awslabs/threat-modeling-mcp-server

phase-1-business-context

Phase 1 Business Context Analysis guide. Use when starting a threat model, setting business context, or configuring business features like industry sector, data sensitivity, and regulatory requirements.

phase-2-architecture

Phase 2 Architecture Analysis guide. Use when documenting system components, connections, data stores, or analyzing technical architecture for threat modeling.

phase-3-threat-actors

Phase 3 Threat Actor Analysis guide. Use when identifying threat actors, setting relevance and priority, or analyzing who might attack the system.

phase-4-trust-boundaries

Phase 4 Trust Boundary Analysis guide. Use when defining trust zones, crossing points, and security boundaries between architecture nodes.

phase-5-asset-flows

Phase 5 Asset Flow Analysis guide. Use when identifying valuable assets, tracking data flows, or analyzing how sensitive data moves through the system.

phase-6-threat-identification

Phase 6 Threat Identification guide with STRIDE methodology reference. Use when identifying threats, categorizing security issues, applying STRIDE analysis, or assessing threat severity and likelihood.

phase-7-5-code-validation

Phase 7.5 Code Validation guide. Use when validating threats and mitigations against actual code or reviewing implementation evidence.

phase-7-mitigation-planning

Phase 7 Mitigation Planning guide. Use when creating mitigations, linking them to threats, validating coverage, or planning security controls.

phase-8-residual-risk

Phase 8 Residual Risk Analysis guide. Use when assessing remaining risk after mitigations and recording explicit risk decisions.

phase-9-output-generation

Phase 9 Output Generation guide with Threat Composer export reference. Use when generating final reports, exporting to JSON/Markdown, or completing the threat modeling process.