Josemlopez Threat Modeling Toolkit
- 8 repo stars
- Updated January 22, 2026
- josemlopez/threat-modeling-toolkit
josemlopez-threat-modeling-toolkit is a Claude Code plugin that runs AI-assisted STRIDE/PASTA threat modeling, compliance mapping, and security verification.
About
josemlopez-threat-modeling-toolkit is a Claude Code security plugin that helps developers and small teams treat threat modeling as a repeatable practice instead of a one-off diagram. The toolkit emphasizes STRIDE and PASTA frameworks, architecture-aware threat discovery, risk analysis, and generating reports you can attach to launch prep or compliance conversations. It also speaks the language of controls, verification, and mapping findings to compliance expectations—useful when you are shipping SaaS, APIs, or internal tools without a dedicated AppSec function. Place it primarily in Ship under security review, but invoke it during Validate when scoping integrations and during Build when backend boundaries are still movable. Expect intermediate complexity: you need enough system context to describe components, trust boundaries, and data flows honestly. One plugin in the repo keeps the surface area focused compared with sprawling security marketplaces.
- AI-powered threat modeling toolkit with STRIDE and PASTA framework support.
- Architecture-oriented threat discovery and risk analysis workflows.
- OWASP-aligned analysis patterns and security verification steps.
- Compliance mapping and control-oriented reporting for solo audits.
- Single-plugin bundle focused on comprehensive security modeling—not generic linting.
Josemlopez Threat Modeling Toolkit by the numbers
- Data as of Jul 20, 2026 (Skillselion catalog sync)
/plugin install josemlopez-threat-modeling-toolkit@josemlopez/threat-modeling-toolkitAdd your badge
Show developers this plugin is listed on Skillselion. Paste this into your README.
| repo stars | ★ 8 |
|---|---|
| Last updated | January 22, 2026 |
| Repository | josemlopez/threat-modeling-toolkit ↗ |
What it does
Run AI-assisted STRIDE and PASTA threat modeling, map controls to compliance, and verify security claims before you ship sensitive features.
Who is it for?
Best when you're shipping web apps, APIs, or multi-service prototypes and need documented threat models without hiring a full-time security engineer.
Skip if: Skip if you only need dependency scanning or secret linting with no architecture to model, or regulated environments that require human-certified pen tests only.
What you get
After install, Claude Code can analyze your architecture, enumerate threats with STRIDE/PASTA, map controls to compliance needs, and produce verification-oriented security reports before release.
- STRIDE/PASTA-oriented threat inventory and risk analysis
- Compliance-oriented control mapping and security verification notes
Recommended Plugins
1mangesh1 Hipaa GuardianAI agent skill for HIPAA compliance - PHI/PII detection, code scanning, audit reports, and remediation guidance6
Abossenbroek Abossenbroek Claude PluginsCustom Claude Code plugins by abossenbroek2
Agentsecops SecopsagentkitSecurity operations toolkit for AI coding agents.181
Agent Sh EnhancePlugin structure and tool use analyzer - validates plugin.json, MCP tools, and security patterns3
Altic Dev EnvaultLet agents safely manage env variables6
Auth0 Agent SkillsAuth0 Agent Skills40How it compares
Dedicated threat-modeling agent toolkit, not a generic code linter or secrets MCP.
FAQ
Who is Josemlopez Threat Modeling Toolkit for?
Claude Code users shipping software who want STRIDE/PASTA-guided threat analysis and compliance-oriented reporting without a large security team.
When should I use Josemlopez Threat Modeling Toolkit?
Use it when architecture or scope is stable enough to describe trust boundaries—especially during security review before launch or after major backend changes.
How do I add Josemlopez Threat Modeling Toolkit to my agent?
Register the josemlopez/threat-modeling-toolkit repository as a Claude Code plugin, enable the toolkit plugin, then invoke it with your system diagram and data-flow description in session.