Connects to your existing tools via API keys, builds a data flow diagram and threat-model diagram in draw.io format, scores every STRIDE threat for business impact, maps attack chains, checks compensating controls, and flags partial-compliance gaps with concrete additional controls — delivered as Word and Excel. Now also threat-models AI/ML pipelines (prompt injection, RAG/training data poisoning, model extraction, excessive agency), maps every threat to OWASP and MITRE ATT&CK/ATLAS, and runs under Claude Code/Cowork, Cursor, and OpenAI Codex CLI.
One skill, four connectors, one report — grounded in what your systems actually say, not a manually typed description.
Jira, Jenkins, ServiceNow, and a code repository (GitHub by default) via read-only API-key-authenticated MCP servers bundled in the plugin.
Two draw.io-compatible .drawio files: a clean data flow diagram, and a threat-model view with trust boundary swimlanes and threat-actor nodes.
Every threat rated Likelihood × Impact (1–25), with the impact rationale named — data sensitivity, compliance regime, blast radius, or reputational angle.
Individual threats linked into plausible end-to-end attack scenarios, so a risk owner sees the real consequence, not just a list.
What's already reducing each risk today, how likely the proposed fix is to actually close the gap, and the residual risk after both are applied.
Partially-compliant controls get named, explained, and paired with specific additional controls to reach full compliance.
A narrative .docx report for review/audit trail, and a sortable/filterable .xlsx risk register — pick either or both.
Defaults to Claude Sonnet to keep large connector payloads cheap to summarize. Point it at Opus, Haiku, or another model per your cost/fidelity tradeoff.
Prompt injection (direct + indirect), training/RAG data poisoning, model extraction, excessive agency, insecure output handling, and unbounded consumption — layered onto STRIDE.
Every threat tagged against OWASP Top 10, OWASP API Security Top 10, and OWASP Top 10 for LLM Applications — whichever lists apply to the component in scope.
Attack-chain steps tagged with MITRE ATT&CK technique IDs for conventional infrastructure and MITRE ATLAS technique IDs for AI/ML-targeting tradecraft.
Lightweight business-impact scoring by default; switch to the complete 7-stage PASTA process for compliance audits, pre-launch gates, or board-facing reports.
The plugin ships four small MCP servers (one per tool) plus a skill that orchestrates the workflow end to end.
If a repo has an LLM, a RAG pipeline, a vector store, or an agent/tool layer, the plugin knows — and switches on the AI-specific analysis.
detect_ai_stack scans the connected repo for LangChain, LlamaIndex, OpenAI/Anthropic/Bedrock SDKs, transformers/torch/vLLM, Pinecone/Weaviate/Chroma, MLflow/Kubeflow/SageMaker, and AutoGen/CrewAI/LangGraph markers.
Direct injection, indirect injection via ingested documents, and vector-store poisoning — each mapped to OWASP LLM01/LLM08 and MITRE ATLAS technique AML.T0051.
Fine-tuning data poisoning and unsigned model-registry deploys, mapped to OWASP LLM03/LLM04 and MITRE ATLAS AML.T0020 / AML.T0018.
Agents given more tool authority than their task needs, and model output trusted downstream without validation — OWASP LLM06/LLM05, MITRE ATLAS AML.T0053.
Missing token/turn/iteration limits that enable cost exhaustion or "denial of wallet" attacks against a metered inference endpoint — OWASP LLM10.
New draw.io node types — training pipeline, model registry, vector store, inference endpoint, agent/tool layer — so RAG and agentic systems render correctly in the DFD.
Not just a STRIDE label — every threat and attack-chain step carries an ID from an industry-standard list.
| Framework | Applies to | Example ID |
|---|---|---|
| OWASP Top 10 (2021) | Conventional web/application components | A01:2021 Broken Access Control |
| OWASP API Security Top 10 (2023) | REST/GraphQL/RPC APIs, including ML inference endpoints | API4:2023 Unrestricted Resource Consumption |
| OWASP Top 10 for LLM Applications (2025) | LLM apps, RAG pipelines, agents | LLM01:2025 Prompt Injection |
| MITRE ATT&CK (Enterprise) | Conventional infrastructure tradecraft in attack chains | T1078 Valid Accounts |
| MITRE ATLAS | AI/ML-specific tradecraft in attack chains | AML.T0051 LLM Prompt Injection |
Both report builders render these as a dedicated column in the threat register and a standalone Framework Coverage Mapping section/sheet.
