Open-source visual threat modeling for AI, LLM, agentic systems, and post-quantum cryptography
English | 日本語
Draw a data flow diagram in your browser, and CyberRiskScape enumerates the threats that apply to your architecture — including the ones classical threat modeling tools have no vocabulary for: goal hijacking, tool misuse, privilege carry-over, memory poisoning.
It runs entirely in the browser. No server, no account, no telemetry — your design never leaves your machine.
▶ Live demo: https://takashi-ohmoto-git.github.io/CyberRiskScape/ (nothing to install)
New here? Start with Getting Started — what the tool is for, how the screen is laid out, and how to work on the canvas, with screenshots. For the thinking behind it, see An Introduction to Secure by Design. For the feature list, see here.
Interface language. English and Japanese are both supported — use the JA / EN switch in the top bar, and your choice is remembered. The interface, all 266 threat rules (name, category, description, mitigations) and every component type label are translated. Help is welcome.
Alongside classical STRIDE, CyberRiskScape treats AI agents, LLMs, MCP servers, and long-term memory as first-class component types, with a rule set to match.
| Framework | Rules | Covers |
|---|---|---|
STRIDE |
175 | Spoofing, tampering, repudiation, information disclosure, DoS, elevation of privilege |
AI |
35 | Adversarial ML, model extraction, training data poisoning |
AgenticAI |
56 | Goal hijacking, tool misuse, privilege carry-over, memory poisoning |
This is where the project invests. Most threat modeling tools have zero rules in the third row.
The threat model does not stay inside the diagram: it connects to the tools you use to design, build, and verify. CyberRiskScape ships an MCP server and integrates file-based with API gateways, API testing, identity platforms, and AI agent platforms. It makes no outbound calls, so it also works in air-gapped environments.
| Integrates with | What you get |
|---|---|
| MCP (Claude Code, GitHub Copilot, Cursor, and others) | Coding agents query threats and update the diagram while they design (guide) |
| CI (GitHub Actions) | Detect new threats from diagram diffs, block the PR, and emit SARIF (guide) |
| API gateways (Kong AI Gateway) | Generate the diagram from your decK or kongctl (AI Gateway 2.x) configuration and watch configuration changes in PRs (guide) |
| Coding agents (a Claude Code working directory) | Generate a diagram of the development environment and dependency packages from package.json, requirements.txt, .env, .mcp.json and .claude/ settings; values in .env are never recorded (guide) |
| API testing (Postman, Postman CLI, Newman) | Export verification requests that check the detected threats (guide) |
| Compromise investigation (Velociraptor and the bundled triage script) | When you suspect a compromise, export an investigation plan from the threat model and overlay the collected evidence on the diagram's nodes as "traces found", "cannot rule out", "not investigated" or "no traces". It does not determine whether a compromise occurred (guide) |
| Penetration testing (in-house or external testers) | Export a vendor-neutral test plan with entry points, attack paths, focus test items, and check viewpoints (guide) |
| Identity platforms and NHIs (Okta, SailPoint, CyberArk (Idira), Microsoft Entra ID, Active Directory / LDAP) | Model and assess IdPs, directories, NHIs, PAM and IGA, generate the diagram from a Conjur policy, and pair with each vendor's MCP server to cross-check against the real state of your identities (guide) |
| ASM and external exposure (Shodan) | Generate a diagram of exposed services from a shodan download export, assess and reduce exposure along CISA's four steps, and catch new exposure by diffing against the previous import (guide) |
| ASM and subdomain takeover (ScopeSentry) | Generate a diagram of exposed services and DNS zones from a ScopeSentry export or its API (MCP), assess subdomain takeover, and catch new exposure by diffing periodic imports (guide) |
| AI agent platforms (Salesforce Agentforce) | Dedicated stencils, threat rules, and a diagram template (guide) |
| Automotive (SDV, connected cars) | Dedicated stencils (Vehicle (SDV) category), threat rules based on UN R155 Annex 5, and a zonal-architecture diagram template (guide) |
AI-driven vulnerability review (Anthropic defending-code-reference-harness) |
Export the threat model as THREAT_MODEL.md-compatible input for the review (guide) |
| Vulnerability remediation (Veracode) | An example setup that builds the threat model into a flow fixing SAST and DAST findings with AI, as context, prioritization, and regression tests (guide) |
| Cloud security scanning (Prowler) | Fill the operational posture and attack surface attributes still unset on diagram nodes from Prowler's OCSF findings for AWS, and cross-check FAIL checks against the diagram's threats (guide) |
For the full list of products and how they connect, see Integrations.
