examples to the defaults. |
| exampleLanguage | string | Exact source example code language for section examples; discover values through cwe_list_reference topic platforms. With sections omitted, adds examples to the defaults. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"ids"
],
"properties": {
"ids": {
"type": "array",
"items": {
"type": "string",
"description": "A CWE ID such as CWE-79 or a positive bare integer. An item that is no CWE ID is reported per item; an item holding a control character other than whitespace, or over 150 characters and no CWE or CAPEC ID, rejects the call."
},
"maxItems": 200,
"minItems": 1,
"description": "One to 200 submitted IDs; up to 20 distinct items are processed within the response budget."
},
"sections": {
"type": "array",
"items": {
"enum": [
"summary",
"consequences",
"mitigations",
"relations",
"examples",
"detection",
"observed",
"platforms",
"mappings",
"notes"
],
"type": "string",
"description": "A supported CWE detail section."
},
"description": "Selected sections; omit for defaults, or pass an empty array for an outline."
},
"exampleLimit": {
"type": "integer",
"default": 3,
"maximum": 9007199254740991,
"minimum": 1,
"description": "Complete examples per entry in section examples; no upper bound beyond the finite source array. With sections omitted, a value other than 3 adds examples to the defaults."
},
"exampleOffset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Offset in each entry’s language-filtered examples (section examples). With sections omitted, a value above 0 adds examples to the defaults."
},
"exampleLanguage": {
"type": "string",
"description": "Exact source example code language for section examples; discover values through cwe_list_reference topic platforms. With sections omitted, adds examples to the defaults."
}
},
"additionalProperties": false
}{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"topic"
],
"properties": {
"limit": {
"type": "integer",
"default": 20,
"maximum": 1000,
"minimum": 1,
"description": "Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."
},
"topic": {
"enum": [
"views",
"abstraction_levels",
"mitigation_phases",
"platforms",
"relationship_natures",
"filter_values",
"workflow",
"versions"
],
"type": "string",
"description": "views lists CWE view IDs; abstraction_levels explains CWE and CAPEC levels; mitigation_phases lists prevention phases; platforms lists platform dimensions and exampleLanguages; relationship_natures lists relation labels; filter_values lists statuses, consequence impacts, CWE mapping usage, CWE taxonomy names, severity, and likelihood; workflow explains navigation; versions reports catalog freshness and refresh health."
},
"cursor": {
"type": "string",
"description": "Opaque continuation returned by this tool."
},
"filter": {
"type": "string",
"maxLength": 500,
"description": "All-token case-insensitive label filter; each token matches at a word start or camelCase hump. Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Blank means unset."
}
},
"additionalProperties": false
}| severity | string | Exact source severity; discover with cwe_list_reference topic filter_values. |
| likelihood | string | Exact source likelihood; discover with cwe_list_reference topic filter_values. |
| abstraction | string | Exact CAPEC abstraction; blank means unset. |
| includeInactive | boolean | Include Deprecated and Obsolete patterns; default false. |
| attackTechniqueId | string | Recorded Tdddd or Tdddd.ddd mapping from cwe_get_attack_pattern mappings, also accepting bare numeric form; blank means unset. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"cweId": {
"type": "string",
"pattern": "^\\s*(?:(?:[Cc][Ww][Ee](?:[-_]|\\s+)?)?0*([1-9]\\d*)\\s*)?$",
"description": "Exact recorded CWE mapping, a CWE ID such as CWE-79 or 79 from cwe_search_weaknesses; blank means unset."
},
"limit": {
"type": "integer",
"default": 20,
"maximum": 1000,
"minimum": 1,
"description": "Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."
},
"cursor": {
"type": "string",
"description": "Opaque continuation returned by this tool."
},
"filter": {
"type": "string",
"maxLength": 500,
"description": "All-token case-insensitive filter over the name, recorded alternate terms, and description; each token matches at a word start or camelCase hump (path finds XPath). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start; spelling coincidences can match. Blank means unset."
},
"severity": {
"type": "string",
"description": "Exact source severity; discover with cwe_list_reference topic filter_values."
},
"likelihood": {
"type": "string",
"description": "Exact source likelihood; discover with cwe_list_reference topic filter_values."
},
"abstraction": {
"enum": [
"Meta",
"Standard",
"Detailed"
],
"type": "string",
"description": "Exact CAPEC abstraction; blank means unset."
},
"includeInactive": {
"type": "boolean",
"default": false,
"description": "Include Deprecated and Obsolete patterns; default false."
},
"attackTechniqueId": {
"type": "string",
"pattern": "^\\s*(?:[Tt]?(\\d{4}(?:\\.\\d{3})?)\\s*)?$",
"description": "Recorded Tdddd or Tdddd.ddd mapping from cwe_get_attack_pattern mappings, also accepting bare numeric form; blank means unset."
