CALDERA를 위한 AI 보조 작업 공간. 채팅 구동 워크플로우는 Adversary 콘텐츠, ingest CTI를 STIX로 만들고, 계획 및 실행하는 Adversary 에뮬레이션을 만들어 MCP 도구에 기반을 둔 LLM과 통신사 복사-파스 대신 CALDERA 상태를 라이브합니다.

작업 흐름

| 워크 플로우 | 그것은 무엇 | |—||| |Author | 자연적인 언어 프롬프트에서 CALDERA abilities 및 adversaries를 만들거나 업데이트합니다. | |Upload CTI | Ingests HTML, PDF, TXT 또는 Markdown 보고서 및 STIX 2.1 번들 생성. | |Plan and Execute | STIX 번들 선택, 한 배우에 대한 퓨즈 보고서, 관찰된 기법에서 모험을 구축, 운영을 실행하고, 커버리지 간격을 보고합니다. ·

계획에서 STIX를 선택하고 실행할 때 CTI의 검색을 활성화할 수 있습니다. 어떤 작업 흐름도 선택하지 못했습니다. 모든 실행은 평가를 위해 transcript, 도구 호출 및 artifacts를 유지합니다.

파이프라인 생성

위협 보고서는 실행하는 ** **에게 알려줍니다. 환경은 ** 어디서든 **.

추출 수율 ATT&CK 기술, 이름 위협 배우 및 파일 해시 관찰, 다른 아무것도.

Caldera MCP Plugin

An AI-assisted operations workspace for CALDERA. Chat-driven workflows create adversary content, ingest CTI into STIX, and plan and run adversary emulation, with the LLM grounded in MCP tools and live CALDERA state instead of operator copy-paste.

Workflows

Selecting STIX in Plan and Execute enables CTI retrieval for that run; with none selected the workflow runs without it. Every run keeps its transcript, tool calls and artifacts for review.

What the pipeline produces

A threat report tells you what to run. Your environment tells you where.

Extraction yields ATT&CK techniques, the named threat actor and file hash observables, and nothing else. Hosts, accounts, domains, services and software describe the report’s victim rather than your estate, so they never become CALDERA facts. CALDERA discovers those at runtime, which is why the abilities that use them carry has_agent_copy and no_backwards_movement requirements.

The one insertion point into core CALDERA is the adversary profile:

upload report(s) -> clean -> IR -> ATT&CK techniques -> STIX bundle
                                                            |
  "build an adversary from this and run it"                 v
      build_adversary   attack-pattern -> ability.technique_id -> Adversary
                        + unmatched_techniques + platform_excluded
      run_operation     Adversary + your agents + runtime-discovered facts

Installation

Install like any CALDERA plugin, from the CALDERA root:

git clone https://github.com/mitre/mcp.git plugins/mcp
source venv/bin/activate
pip install -r plugins/mcp/requirements.txt
python -m spacy download en_core_web_lg
cp plugins/mcp/.env.example plugins/mcp/.env

The spaCy model needs its own command because pip cannot install it from requirements.txt. Then add mcp to the plugins: list in conf/local.yml, alongside magma, sandcat and stockpile. Do not commit that file.

Optional extras:

brew install poppler                              # macOS, supplies pdftotext
apt install poppler-utils                         # Debian/Ubuntu
pip install -r plugins/mcp/requirements-dev.txt   # to run the test suite

Without poppler, TXT, MD and HTML still ingest and PDF uploads report the missing dependency rather than failing silently.

LLM credentials