[opensourcedex]

stride-gpt is a free, open source ai security & privacy project written in Python and released under MIT. It has 1,124 GitHub stars, 326 forks and 12 open issues, and was last pushed 3 days ago. On this registry it ranks #22 of 34 tracked projects in AI Security & Privacy, with 5 head-to-head comparisons available. It gained 1 stars over the last 3 tracked days.

What is stride-gpt?

STRIDE GPT is an MIT-licensed Python threat modeling tool that uses large language models — OpenAI GPT, Anthropic Claude, Google Gemini and Mistral — to generate STRIDE threat models, attack trees, mitigations and Gherkin test cases from a description of an application, aimed at security engineers, AppSec teams and developers who need a structured threat model during design review rather than weeks after a manual workshop.

What it is

STRIDE GPT is a threat modeling tool that lives in the Python and generative-AI security ecosystem, distributed under the MIT licence with 1,123 stars, 326 forks and 12 open issues. It takes application details that a user supplies — application type, authentication methods, whether the application is internet-facing, whether it processes sensitive data — and produces a threat model based on the STRIDE methodology, along with attack trees, suggested mitigations and optional DREAD risk scoring. It runs either as a hosted Streamlit web application, or as a full-featured terminal experience with a CLI and an interactive REPL that offers tab completion, history and real-time progress without a browser.

The concrete thing it replaces is the manual threat modeling exercise: the workshop, the whiteboard, the spreadsheet of threats, and the separate step of turning all of that into a written artefact. STRIDE GPT folds those steps into one pass and emits the result in formats that downstream tooling already consumes — Markdown, JSON, SARIF and a self-contained HTML view. It also reaches further than a text prompt does, by accepting architecture diagrams and flowcharts as inputs across vision-capable models, by parsing draw.io diagrams as XML to extract components, connections and trust boundaries, and by running an agentic analysis over a codebase so that findings are synthesized across subsystems instead of guessed from a description.

Key capabilities

  • Agentic codebase analysis: pointing the CLI at a codebase produces an autonomous, deep STRIDE threat model in which the agent plans, explores and synthesizes findings across subsystems.
  • MITRE ATT&CK and ATLAS mapping: threats are annotated with standardized adversary technique IDs, surfaced as columns in Markdown, linked pills in HTML, and a mitre_attack property in SARIF.
  • Architectural pattern detection: automatically identifies RAG pipelines, multi-agent systems, code execution environments and tool ecosystems from application descriptions, inspired by CSA MAESTRO.
  • Embedded draw.io diagram editor using diagrams.net, with the hosted embed.diagrams.net loaded by default and STRIDE_GPT_DRAWIO_URL pointing self-hosted or air-gapped deployments at their own instance.
  • Data Flow Diagrams generated from an application description or parsed from an uploaded image, with editable Mermaid source that can be fed back into the Threat Model and Attack Tree prompts as the authoritative system model.
  • Domain-specific coverage through OWASP Top 10 for Agentic Applications (ASI) integration for agentic AI systems and OWASP LLM Top 10 integration for generative AI applications.
  • GitHub repository analysis, including GitHub Enterprise support, plus advanced reasoning model support for OpenAI GPT-5.4/5.5, Anthropic Claude 4.6/4.8 with Extended Thinking, Google Gemini 3 and Mistral Magistral.

Who uses it and how

  • AppSec and product security teams that need a first-draft threat model attached to a design review, then a Markdown or HTML artefact for stakeholders.
  • Builders of agentic and generative AI systems, who use the ASI and OWASP LLM Top 10 integrations rather than adapting a generic model to LLM-specific risks.
  • Enterprises that point the tool at GitHub or GitHub Enterprise repositories so the agentic analysis runs against real code rather than a prose summary.
  • Regulated or air-gapped environments, where the draw.io editor is redirected to an internal diagrams.net instance through STRIDE_GPT_DRAWIO_URL.
  • DevOps and security-engineering workflows that import SARIF output into GitHub, GitLab, Azure DevOps or an IDE, instead of tracking threats in a standalone document.

