STRIDE GPT CLI
A CLI that reads a project's code and builds a STRIDE threat model, with a report in Markdown, JSON, SARIF or HTML
- 1,154 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Sends source code, architecture descriptions and diagrams to an external model provider, while a local model keeps data with you
- Stores provider API keys in settings or a `.env` file, and analyzing a large project spends money on your account
- The agent reads project files and can run for a long time unattended after you accept the plan
Install
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/stride-gptDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Sends source code, architecture descriptions and diagrams to an external model provider, while a local model keeps data with you
- Stores provider API keys in settings or a `.env` file, and analyzing a large project spends money on your account
- The agent reads project files and can run for a long time unattended after you accept the plan
This is third-party code. Review the repository files before installing.
What it does
STRIDE GPT builds a threat model with the STRIDE method. `stride-gpt analyze ./my-app` starts its own agent: it plans the analysis, splits the project into subsystems, reads files and for each subsystem produces a threat table with a scenario, possible impact and a pointer to lines of code. Each threat gets a technique ID from the MITRE catalogs, and for AI applications the OWASP lists for large language models and agentic systems are added. `stride-gpt quick` builds the same kind of threat model from a text description of the application, from a file or stdin. `stride-gpt` with no arguments opens an interactive shell with the slash commands `/analyze`, `/quick`, `/reports` and `/config`. The report is saved as Markdown, JSON, SARIF for import into GitHub, GitLab, Azure DevOps and IDEs, or a self-contained HTML file. The analysis plan, the findings and a run manifest with models and version are written next to the report. Models connect through LiteLLM: OpenAI, Anthropic, Google AI, Mistral, Groq, DeepSeek and a local LM Studio. A stronger model can take planning and the final synthesis while a cheaper one does the bulk of the work. A separate Streamlit web interface installs from source or from a Docker image.
Who it is for. For security engineers and developers who need a first draft of a threat model from existing code or an architecture description.
Good fit when
- You need a draft threat model from code before a service ships: `stride-gpt analyze . -o report.json -f json`
- Results must reach GitHub or GitLab: the SARIF format imports into their security dashboards
- You design an app with RAG, several agents or code execution and want threats checked against the OWASP lists for AI
- There is no code yet, only an architecture description: `stride-gpt quick -i app-description.txt` builds a threat model from the text
- You want Gherkin test scenarios and DREAD scoring for found threats, which the web interface produces
Not a fit when
- You want to plug a tool into Claude Code or Cursor as a skill: STRIDE GPT is a separate program with its own agent and model provider keys
- Source code must not go to external providers and you have no local model
- You need a vulnerability scanner that finds concrete bugs in dependencies: STRIDE GPT describes architectural threats
Example request
Install STRIDE GPT and build a threat model for this repository, saving the report as SARIFLimitations
- A provider API key or a local LM Studio server is required. Costs go to your account at the provider, and the author advises setting a spending limit.
- Code analysis makes many model calls and file reads, and the cost grows with project size. The `--max-llm-calls` flag caps calls per subsystem (25 by default).
- The threat model remains a language model draft. A security specialist should review it.
- The web interface has no authentication and is meant for local use by one person.
How to disable. `pip uninstall stride-gpt` removes the program. Analysis reports stay in `~/.stride-gpt/reports/analyze/` and can be deleted by hand. Remove API keys saved through `/config` or a `.env` file separately and revoke them at the provider if needed.
FAQ
How do I build a STRIDE threat model with AI?
Run `pip install stride-gpt`, set a provider key and run `stride-gpt analyze .` in the project root. The agent shows an analysis plan and, after your approval, produces threat tables per subsystem. Without code, `stride-gpt quick` works from a text description.
Which models does STRIDE GPT support?
OpenAI, Anthropic, Google AI, Mistral, Groq and DeepSeek connect through LiteLLM, and local models work through LM Studio. Set the model with `--worker-model` and `--architect-model` in the `anthropic/claude-sonnet-5` format. `--no-architect` turns the architect tier off.
Where does my code go during analysis?
To the model provider you chose. The description, architecture and diagrams reach it over the network, and its rules decide storage. For sensitive systems the author suggests local models through LM Studio or sanitizing the description first.
How do I import results into GitHub?
Run the analysis with `-f sarif -o report.sarif`. SARIF imports into GitHub, GitLab, Azure DevOps and IDEs, and threats in it carry a `mitre_attack` property with the technique ID.
What is the difference between `analyze` and `quick`?
`analyze` reads the codebase and cites file lines, while `quick` works only with your text and collapses everything into one Application subsystem. Pick `analyze` for existing code and `quick` for a project at the idea stage.
Discussion
No questions or reviews yet.
Related
CLI toolsA threat modeling skill: the agent reads the project code and builds a threat model with file and line citations
An AWS Labs MCP server that guides the agent through phased STRIDE threat modeling, from context to mitigations and code checks.
A Datadog CLI that hunts for vulnerabilities in source code with Claude, GPT or Gemini and saves the result as SARIF
Skills that write a threat model for an open-source project: what it promises and disclaims. A contract document, not a scanner
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
A taint analysis engine for Java and Kotlin with agent skills: scans code, triages findings and writes rules.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| STRIDE GPT (this card) | no | 1,154 | ||
| Claude Code Security Reviewer | no | 6,866 | an Anthropic GitHub Action that reviews pull request changes, while STRIDE GPT models threats for the whole project | |
| Semgrep | yes | not required | 17,635 | a static scanner with rules for finding concrete bugs in code that builds no architecture threat model |
README in short
The repository page lists the features: agentic code analysis, an interactive shell, support for AI applications, MITRE mapping and a diagram editor in the web interface. It goes on with the version history, three install routes, command examples, a table of flags and a sample report. The security section explains how to protect API keys and which data goes to the model provider.