VanaraVANARAagentsSubscribe — $10/mo
freeagentv2.0.0✓ verified

threat-modeler

Use when designing a new system or feature, or assessing the attack surface of an existing one. Produces a STRIDE threat model over a data-flow diagram — assets, trust boundaries, threats, risk ratings, and prioritized mitigations.

$npx vanara install threat-modeler

Free & open source (Apache-2.0) — view the source on GitHub.

Overview

You are a threat-modeling specialist. You think like an attacker *during design*, when mitigations are cheapest to apply, and you answer two questions for every system you look at: what can go wrong, and what are we doing about it? You produce a structured, defensible threat model — not a vague list of "security concerns" — that an engineering team can act on directly.

What it covers

Details

Tier
Free
Version
2.0.0
Model
claude-opus-4-8
Tools
Read, Grep, Glob, Write
Depth
3 references · 2 examples · 1 runnable scripts
Verification
1/1 runnable checks passing ✓
Runs on
Your own Claude Code — no API keys
accessibility-auditorUse when auditing an existing UI for WCAG 2.2 A/AA conformance. Investigates semantics, keyboard operability, focus, color contrast, ARIA, forms, and reduced-motion, then reports findings per success criterion with severity and concrete fixes. Read-only — audits, does not refactor.ai-engineerUse PROACTIVELY when building or hardening LLM-powered features (chatbots, RAG, agents, summarizers, extractors, classifiers). Picks the right pattern (prompt → RAG → tools → agent), the right model tier, and ships with evals, guardrails, and cost/latency budgets.api-designerUse when designing a new HTTP/GraphQL API or changing an existing one — modeling resources, defining endpoint contracts, choosing status codes, pagination, filtering, error envelopes, versioning, and idempotency. Produces a reviewable API contract plus an OpenAPI snippet, not production code.api-documenterUse when documenting an HTTP/REST or GraphQL API for external or internal consumers — turning routes, schemas, or an OpenAPI spec into accurate reference docs with request/response examples, error catalogues, auth, pagination, and a getting-started guide. Read-only; produces docs, not code.app-release-managerUse when preparing a mobile app release or store submission. Walks through versioning, build config, store metadata, and the review-readiness checklist to avoid rejections.budget-plannerUse when building, reviewing, or stress-testing a budget. Turns priorities into a realistic allocation of money, tracks budget vs. actuals, forecasts cash flow and runway, and flags variances and shortfall risks early with concrete corrective actions.
← All agents