Getting started

The fastest path is the hosted Streamlit application at https://stridegpt.streamlit.app, which needs only application details to produce a model. For the CLI, interactive REPL or self-hosted deployment, follow the Installation section of the repository.

How it compares

The only comparable reference named in this entry is the CSA MAESTRO agentic AI threat modeling framework, cited as the inspiration for the tool's architectural pattern detection; STRIDE GPT takes that framing and builds it into a generator that produces threat models, attack trees and diagrams rather than leaving it as a framework to apply by hand. No direct peer tool is named in the facts, so within this registry it stands alone in the AI-assisted threat modeling slot.

When to use it — and when not to

A self-hoster must operate the Python application and, for air-gapped use, a separate diagrams.net instance, and must supply API credentials for whichever LLM providers are approved, since generation depends on external model access and the hosted Streamlit app sends application details to those providers. Output is model-generated and should be reviewed by a human threat modeler before it is treated as a finding, so teams with no reviewer or no approved LLM provider should not adopt it, and anyone working with architecture descriptions they cannot send to a third-party model should use the self-hosted CLI path instead.

project readme (upstream, from github) — read inline

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models (LLMs) to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the application is internet-facing or processes sensitive data. The model then generates its output based on the provided information.

Table of Contents

Support the Project

If you find STRIDE GPT useful, please consider supporting the project:

  • ⭐ Star the repository on GitHub to help more people discover the tool
  • ☕ Buy me a coffee to support continued development and maintenance
Buy Me A Coffee

Features

  • Agentic codebase analysis: Point the CLI at a codebase and get an autonomous, deep STRIDE threat model — the agent plans, explores, and synthesizes findings across subsystems
  • CLI and interactive REPL: Full-featured terminal experience with tab completion, history, and real-time progress — no browser required
  • Simple and user-friendly Streamlit web interface
  • Generates threat models based on the STRIDE methodology
  • Agentic AI support: Specialized threat modeling for agentic AI systems with OWASP Top 10 for Agentic Applications (ASI) integration
  • Generative AI support: Threat modeling for GenAI applications with OWASP LLM Top 10 integration
  • MITRE ATT&CK & ATLAS mapping: Threats are annotated with standardized adversary technique IDs (MITRE ATT&CK Enterprise for traditional infrastructure attacks, ATLAS for ML/LLM-specific attacks) — surfaced as columns in markdown, linked pills in HTML, and mitre_attack properties in SARIF
  • Architectural pattern detection: Automatically detects RAG pipelines, multi-agent systems, code execution environments, tool ecosystems, and more from application descriptions (inspired by CSA MAESTRO)
  • Embedded draw.io diagram editor: Create and edit architecture diagrams directly in STRIDE-GPT using the integrated diagrams.net editor — no external tool needed. Diagrams are parsed as XML to extract components, connections, and trust boundaries, providing significantly richer context for threat model generation than image analysis alone. The existing image upload workflow is unchanged. By default the editor loads from the hosted embed.diagrams.net; for self-hosted or air-gapped deployments, point it at your own draw.io via the STRIDE_GPT_DRAWIO_URL environment variable
  • Multi-modal: Use architecture diagrams, flowcharts, etc. as inputs for threat modelling across all supported vision-capable models
  • Data Flow Diagrams: Generate DFDs from your application description (or parse an uploaded DFD image), edit the Mermaid source live, and feed the confirmed diagram back into the Threat Model and Attack Tree prompts as the authoritative system model. CLI /analyze also emits a system-level DFD alongside its findings
  • Generates attack trees to enumerate possible attack paths
  • Suggests possible mitigations for identified threats
  • Supports DREAD risk scoring for identified threats
  • Generates Gherkin test cases based on identified threats
  • GitHub repository analysis for comprehensive threat modelling (including GitHub Enterprise support)
  • Multiple output formats: Markdown, JSON, SARIF (imports into GitHub, GitLab, Azure DevOps, IDEs), and a self-contained HTML view for sharing with stakeholders
  • Advanced reasoning model support (OpenAI GPT-5.4/5.5 series, Anthropic Claude 4.6/4.8 with Extended Thinking, Google Gemini 3, Mistral Magistral series)
  • Comprehensive LLM provider support via LiteLLM: OpenAI, Anthropic, Google AI, Mistral, Groq, DeepSeek, plus local hosting via LM Studio Server
  • No data storage; application details are not saved
  • Available as a Docker container image for easy deployment
  • Environment variable support for secure configuration