Same skill, same reference docs, same scripts — three entry points depending on your agent of choice.
Native plugin — .claude-plugin/plugin.json and .mcp.json. Install directly or from this repo.
.cursor/rules/threat-modeling.mdc project rule plus .cursor/mcp.json for the four connectors.
Root AGENTS.md, read automatically, plus config/codex-config.example.toml for MCP server registration.
Illustrative preview — actual reports are generated from your live data, with as many rows as the assessment produces.
| ID | Threat | L×I | Risk | OWASP |
|---|---|---|---|---|
| S-1 | Session token replay | 4×5 | High | A07:2021 |
| E-1 | Parameter tampering on status | 3×5 | High | API5:2023 |
| I-2 | Excess PII sent to vendor | 3×4 | Medium | API6:2023 |
| T-1 | Unsigned internal gRPC payload | 2×4 | Medium | A08:2021 |
| D-1 | No per-account rate limit | 2×2 | Low | API4:2023 |
| Step | Threat | Action |
|---|---|---|
| 1 | S-1 | Replay captured session token |
| 2 | E-1 | Force applicant status to "approved" |
| 3 | R-1 | No immutable log → bypass goes undetected |
| ID | Threat | L×I | Risk | OWASP LLM |
|---|---|---|---|---|
| T-1 | Direct prompt injection overrides system instructions | 5×5 | High | LLM01:2025 |
| E-1 | Excessive agency — refund tool with no approval gate | 4×5 | High | LLM06:2025 |
| I-2 | Cross-tenant PII bleed via RAG context | 3×5 | High | LLM02/LLM08:2025 |
| D-1 | Unbounded consumption — no token/turn limits | 4×3 | Medium | LLM10:2025 |
| Step | Threat | MITRE ATLAS |
|---|---|---|
| 1 | T-2 Poisoned KB doc retrieved as RAG context | AML.T0051 |
| 2 | E-1 Agent calls refund tool with no approval | AML.T0053 |
| 3 | R-1 Mutable logs delay detection | — |
Install the plugin, then configure only the connectors you actually plan to use — none are mandatory.
.plugin file from the repo's releases and install it in Claude Code or Cowork — or, for Cursor, enable .cursor/rules/threat-modeling.mdc + .cursor/mcp.json; for OpenAI Codex CLI, it reads AGENTS.md automatically (see config/codex-config.example.toml for MCP setup)..env.example to .env and fill in API keys for the tools you use (table below).ANTHROPIC_API_KEY if you want the token-minimizing summarizer (scripts/summarize.py) to run automatically on large payloads.| Connector | Env vars | Where to get credentials |
|---|---|---|
| Jira | JIRA_BASE_URL, JIRA_EMAIL, JIRA_API_TOKEN | Atlassian account → API tokens |
| Jenkins | JENKINS_BASE_URL, JENKINS_USER, JENKINS_API_TOKEN | Jenkins → User → Configure → API Token |
| ServiceNow | SERVICENOW_INSTANCE_URL, SERVICENOW_USER, SERVICENOW_PASSWORD | ServiceNow admin / service account |
| Code repo | REPO_PROVIDER, REPO_TOKEN, REPO_OWNER, REPO_NAME | GitHub → Settings → Developer settings → PAT (read-only repo scope) |
| Model config | ANTHROPIC_API_KEY, MODEL_NAME | Anthropic Console; MODEL_NAME defaults to claude-sonnet-5 |
The report and diagram generators run standalone against a JSON spec — useful for previewing the output format before wiring up live tools.
# Conventional application example python3 scripts/generate_drawio.py skills/threat-modeling/references/examples/sample_threat_model_spec.json MyService_Threat_Model.drawio threat_model python3 scripts/build_docx_report.py skills/threat-modeling/references/examples/sample_report_data.json MyService_Report.docx python3 scripts/build_xlsx_report.py skills/threat-modeling/references/examples/sample_report_data.json MyService_Register.xlsx # AI / RAG / agentic system example python3 scripts/generate_drawio.py skills/threat-modeling/references/examples/sample_ai_threat_model_spec.json AI_Agent_Threat_Model.drawio threat_model python3 scripts/build_docx_report.py skills/threat-modeling/references/examples/sample_ai_report_data.json AI_Agent_Report.docx python3 scripts/build_xlsx_report.py skills/threat-modeling/references/examples/sample_ai_report_data.json AI_Agent_Register.xlsx