// Phase 2 Architecture Analysis guide. Use when documenting system components, connections, data stores, or analyzing technical architecture for threat modeling.
Phase 1 Business Context Analysis guide. Use when starting a threat model, setting business context, or configuring business features like industry sector, data sensitivity, and regulatory requirements.
Phase 3 Threat Actor Analysis guide. Use when identifying threat actors, setting relevance and priority, or analyzing who might attack the system.
Phase 4 Trust Boundary Analysis guide. Use when defining trust zones, crossing points, and security boundaries between system components.
Phase 5 Asset Flow Analysis guide. Use when identifying valuable assets, tracking data flows, or analyzing how sensitive data moves through the system.
Phase 6 Threat Identification guide with STRIDE methodology reference. Use when identifying threats, categorizing security issues, applying STRIDE analysis, or assessing threat severity and likelihood.
Phase 7.5 Code Validation guide. Use when validating threats against actual code, checking which security controls are implemented, or generating remediation reports.
| name | phase-2-architecture |
| description | Phase 2 Architecture Analysis guide. Use when documenting system components, connections, data stores, or analyzing technical architecture for threat modeling. |
Document every component, connection, and data store in the system. This becomes the attack surface map for later phases.
| Parameter | Required | Values |
|---|---|---|
| name | Yes | e.g., "API Gateway", "User Database" |
| type | Yes | Compute, Storage, Network, Security, Database, Messaging, Analytics, Container, Serverless, Other |
| service_provider | No | AWS, Azure, GCP, CNCF, On-Premise, Hybrid, Other |
| specific_service | No | e.g., "Lambda", "RDS", "API Gateway", "EC2" |
| version | No | e.g., "Python 3.9", "PostgreSQL 13" |
| description | No | What this component does |
| configuration | No | Dict of config details |
| Parameter | Required | Values |
|---|---|---|
| source_id | Yes | Component ID (from add_component response) |
| destination_id | Yes | Component ID |
| protocol | No | HTTP, HTTPS, TCP, UDP, SSH, FTP, SMTP, WebSocket, gRPC, MQTT, Other |
| port | No | Integer port number |
| encryption | No | true/false |
| description | No | What flows over this connection |
| Parameter | Required | Values |
|---|---|---|
| name | Yes | e.g., "Customer PII Store" |
| type | Yes | Relational, NoSQL, Object Storage, File System, Cache, Data Warehouse, Graph, Time Series, Ledger, Other |
| classification | Yes | Public, Internal, Confidential, Restricted, Regulated |
| encryption_at_rest | No | true/false |
| backup_frequency | No | Hourly, Daily, Weekly, Monthly, Continuous, None |
| description | No | What data is stored |
list_components() -- Review all componentslist_connections() -- Review all connectionslist_data_stores() -- Review all data storesget_architecture_analysis_plan() -- AI-powered analysis guidanceclear_architecture() -- Start over if neededget_phase_2_guidance() for detailed instructionssearch_documentation() to validate service security configs| Code Pattern | Component Type |
|---|---|
| Dockerfile, ECS/EKS config | Container |
| Lambda handler, serverless.yml | Serverless |
| Database connection strings, ORM config | Database |
| S3 client, blob storage | Storage |
| API routes, REST/gRPC endpoints | Compute/Network |
| Queue/topic publishers/subscribers | Messaging |
| Redis/Memcached clients | Cache (Data Store) |
list_components() shows comprehensive inventoryadvance_phase() to proceed to Phase 3