Enterprise Deployment

Want to customize STRIDE-GPT for your organization? Check out our comprehensive Operationalization Guide to learn how to:

  • 🎯 Inject organizational security controls and standards
  • 📋 Customize threat models with your compliance requirements
  • 🔧 Fork and deploy STRIDE-GPT internally
  • 📊 Get context-aware, actionable threat models specific to your environment

The guide includes step-by-step instructions, code examples, and deployment patterns for organizations looking to scale AI-powered threat modeling across their teams.

Talk at Open Security Summit

In January 2024 I gave a talk about STRIDE GPT at the Open Security Summit. During the talk, I discussed the project's inception, its core functionalities, recent updates, and some future plans. You can watch the full presentation below:

Open Security Summit Talk

This video is an excellent resource for anyone interested in understanding how STRIDE GPT works and how it can be used to improve threat modelling.

Changelog

Version 0.19 (latest)

  • --version flag (#161): stride-gpt --version now prints the installed version and exits, and the interactive TUI banner shows the running version so you can confirm what you're on at a glance.
  • Dependency management consolidated onto uv (closes #155): uv.lock is now the single source of truth for every dependency. The duplicated requirements.txt files are retired; the Docker UI image and the security-scan workflow install from uv.lock via uv export, so what ships and what gets scanned can no longer drift from what's locked. No change for pip install stride-gpt users.
  • Documentation: Added a sample threat-model markdown output (#151) and an interactive REPL cheat sheet (#163) to the README.

Version 0.18

  • Embedded draw.io diagram editor (#132, #138): The Streamlit Threat Model tab now embeds the diagrams.net editor so you can sketch an architecture diagram in-app; on save the diagram XML is parsed (components, connections, trust boundaries) and folded into the threat-model prompt. GitHub analysis, image upload, the diagram editor, and an AI-assisted guided builder are unified into one tabbed "describe your application" section over a single description canvas, so the optional inputs no longer crowd out the primary description field. The guided builder now calls the selected model to draft a description and suggest missing security-relevant details, replacing the previous static template and coverage checks. For self-hosted or air-gapped deployments the editor host is configurable via STRIDE_GPT_DRAWIO_URL (defaults to embed.diagrams.net), the iframe postMessage origin is scoped to it, and untrusted diagram XML is parsed with defusedxml.
  • DeepSeek provider support (closes #133): DeepSeek is now a first-class model provider in both the CLI setup wizard and the Streamlit UI, offering deepseek-v4-pro and deepseek-v4-flash. Calls route through LiteLLM's native deepseek/ integration (hosted endpoint, no custom base URL needed); set your key via DEEPSEEK_API_KEY.
  • Data Flow Diagram support (closes #56): New "Data Flow Diagram" tab in the Streamlit UI generates DFDs from the application description, parses uploaded DFD images via vision-capable models, and renders an editable Mermaid source pane with a live preview. Ticking "Use this DFD for the threat model" stores the confirmed diagram in session state and splices it into subsequent Threat Model and Attack Tree prompts as the authoritative system model — closing the description → DFD → review → refined threat model loop the issue asks for. The CLI's /analyze agent also produces a system-level DFD after synthesis, rendered as a Mermaid block in the markdown report, carried in the JSON data_flow_diagram field, and shown in the HTML view via a CDN-loaded Mermaid runtim

readme truncated — read the full docs on github

Frequently asked questions

Is stride-gpt free to use?

stride-gpt is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does stride-gpt do?

An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.

What is stride-gpt written in?

stride-gpt is primarily written in Python. Its source is publicly available at https://github.com/mrwadams/stride-gpt, and it has 1,124 GitHub stars.