agent-threat-model: threat modeling for AI agents

Threat modeling for AI agents and LLM applications, for security architects and the engineers who own an agent: describe the system in YAML and get a STRIDE and OWASP Agentic threat model with a ranked threat register, a Mermaid diagram, a control checklist, a residual risk score and SARIF for GitHub code scanning. Deterministic, offline, no model in the loop, so the same input always gives the same report and it runs in CI.

Demo

Generated from the committed fixtures by scripts/render_demo.py; run python3 scripts/render_demo.py to regenerate it.

Why

Agent systems fail in predictable ways: an email the agent reads tells it to forward the customer database, a shell tool runs without a sandbox, a payment tool needs no approval, a static API key sits in the prompt. Security reviews keep rediscovering the same twenty-odd threats by hand. This tool encodes them once, as rules over the architecture you declare, and tells you which ones apply to your system, how bad they are, and which control removes the most risk for the least effort.

What it is not: a scanner of code or prompts, and not a judgement about your implementation. It reasons only about what you declare. Treat the output as the starting checklist for a review, and keep the YAML next to the code so the model is diffed with every change.

When to use this

• How do I threat-model an LLM agent or an MCP integration before it ships? Write the YAML once and run atm analyse in the pull request.
• Which OWASP Agentic Top 10 and MITRE ATLAS entries apply to my agent architecture? Every applicable threat in the report carries its OWASP LLM, OWASP Agentic and ATLAS ids.
• How do I get agent threat findings into GitHub code scanning? --format sarif plus the GitHub Action uploads them as alerts.
• Which control reduces the most risk for my agent? The report ranks missing controls by the number of applicable threats they mitigate.
• How do I show that a design change (brokered credentials, approval gates) lowered the risk? atm diff old.yaml new.yaml prints the threats removed and the score change.

30-second demo

pipx install git+https://github.com/basitalisandhu/agent-threat-model   # see "Install" below
atm init system.yaml                 # writes the support-bot example
atm analyse system.yaml

Output for examples/support-bot.yaml, a retrieval-backed support chatbot that reads inbound email and can send email (excerpt, as atm analyse system.yaml --plain prints it; without --plain the same table is drawn with borders, and with colours in a terminal):

Threat model: Customer support assistant

#   Threat                                 STRIDE                  OWASP LLM            Inherent  Residual    Affected
--  -------------------------------------  ----------------------  -------------------  --------  ----------  ---------------------------------------------------------
1   excessive-agency                       Elevation of privilege  LLM06                16 High   16 High     create-ticket, support-bot
2   indirect-prompt-injection              Tampering               LLM01                16 High   16 High     inbound-email, support-bot, web-chat
3   credential-exfiltration-via-tool-args  Information disclosure  LLM02, LLM01         15 High   15 High     create-ticket, lookup-customer, send-email, support-bot
4   data-exfiltration-via-messaging        Information disclosure  LLM02, LLM01         15 High   15 High     crm, inbound-email, lookup-customer, send-email ...
5   denial-of-wallet                       Denial of service       LLM10                12 High   12 High     support-bot
6   destructive-write-actions              Tampering               LLM06, LLM01         12 High   12 High     create-ticket, inbound-email, support-bot, web-chat
...
21  insecure-output-handling               Tampering               LLM05                9 Medium  6.6 Medium  create-ticket, support-bot

21 of the catalogue threats apply to 'Customer support assistant' (0 critical, 14 high, 7 medium, 0 low after mitigations). Residual risk score 99/100 (Critical). The 1 control(s) in place reduce modelled risk by 1% compared with the same system with no controls.

Highest-leverage missing controls:
  - approval-gates: Human approval for high-impact actions (mitigates 9 applicable threat(s))
  - audit-log: Tamper-evident audit log of every tool call (mitigates 9 applicable threat(s))
  - least-privilege-tool-scopes: Least-privilege scopes on every tool (mitigates 8 applicable threat(s))
  - adversarial-testing: Adversarial testing before and after release (mitigates 4 applicable threat(s))
  - brokered-credentials: Short-lived, scoped, brokered credentials (mitigates 4 applicable threat(s))

Then write the full report:

atm analyse system.yaml --format markdown -o threat-model.md   # also: json, sarif, html, csv

The same accounts-payable agent with and without governance controls (brokered credentials, approvals enforced outside the model, audit log, kill switch, budget caps); the example files live in examples/, so run this from a clone:

This is the beginning of the README. Read the rest at the original. Read the full README ↗