Build and maintain a STRIDE threat model

CodeGraph derives candidate assets, processes, data stores, flows, trust boundaries, and STRIDE threats from the current CPG. The output gives the professional threat-model review a structured starting point; the reviewer completes architecture and threat coverage.

Generate a baseline

python -m src.cli threat-model generate `
  --format json `
  --min-severity medium `
  --output <threat-model.json>

The severity choices are --min-severity {low,medium,high,critical}. Preserve the project and code revision with the JSON baseline.

Generate a data-flow diagram

python -m src.cli threat-model dfd --format mermaid --output <dfd.mmd>

Review inferred processes, stores, external entities, flows, and trust boundaries against the deployed architecture. An omitted component in the graph cannot appear in the diagram.

Inspect and filter threats

python -m src.cli threat-model list --severity high --category Tampering --format json

The severity filter is --severity {low,medium,high,critical} and --category accepts one category value per invocation. Verify the category spelling with current --help.

Update from a reviewed baseline

python -m src.cli threat-model update --previous <threat-model.json> `
  --changed-files <file-one> <file-two> `
  --format json `
  --output <threat-model-updated.json>

An incremental update is valid only when the previous model belongs to the expected revision and the changed-file list is complete. Otherwise generate a new baseline.

Review workflow

1. Validate assets, flows, boundaries, deployment assumptions, and identities.
2. Classify candidate threats and remove false positives with rationale.
3. Bind mitigations to an owner, verification method, and due date.
4. Retain unresolved threats and evidence gaps; do not convert them to Pass implicitly.
5. Regenerate after architecture or trust-boundary changes.

Contract sources

• src/cli/security_suite/threat_model_commands.py — generate/update/DFD/list parser;
• src/security/threat_model/ — builder, STRIDE classifier, boundaries, and exporter;
• src/mcp/tools/security_suite/threat_model.py — authorized role-scoped tools;
• generated REST reference — live API operations, if the deployment exposes them.