MCP 服务器

threatmodel-mcp

Enables AI-powered threat modeling with tools for creating threat models, analyzing security threats, generating security controls, and validating architecture against best practices.

README

`ThreatModel-MCP`

Model Context Protocol server for AI-powered threat modeling.

<samp>

Demo

Web Application Architecture

Setup

Install dependencies <code>pip install -r requirements.txt</code>
Install Graphviz (optional, for PNG diagrams) 
- Windows: Download from https://graphviz.org/download/ 
- Mac: <code>brew install graphviz</code> 
- Linux: <code>sudo apt-get install graphviz</code>

Configure MCP client (Claude Desktop, etc.)

{
  "mcpServers": {
    "threatmodel": {
      "command": "python",
      "args": ["/full/path/to/threatmodel_server.py"]
    }
  }
}

Available Tools

<code>create_threat_model</code>

Creates comprehensive threat models with components, boundaries, and data flows.

Parameters:

<code>system_name</code> - Name of the system
<code>components</code> - Array of system components with types, boundaries, security controls
<code>boundaries</code> - Trust boundaries with security levels (0-10)
<code>dataflows</code> - Data flows between components with protocols and classifications
<code>output_format</code> - "diagram", "pytm_code", "threats", or "full_analysis"
<code>auto_save</code> - Auto-save files (default: true)
<code>save_path</code> - Directory to save files (default: current directory)

<code>analyze_security_threats</code>

Performs deep security analysis using multiple frameworks.

Parameters:

<code>analysis_depth</code> - "basic", "standard", "comprehensive", or "paranoid"
<code>threat_frameworks</code> - ["STRIDE", "MITRE_ATTACK", "OWASP", "NIST", "CIS"]
<code>focus_areas</code> - Authentication, data protection, network security, etc.
<code>compliance_frameworks</code> - ["SOC2", "ISO27001", "HIPAA", "PCI-DSS", "GDPR"]

<code>generate_security_controls</code>

Generates security control recommendations based on threats.

Parameters:

<code>threats</code> - Array of identified threats
<code>risk_appetite</code> - "low", "medium", or "high"
<code>technology_stack</code> - Current technologies (AWS, k8s, etc.)
<code>prioritization_method</code> - "risk_based", "quick_wins", "compliance_driven"

<code>validate_architecture</code>

Validates architecture against security best practices.

Parameters:

<code>components</code> - System components to validate
<code>validation_rules</code> - ["zero_trust", "encryption_in_transit", "api_gateway_pattern"]
<code>architecture_patterns</code> - ["microservices", "serverless", "hybrid_cloud"]

Component Types

Actors: user, admin, service_account Services: server, api_gateway, microservice, lambda, container Data: database, cache, message_queue, file_storage Infrastructure: load_balancer, firewall, external_service

Protocols & Classifications

Protocols: HTTPS, gRPC, WebSocket, SQL, Redis, S3 API Data Classifications: PUBLIC → INTERNAL → CONFIDENTIAL → RESTRICTED → TOP_SECRET

Auto-Save Features

Generated files (with timestamps):

<code>SystemName_threatmodel_YYYYMMDD_HHMMSS.png</code> - Diagram (when output_format="diagram")
<code>SystemName_threatmodel_YYYYMMDD_HHMMSS.dot</code> - DOT source (always)
<code>SystemName_threatmodel_YYYYMMDD_HHMMSS.py</code> - PyTM code (always)
<code>SystemName_threatmodel_analysis_YYYYMMDD_HHMMSS.md</code> - Analysis report (when output_format="full_analysis")

Example Usage

Example 1: Codebase Analysis

Prompt: <code>"Create a high level threat diagram of current codebase"</code>

OpenAI Codex Architecture

Example threat model diagram generated from a cloned <a href="https://github.com/openai/codex">OpenAI Codex</a> codebase, showing multi-layer security boundaries, component classifications, and encrypted data flows between services.

Example 2: Web Application Architecture

Prompt: <code>"A web application where the user interacts with a web server, which in turn communicates with a database server. The web server and database server are outside the user's trust boundary. The user connects to the web application via a browser. The web server handles requests and responses, and the database server stores application data. The trust boundary is around the user only; both the web server and database server are outside this boundary"</code>

Web Application Architecture