The repository
The model and its datasets are published on GitHub under CC-BY-4.0, together with the scoring specification and conformance vectors.
What is published
model/— the complete model definition and JSON Schemasdata/— the derived ATT&CK datasetsdocs/scoring-reference.md— the full scoring specificationconformance/— assessments with the scores a conforming implementation must produce
What is not
The assessment tool's source is not published. It is free to use for any purpose, including commercial assessment work, and is not licensed for redistribution or for building derivative tooling.
Why publish the specification but not the implementation. The model's central claim is that an assessment cannot flatter itself, because the constraints are applied mechanically rather than urged. That claim is only worth something if someone other than the author can check it — which the specification and the conformance vectors allow, without the implementation.
Contributing
Descriptors, weights and crosswalks are open to challenge. The most useful contribution is not a correction but a counter-example: if a level descriptor does not match what you see in practice, say which sub-capability, which level, and what you actually observed.