Skip to main content

Build and maintain a STRIDE threat model

Build a STRIDE model from the CPG. Inspect data flows and trust boundaries, review threats, and compare models after architecture changes.

User Guides

A threat model helps reviewers trace external data through an application, identify changes in trust, and choose controls for its components. Use it when designing an integration, reviewing architecture, or preparing security changes.

CodeGraph derives candidate processes, stores, and data flows from the CPG, identifies trust boundaries, and generates STRIDE threats. The reviewer compares the model with the deployed architecture and adds external systems, identities, and operating conditions.

What the model contains

What the model contains
JSON field Review purpose
components Locate a process, store, or external entity and connect it to source evidence.
flows Trace data transfers between components.
trust_boundaries Review crossings between areas with different trust conditions.
threats Inspect each threat’s category, severity, affected component, and evidence.

STRIDE categories

STRIDE provides six categories for a systematic review:

STRIDE categories
Category Review question
spoofing How does the component verify who is making a request?
tampering How are data and operations protected against modification?
repudiation Which records identify the actor responsible for an action?
info_disclosure Who can access sensitive data?
dos How does the component limit resource consumption?
elevation How are permissions checked for a privileged operation?

Prepare the environment

Install the CLI using the CLI guide. Run these PowerShell examples from the CodeGraph repository root. You need an accessible GoCPG gRPC service and a CPG for the assessed revision. Every command requires explicit --db; it does not refresh the graph.

$env:CODEGRAPH_ALLOW_LOCAL_PYTHON_CLI = '1'
$cpgPath = 'C:/analysis/project.duckdb'

Replace $cpgPath with your CPG identifier. Use a writable directory: output files below are written to the current directory and overwrite files with the same names.

Generate a baseline

python -m src.cli threat-model generate `
  --db "$cpgPath" --language en --format json `
  --min-severity medium --output 'threat-model.json'
if ($LASTEXITCODE -ne 0) { throw 'Threat model generation failed' }
$model = Get-Content -Raw 'threat-model.json' | ConvertFrom-Json
$model.threats.Count

The --min-severity choices are low, medium, high, and critical. Preserve the project, indexed Git revision, command arguments, and JSON output. Inspect components, flows, trust_boundaries, and threats. If threats is empty, review the extracted components, flows, and the basis for their classification. The gost format presents the model for a subsequent requirements review. With --format json and no --output, generation appends a summary to stdout; that stream is not a single JSON document.

Generate a data-flow diagram

python -m src.cli threat-model dfd --db "$cpgPath" --format mermaid --output 'dfd.mmd'
if ($LASTEXITCODE -ne 0) { throw 'DFD generation failed' }

Open dfd.mmd in a Mermaid viewer. Compare components, flows, and trust boundaries with the architecture. If there are no components, the command prints No components to diagram. and returns 0 without writing a file. Check that message; an old file does not prove the current run succeeded.

Filter threats

python -m src.cli threat-model list --db "$cpgPath" --severity high --category Tampering --format json

list rebuilds a model from the CPG; it does not read the saved threat-model.json. --severity high selects exactly high, excluding critical. Category filtering uses a case-insensitive substring. STRIDE values are spoofing, tampering, repudiation, info_disclosure, dos, and elevation. A typo can return an empty result. The output is a JSON array with id, category, title, severity, cwe_ids, affected_component, status, and risk_score fields.

Compare with the previous model

python -m src.cli threat-model update --db "$cpgPath" `
  --previous 'threat-model.json' --changed-files 'src/file-one.py' 'src/file-two.py' `
  --language en --format json --output 'threat-model-updated.json'
if ($LASTEXITCODE -ne 0) { throw 'Threat model update failed' }
$updated = Get-Content -Raw 'threat-model-updated.json' | ConvertFrom-Json
$updated.delta

Replace the paths with your actual changed-file list. update builds a new full model and compares it with the previous model. --changed-files records context; it does not restrict analysis. The new model replaces the old one: manual statuses and mitigations are not automatically retained. Reapply reviewed decisions after checking the differences. Generation above uses medium, while update builds with low; newly included low-severity threats do not alone establish a regression. Inspect delta counts, component changes, and the reason for each changed threat.

Review workflow

For example, you are adding an event receiver for an external system. Locate the handler in components, trace incoming connections in flows, and identify the trust boundary. For spoofing, review sender authentication; for tampering, review signature and event-content validation; for repudiation, review the log of the sender and processing result. Record the selected controls and tests with the integration decision. This illustrates a review; use the components and threats from your project’s model.

  1. Validate flows, trust boundaries, identities, and deployment assumptions.
  2. Assess candidate threats and record the rationale for rejected findings.
  3. Assign each mitigation an owner, verification method, and due date.
  4. Retain unresolved threats and evidence gaps. A successful-control verdict requires verification.
  5. Regenerate after architecture changes and reconcile the result with reviewed decisions.

Work through MCP

Select the project and a connection with the codex:role:codegraph_appsec:read profile using the MCP operator guide. For local stdio, set the CODEGRAPH_PROJECT environment variable to the registered project name before starting the MCP server. For example, select the codegraph project in PowerShell with $env:CODEGRAPH_PROJECT = 'codegraph'. The tools use the selected project’s CPG:

  • codegraph_security_threat_model_generate builds a model. Set min_severity to the minimum threat severity and use include_inferred to include threats inferred from trust-boundary analysis. Select language (ru or en) and format (json, markdown, gost, or sarif).
  • codegraph_security_threat_model_dfd_generate creates a diagram with format="mermaid" or returns components, flows, and trust boundaries with format="json".

Use the JSON components array to review the complete component inventory, including external entities, and the diagram to examine their connections.

Report a documentation issue