# Threat Modeler

Produces evidence-linked threat models for agentic systems and other risk-surface changes.

Status: active

## The problem

Adding an MCP server, model call, persistent memory, authentication boundary, external API, or user-data flow changes a system's threat surface. A generic checklist does not connect those risks to the exact code, configuration, test, or decision that mitigates them.

## What I built

Threat Modeler is a lightweight workshop workflow that turns a concrete change into a Markdown threat-model artifact. It inventories assets and actors, describes data flows, applies STRIDE, cross-maps relevant OWASP LLM and Agentic risks, MITRE ATLAS techniques, and NIST AI 600-1 guidance, then records mitigations, residual risks, and decisions.

Every mitigation row requires evidence and a status. The artifact documents a control; it does not claim the control exists unless the cited implementation or test proves it.

## Relationship to Build Loop

Build Loop can require a threat model when a plan crosses a security boundary. Threat Modeler produces that design-time artifact; runtime enforcement remains a separate responsibility.

## Links

- [HTML project page](https://rosslabs.ai/projects/threat-modeler/)
- [Source code](https://github.com/tyroneross/threat-modeler)