Threat Modeling MCP Server
An AWS Labs MCP server that guides the agent through phased STRIDE threat modeling, from context to mitigations and code checks.
- 126 ★ on the repository
- Last commit
- Apache-2.0
Minimal access
Why this level
- The server runs and scans nothing: it steers the model through phases and writes reports to a local folder.
- Auto-approval of every tool in the sample configurations removes call confirmation.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/threat-modeling-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The server runs and scans nothing: it steers the model through phases and writes reports to a local folder.
- Auto-approval of every tool in the sample configurations removes call confirmation.
This is third-party code. Review the repository files before installing.
What it does
The server gives the agent a threat modeling sequence based on STRIDE and keeps the working model in process memory. Phases run in order: business context, architecture, threat actors, trust boundaries, asset flows, threat identification, mitigation planning, residual risk and a final report. Each step has a tool such as `manage_threats`, `manage_architecture` or `manage_trust_boundaries`. A separate `manage_code_validation` tool records evidence the agent found in code, updates threat and mitigation statuses and keeps the phase open until every current threat is covered. The report exports to Markdown and JSON with `export_threat_model`. The server calls no external model and uses the model of the client it is connected to.
Who it is for. Developers and security engineers who need a structured threat model of a project rather than a free-form chat about security.
Good fit when
- A new service is heading to release and the team needs a threat model with trust boundaries.
- The agent reviews one monorepo subfolder and records threats for it only.
- An architecture diagram is attached as an image and components and data flows must be derived from it.
- After code fixes the model is rebuilt and mitigation statuses are checked against the implementation.
Not a fit when
- An automated vulnerability scanner is needed: the server structures analysis but does not scan code.
- The result must survive closing the session without a manual export.
- The agent has no model of its own and external model calls are not allowed.
Example request
Threat model this project using the Threat Modeling MCP Server, complete every phase and save the report.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
FASTMCP_LOG_LEVEL- Server log level, set to `ERROR` in the README examples.
Limitations
The working model lives in process memory: JSON and Markdown reach disk, in a `.threatmodel` folder, only after export and are not loaded automatically in the next session. Quality depends on the client's model, and the README advises naming the server in the prompt so the agent does not take a shortcut. The sample configurations auto-approve every tool, so review that list against your own rules. Examples target Amazon Q, Cline and Kiro, and for other clients the configuration block has to be adapted by hand.
How to disable. Delete the `threat-modeling-mcp-server` entry from the client's `mcp.json` and restart the IDE. Delete exported reports in `.threatmodel` separately.
FAQ
Which tools does the server have?
Eleven: `manage_workflow`, `export_threat_model`, `manage_system_context`, `manage_assumptions`, `manage_architecture`, `manage_threat_actors`, `manage_trust_boundaries`, `manage_asset_flows`, `manage_threats`, `inspect_data_models` and `manage_code_validation`.
Does the server send data to outside services?
No, the tools are internal and make no external calls, as the README states. Your client's model sees the data, and its route depends on the client and other connected servers.
How do I limit analysis to part of a project?
Ask the model to review a subfolder through the server. Set the export path separately, because it is not inferred from the analysis scope.
How do I save the result?
Ask to save the report. The server writes JSON and Markdown to `.threatmodel`, and a file name like `my_model.tc.json` can be set in the request.
Can I remove tool auto-approval?
Yes, replace the `autoApprove` array with an empty `[]` and the client will ask permission for each call.
Discussion
No questions or reviews yet.
Related
MCP serversA scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
MCP Observatory: security testing for MCP servers
MCP Observatory
An MCP server scanner: checks schemas, drift and attack behavior, runs in CI and as an MCP server for agents
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
A threat modeling skill: the agent reads the project code and builds a threat model with file and line citations
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
MCP Scanner
mcp-scanner
A scanner from Cisco AI Defense: checks MCP servers and their tools for threats with three engines, YARA rules, a model and the Cisco API
README in short
The README has sample prompts, a feature list, installation through `uvx` for Amazon Q, Cline and Kiro, a description of STRIDE phases, assumptions and development.