Threat Modeler
Produces evidence-linked threat models for agentic systems and other risk-surface changes.
The problem
Adding an MCP server, model call, persistent memory, authentication boundary, external API, or user-data flow changes a system’s threat surface. A generic checklist does not connect those risks to the exact code, configuration, test, or decision that mitigates them.
What I built
Threat Modeler is a lightweight workshop workflow that turns a concrete change into a Markdown threat-model artifact. It inventories assets and actors, describes data flows, applies STRIDE, cross-maps relevant OWASP LLM and Agentic risks, MITRE ATLAS techniques, and NIST AI 600-1 guidance, then records mitigations, residual risks, and decisions.
Every mitigation row requires evidence and a status. The artifact documents a control; it does not claim the control exists unless the cited implementation or test proves it.
Relationship to Build Loop
Build Loop can require a threat model when a plan crosses a security boundary. Threat Modeler produces that design-time artifact; runtime enforcement remains a separate responsibility.