}
},
"additionalProperties": false
}| status | string | Exact weakness status; discover with cwe_list_reference topic filter_values. A status only categories carry matches nothing. Omission includes all statuses, including Deprecated. |
| viewId | string | CWE view ID such as CWE-1000 or 1000, from cwe_list_reference topic views; matches the weaknesses its recorded members reach within the view, or that its source filter selects for a filter-defined view. Blank means unset. |
| language | string | Exact platform language name or class; discover with cwe_list_reference topic platforms. |
| technology | string | Exact platform technology name or class; discover with cwe_list_reference topic platforms. |
| abstraction | string | Exact CWE abstraction level; blank means unset. |
| mappingUsage | string | Exact MITRE vulnerability mapping usage, such as Allowed or Allowed-with-Review; discover values with cwe_list_reference topic filter_values. |
| taxonomyName | string | Exact taxonomy name a weakness mapping records, such as CERT C Secure Coding or ISA/IEC 62443; discover values with cwe_list_reference topic filter_values. Matches any mapping in that taxonomy, including one without an entry ID. |
| observedCveId | string | CVE ID such as CVE-2021-44228, in any case; matches the weaknesses MITRE cites it on as an observed example, not other CVE-to-CWE assignments such as NVD’s. Blank means unset. |
| taxonomyEntryId | string | Entry ID a weakness taxonomy mapping records, such as ARR30-C or A1, in any case and with any whitespace runs; matches only the whole recorded ID. With taxonomyName, both must hold on the same mapping. Blank means unset. |
| consequenceImpact | string | Exact consequence impact; discover with cwe_list_reference topic filter_values. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"limit": {
"type": "integer",
"default": 20,
"maximum": 1000,
"minimum": 1,
"description": "Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure."
},
"cursor": {
"type": "string",
"description": "Opaque continuation returned by this tool."
},
"filter": {
"type": "string",
"maxLength": 500,
"description": "All whitespace-separated tokens must match the name, a recorded alternate term, the description, or the extended description, each at a word start or camelCase hump (dos finds ReDoS). Tokens of at least four Unicode letters also match after exactly one un or mis prefix at a word start (trusted finds untrusted); spelling coincidences can match. Other compounds such as deserialization must be searched as written. Blank means unset."
},
"status": {
"type": "string",
"description": "Exact weakness status; discover with cwe_list_reference topic filter_values. A status only categories carry matches nothing. Omission includes all statuses, including Deprecated."
},
"viewId": {
"type": "string",
"pattern": "^\\s*(?:(?:[Cc][Ww][Ee](?:[-_]|\\s+)?)?0*([1-9]\\d*)\\s*)?$",
"description": "CWE view ID such as CWE-1000 or 1000, from cwe_list_reference topic views; matches the weaknesses its recorded members reach within the view, or that its source filter selects for a filter-defined view. Blank means unset."
},
"language": {
"type": "string",
"description": "Exact platform language name or class; discover with cwe_list_reference topic platforms."
},
"technology": {
"type": "string",
"description": "Exact platform technology name or class; discover with cwe_list_reference topic platforms."
},
"abstraction": {
"enum": [
"Pillar",
"Class",
"Base",
"Variant",
"Compound"
],
"type": "string",
"description": "Exact CWE abstraction level; blank means unset."
},
"mappingUsage": {
"type": "string",
"description": "Exact MITRE vulnerability mapping usage, such as Allowed or Allowed-with-Review; discover values with cwe_list_reference topic filter_values."
},
"taxonomyName": {
"type": "string",
"description": "Exact taxonomy name a weakness mapping records, such as CERT C Secure Coding or ISA/IEC 62443; discover values with cwe_list_reference topic filter_values. Matches any mapping in that taxonomy, including one without an entry ID."
},
"observedCveId": {
"type": "string",
"pattern": "^\\s*(?:[Cc][Vv][Ee]-\\d{4}-\\d{4,}\\s*)?$",
"description": "CVE ID such as CVE-2021-44228, in any case; matches the weaknesses MITRE cites it on as an observed example, not other CVE-to-CWE assignments such as NVD’s. Blank means unset."
},
"taxonomyEntryId": {
"type": "string",
"maxLength": 500,
"description": "Entry ID a weakness taxonomy mapping records, such as ARR30-C or A1, in any case and with any whitespace runs; matches only the whole recorded ID. With taxonomyName, both must hold on the same mapping. Blank means unset."
},
"consequenceImpact": {
"type": "string",
"description": "Exact consequence impact; discover with cwe_list_reference topic filter_values."
}
},
"additionalProperties": false
}