- Visual DFD editor — 113 component types across 14 libraries and 16 categories, trust boundaries, and data flows carrying encryption, authentication, and semantic attributes. The library covers network and security appliances (with examples of the equivalent cloud services), Storage & Databases, and Basic Shapes (DFD) drawn in the classic Yourdon notation
- Automatic threat detection — distinguishes inherent threats (a component fires them just by existing) from path-dependent ones (they need a specific connection to exist)
- Attack path analysis — maps routes from attacker to asset and identifies choke points where several routes converge on one defensible node
- PQC migration support — draw a design on a PQC layer, separate from the depth layers, and trace a route from sender to destination, split into segments at each node that terminates or decrypts the encryption. Each segment gets a termination verdict, a likelihood, and a PQC verdict (based on the CRYPTREC Cryptographic Algorithm List, Table 2, and NIST FIPS 203/204/205), and a simple report (CSV) can be exported. A CycloneDX SBOM / CBOM can also be read to check a node's cryptographic libraries and the PQC verdicts of its algorithms (guide)
- Layer copy — copy a depth layer to the PQC layer (or back) as a draft
- Operational posture record — record per node what a diagram cannot show on its own: logging (collection, retention, who can review), encryption at rest, patch status, account review, whether held data is still needed and how many records, and the last review date. Blank fields are evaluated as "no countermeasure" (guide)
- Alert checklist — apply a published alert's measures (bundled: the IPA alert of
2026-10-09, 17 items) to your diagram. Each item shows action needed / not entered / risk
accepted / no issue / not applicable with the related nodes, plus the nodes whose review
record is old. Export CSV or run it in CI with
checklist --fail-on-action(guide) - Compliance mapping — maps detected threats to NIST CSF 2.0 (128 items), NIST AI RMF (72 items), and Japan's AI Business Operator Guidelines (34 items)
- Risk assessment — Impact × Likelihood scoring and risk treatment decisions (mitigate / accept / transfer / avoid)
- Custom rules — add your own detection rules from an in-app editor
- Threat library inspector — read-only view of every rule and the exact conditions that make it fire
- Export — threat lists as CSV / JSON, and as Markdown compatible with the
THREAT_MODEL.mdschema used by Anthropic'sdefending-code-reference-harness; a PDF report (one-page executive summary plus details) and PNG diagram images, with selectable layers (guide) - Local persistence — automatic retention via IndexedDB, plus explicit saves to local files through the File System Access API
Left: component palette and library management. Center: the DFD canvas and its legend. Right: detected threats, each with its firing conditions, three-tier mitigations, compliance references, and sources.
See it running in the live demo.
| Node.js | 20 or later (for development and builds only) |
| Browser | Chromium-based (Chrome / Edge) recommended |
Saving to local files uses the File System Access API, which is Chromium-only. On Firefox and Safari that one feature is disabled; everything else works.
git clone https://github.com/takashi-ohmoto-git/CyberRiskScape.git
cd CyberRiskScape
npm install
npm run devOpen the URL it prints (http://localhost:5173 by default).
Production builds are plain static files and can be hosted anywhere:
npm run build # outputs to dist/
npm run preview # serve the build locally- Place components — add DFD elements (users, LLMs, agents, data stores, …) from the left sidebar onto the canvas
- Connect them — draw data flows and set encryption, authentication, and semantics (tool call, memory write, …)
- Draw trust boundaries — make the crossings explicit
- Review threats — threats appear as you build. Each one opens to show why it fired: its conditions, rule ID, and source
- Assess and decide — record risk scores and a risk treatment; suppress false positives
- Export — CSV, JSON, Markdown, a PDF report, or PNG diagram images
Getting Started walks through each of these steps with screenshots.
npm run dev # dev server
npm run build # production build
npm run preview # preview the build
npm run test # run all tests
npm run test:watch # watch mode
npx tsc --noEmit # type check (strict)The standard check after a change is npx tsc --noEmit plus the test suite. 1,588 tests
currently pass.
