Atomic Red Team
MCP server for Atomic Red Team
What is Atomic Red Team?
Atomic Red Team is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to mcp server for atomic red team
MCP server for Atomic Red Team
This server falls under the Security category on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- MCP server for Atomic Red Team
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx atomic-red-teamConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use Atomic Red Team
The Atomic Red Team MCP Server bridges the open-source Atomic Red Team security testing framework with AI assistants, enabling security teams to query, validate, and execute adversary simulation tests directly from an MCP-compatible client. Atomic Red Team provides hundreds of small, focused tests mapped to MITRE ATT&CK techniques; this server exposes them through five tools so red teamers and detection engineers can search for tests by technique ID or OS, refresh the test library from GitHub, validate YAML test files, and optionally execute tests in controlled environments. It is the fastest way to integrate structured adversary simulation into an AI-driven security workflow.
Prerequisites
- Python 3.9+ with uv or pip installed (for uvx / pip-based install)
- Docker (optional, for the containerized deployment)
- An MCP-compatible AI client such as Claude Desktop, VS Code with Cline, or Cursor
- Network access to GitHub to sync the Atomic Red Team test library
- ART_EXECUTION_ENABLED set to true only in isolated test environments — execution is disabled by default
Install and run the server with uvx (recommended)
The quickest way to start the server is via uvx, which pulls the latest published package and runs it without a permanent install. This works for stdio-based MCP clients.
uvx atomic-red-team-mcpOr run with Docker
Use the pre-built container image if you prefer an isolated runtime or need to deploy on a server. Pipe stdin/stdout for stdio MCP transport.
docker run --rm -i ghcr.io/cyberbuff/atomic-red-team-mcp:latestConfigure environment variables
Set optional variables to control the data source, transport, and whether test execution is enabled. By default the server clones the official Atomic Red Team repository from GitHub.
export ART_GITHUB_URL=https://github.com/redcanaryco/atomic-red-team
export ART_DATA_DIR=~/.atomic-red-team
export ART_EXECUTION_ENABLED=false # set true only in isolated labsAdd the server to your MCP client configuration
Register the atomic-red-team-mcp server in your claude_desktop_config.json or equivalent client config to make it available to your AI assistant.
{
"mcpServers": {
"atomic-red-team": {
"command": "uvx",
"args": ["atomic-red-team-mcp"],
"env": {
"ART_EXECUTION_ENABLED": "false",
"ART_DATA_DIR": "/home/user/.atomic-red-team"
}
}
}
}Refresh the Atomic Red Team library
On first use — or to pull the latest tests — ask the AI assistant to refresh the local data store from GitHub. This populates the test library the other tools query against.
Atomic Red Team Examples
Client configuration
Minimal claude_desktop_config.json for the Atomic Red Team MCP server using uvx with execution disabled.
{
"mcpServers": {
"atomic-red-team": {
"command": "uvx",
"args": ["atomic-red-team-mcp"],
"env": {
"ART_EXECUTION_ENABLED": "false",
"ART_DATA_DIR": "~/.atomic-red-team"
}
}
}
}Prompts to try
Example prompts for red team and detection engineering workflows using the five available tools.
- "Show me all the atomic tests for technique T1059.002"
- "Search mshta atomics for Windows"
- "Find all AppleScript atomic tests for macOS"
- "Validate this atomic test YAML for syntax errors"
- "Refresh the atomic red team library from GitHub"Troubleshooting Atomic Red Team
Server fails to start with 'module not found' or import errors
Ensure you are running Python 3.9+ and that uvx is installed via 'pip install uv'. If using Docker, verify you have pulled the latest image with 'docker pull ghcr.io/cyberbuff/atomic-red-team-mcp:latest'.
query_atomics returns no results or an empty library
The test library has not been synced yet. Ask the AI assistant to call refresh_atomics, or check that ART_DATA_DIR is writable and that the host has network access to the ART_GITHUB_URL.
execute_atomic tool is missing or disabled
Execution is intentionally disabled by default. Set ART_EXECUTION_ENABLED=true in the MCP server environment only when running in an isolated, purpose-built test lab — never on production systems.
Frequently Asked Questions about Atomic Red Team
What is Atomic Red Team?
Atomic Red Team is a Model Context Protocol (MCP) server that mcp server for atomic red team It connects AI assistants to external tools and data sources through a standardized interface.
How do I install Atomic Red Team?
Follow the installation instructions on the Atomic Red Team GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with Atomic Red Team?
Atomic Red Team works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is Atomic Red Team free to use?
Yes, Atomic Red Team is open source and available under the MIT license. You can use it freely in both personal and commercial projects.
Atomic Red Team Alternatives — Similar Security Servers
Looking for alternatives to Atomic Red Team? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up Atomic Red Team in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use Atomic Red Team?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.