stride-gpt
installs/mo · pypistarsforks
How to install stride-gpt?
mrwadams/stride-gpt
$git clone https://github.com/mrwadams/stride-gptSTRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models (LLMs) to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication method
README.md
| 1 | <p align="center"> |
| 2 | <img src="stride-gpt-logo.png" alt="STRIDE GPT Logo" width="400"> |
| 3 | </p> |
| 4 | |
| 5 | STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models (LLMs) to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the application is internet-facing or processes sensitive data. The model then generates its output based on the provided information. |
| 6 | |
| 7 | ## Table of Contents |
| 8 | - [Support the Project](#support-the-project) |
| 9 | - [Features](#features) |
| 10 | - [Enterprise Deployment](#enterprise-deployment) |
| 11 | - [Talk at Open Security Summit](#talk-at-open-security-summit) |
| 12 | - [Changelog](#changelog) |
| 13 | - [Installation](#installation) |
| 14 | - [Repository layout](#repository-layout) |
| 15 | - [Usage](#usage) |
| 16 | - [Interactive REPL cheat sheet](#interactive-repl-cheat-sheet) |
| 17 | - [Sample output](#sample-output) |
| 18 | - [Security Best Practices](#security-best-practices) |
| 19 | - [Contributing](#contributing) |
| 20 | - [License](#license) |
| 21 | |
| 22 | ## Support the Project |
| 23 | |
| 24 | If you find STRIDE GPT useful, please consider supporting the project: |
| 25 | |
| 26 | - ⭐ **Star the repository** on GitHub to help more people discover the tool |
| 27 | - ☕ **Buy me a coffee** to support continued development and maintenance |
| 28 | |
| 29 | <a href="https://buymeacoffee.com/mrwadams" target="_blank"> |
| 30 | <img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px; width: 217px;"> |
| 31 | </a> |
| 32 | |
| 33 | ## Features |
| 34 | - **Agentic codebase analysis**: Point the CLI at a codebase and get an autonomous, deep STRIDE threat model — the agent plans, explores, and synthesizes findings across subsystems |
| 35 | - **CLI and interactive REPL**: Full-featured terminal experience with tab completion, history, and real-time progress — no browser required |
| 36 | - Simple and user-friendly Streamlit web interface |
| 37 | - Generates threat models based on the STRIDE methodology |
| 38 | - **Agentic AI support**: Specialized threat modeling for agentic AI systems with OWASP Top 10 for Agentic Applications (ASI) integration |
| 39 | - **Generative AI support**: Threat modeling for GenAI applications with OWASP LLM Top 10 integration |
| 40 | - **MITRE ATT&CK & ATLAS mapping**: Threats are annotated with standardized adversary technique IDs (MITRE ATT&CK Enterprise for traditional infrastructure attacks, ATLAS for ML/LLM-specific attacks) — surfaced as columns in markdown, linked pills in HTML, and `mitre_attack` properties in SARIF |
| 41 | - **Architectural pattern detection**: Automatically detects RAG pipelines, multi-agent systems, code execution environments, tool ecosystems, and more from application descriptions (inspired by [CSA MAESTRO](https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro)) |
| 42 | - **Embedded draw.io diagram editor**: Create and edit architecture diagrams directly in STRIDE-GPT using the integrated [diagrams.net](https://www.diagrams.net/) editor — no external tool needed. Diagrams are parsed as XML to extract components, connections, and trust boundaries, providing significantly richer context for threat model generation than image analysis alone. The existing image upload workflow is unchanged. By default the editor loads from the hosted `embed.diagrams.net`; for self-hosted or air-gapped deployments, point it at your own draw.io via the `STRIDE_GPT_DRAWIO_URL` environment variable |
| 43 | - Multi-modal: Use architecture diagrams, flowcharts, etc. as inputs for threat modelling across all supported vision-capable models |
| 44 | - **Data Flow Diagrams**: Generate DFDs from your application description (or parse an uploaded DFD image), edit the Mermaid source live, and feed the confirmed diagram back into the Threat Model and Attack Tree prompts as the authoritative system model. CLI `/analyze` also emits a system-level DFD alongside its findings |
| 45 | - Generates attack trees to enumerate possible attack paths |
| 46 | - Suggests possible mitigations for identified threats |
| 47 | - Supports DREAD risk scorin |
People who liked this also viewed
6 picksType
- mcp-scannerScan MCP servers for potential threats & security findings.MCP ServersJul 2026
- hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.MCP ServersJul 2026
- agent-scanSecurity scanner for AI agents, MCP servers and agent skills.MCP ServersJul 2026
- falcon-mcpConnect AI agents to CrowdStrike Falcon for automated security analysis and threat huntingMCP ServersJul 2026
- python🔐 Plug-and-play auth for Python MCP servers.MCP ServersAug 2025
- auth0-mcp-serverConnect LLMs and AI agents to Auth0 Management APIs via an MCP server. Use natural-language commands to create apps, deploy Actions, and query logs—runs locally and supports interactive tenant authentication for secure Auth0 administration from AI tools/CLIs.MCP ServersJul 2026