A headless CLI can analyze a saved project file without a browser — useful for CI gates. It evaluates only the bundled threat rules (custom rules stored in IndexedDB are not available to it).
npm run build:cli
node dist-cli/main.js analyze <project.json> [options]| Option | Values | Default |
|---|---|---|
--format |
json | sarif | md |
json |
--layer |
L0 | L1 | L2 | L3 |
every layer that has nodes |
--framework |
STRIDE | AI | AgenticAI | ALL |
ALL |
--fail-on |
Critical | High | Medium | Low |
no gate |
--locale |
ja | en |
ja |
--out |
output file path | stdout |
Exit codes: 0 success, 1 --fail-on gate failed, 2 input/argument error.
Compares two versions (base / head) of a saved project file and reports which threat modeling triggers (T1–T8 below) the change hits, plus added/removed threats, disposition changes, and effective severity changes. Markdown output is ready to paste as a PR comment; JSON is for machine processing.
node dist-cli/main.js diff <base.json> <head.json> [options]| Option | Values | Default |
|---|---|---|
--format |
md | json |
md |
--fail-on |
Critical | High | Medium | Low |
no gate |
--triggers |
path to a trigger-definition YAML | the bundled T1–T8 (translation overlay not applied when set) |
--locale |
ja | en |
ja |
--out |
output file path | stdout |
The gate only considers newly added threats (existing unaddressed ones never fail it). Disposition changes to accepted/false-positive never fail the gate either — they are flagged as "needs approval" in the output instead.
Trigger list:
| ID | Trigger |
|---|---|
| T1 | New trust boundary |
| T2 | New external interface |
| T3 | New authentication / authorization mechanism |
| T4 | New technology or runtime |
| T5 | Sensitive data takes a new path |
| T6 | New third-party integration |
| T7 | Expanded agent capability |
| T8 | Change to the model, training data, or RAG source |
T4 cannot be auto-judged from the model diff (the diagram has no tech-stack information), so it is always reported as "confirm in PR review".
node dist-cli/main.js triggers [options]| Option | Values | Default |
|---|---|---|
--format |
md | json |
md |
--triggers |
path to a trigger-definition YAML | the bundled T1–T8 (translation overlay not applied when set) |
--locale |
ja | en |
ja |
--out |
output file path | stdout |
Outputs the T1–T8 trigger list above as a Markdown checklist (for a PR template or an AI
reviewer's checklist) or as JSON. For a ready-to-use GitHub Action (action.yml), example
workflow, CODEOWNERS and PR template, and the full setup guide, see
Integrating with AI-Driven Development CI in the user guide.
node dist-cli/main.js mcp starts an MCP server over stdio so coding agents (Claude Code, GitHub Copilot, etc.)
can query threats and update the diagram's structure. It makes no external calls and cannot change acceptances or risk assessments.
See Using It from Coding Agents.
Near-term priorities, in order:
- Structured audit report — the PDF report (one-page summary, top-10 details, per-layer appendix) has shipped; still to come is an HTML output fit to serve as audit evidence, with detection confidence stated explicitly
Done recently: an English UI with a language switcher, plus English translation overlays for all 266 threat rules and every component type label, all leaving the existing schemas unchanged.
Issues and pull requests are welcome. See CONTRIBUTING.md for the development workflow, the rules for adding threat rules, and how to help with translation.
Please report vulnerabilities privately through GitHub Security Advisories, not through public issues. Details are in SECURITY.md.
Two things to be aware of:
- Do not load untrusted YAML. Inline SVG icons in component libraries are not yet sanitized, so review any third-party library YAML before using it
- This tool is a design aid for threat modeling. It does not guarantee that its findings are complete or correct; use it alongside expert judgment, not instead of it
The threat library and compliance mappings are original work of this project. Attribution for the external sources they reference (OWASP, MITRE ATLAS, NIST, CISA, Anthropic, and others) is collected in NOTICE.