mrwadams/stride-gpt

An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.

What it solves

STRIDE GPT is an AI-powered tool designed to automate and enhance threat modeling. It helps security professionals and developers identify potential security threats, map them to standardized frameworks like MITRE ATT&CK and ATLAS, and generate actionable mitigations and test cases for applications, including traditional software, Generative AI, and agentic AI systems.

How it works

The tool uses Large Language Models (LLMs) to analyze application descriptions, architecture diagrams, or entire codebases. It follows the STRIDE methodology to identify threats and can employ an agentic approach where an AI agent plans, explores, and synthesizes findings across different subsystems. It integrates with various LLM providers via LiteLLM and can parse XML from draw.io diagrams or Mermaid source for Data Flow Diagrams (DFDs) to gain a deeper understanding of the system architecture.

Who it’s for

It is built for security engineers, architects, and developers who need to perform comprehensive threat modeling and risk assessment without starting from scratch, particularly for complex modern AI-driven applications.

Highlights

  • Agentic Codebase Analysis: Automatically analyzes codebases to generate deep STRIDE threat models.
  • Cros-Layer Threat Analysis: Identifies attack chains across different architectural layers.
  • Multi-modal Input: Supports architecture diagrams, flowcharts, and text descriptions as inputs.
  • Framework Integration: Maps threats to MITRE ATT&CK, MITRE ATLAS, and OWASP Top 10 for LLM and Agentic applications.
  • Comprehensive Output: Generates threat models, attack trees, DREAD risk scoring, Gherkin test cases, and reports in Markdown, JSON, SARIF, and HTML.
  • Integrated Diagramming: Includes an embedded draw.io editor and Mermaid DFD generation.