威胁建模 MCP 服务器

一个用于全面威胁建模的模型上下文协议（MCP）服务器，具备自动代码验证功能。

目录

• 概述
• 快速启动提示
• 主要特性
• 前提条件
• 安装
• 使用 Kiro CLI 运行
• 输出文件管理
• 快速参考
• 工具概述
• 威胁建模方法
• 威胁建模中的假设
• 开发
• 路线图

概述

该服务器提供威胁建模工具，包括业务上下文分析、架构分析、威胁行为者分析、信任边界分析、资产流分析、代码安全验证以及综合报告生成。

架构与方法

此 MCP 服务器调用现有代理的 LLM，而非对外部 API 或其他服务进行网络调用。它依赖于现有客户端的 LLM，可能是 Amazon-Q、Kiro 或 Cline。

此威胁建模 MCP 服务器具有三项主要功能：

1. 威胁建模阶段或状态管理及提示控制。
2. 提示引导，通过使用内置的业务风险、暴露面、威胁行为者定义，并按顺序使用 STRIDE，来控制代理遵循系统化的威胁建模方法。
3. 在每个状态或阶段进行数据验证，从而生成可操作的威胁模型报告。

它还具备生成最终报告的工具，支持 Markdown 和 JSON 可导出格式。

此方法的主要优势

• 此威胁模型采用阶段化的标准 STRIDE 威胁建模方法，而非快速得出资产、边界和威胁的结论，从而避免产生幻觉或低质量输出。
• LLM 会努力理解项目的业务上下文并做出合理假设，用户可对此进行控制。
• 使用此本地运行的威胁建模 MCP 服务器的主要优势在于，它利用了客户端现有的 LLM（Cline、Amazon-Q、Kiro）。所有处理或发送的数据仅限于客户端或您已安装并调用的其他 MCP 服务器。该服务器不会调用任何外部 API，也不会发送或接收超出客户端已有 LLM 调用的数据，或产生额外的计费或令牌消耗。
• 此威胁建模方法将威胁模型存储在同一仓库的 .threatmodel 目录中，您可以根据代码、设计和架构的演变来演进威胁模型。
• 此威胁建模方法会检查代码（如果存在），并更新已通过代码级控制缓解的威胁。一旦修复代码，您可以重新运行威胁模型，它会查看修复内容，从而快速更新威胁模型。

快速启动提示及如何使用此 MCP 服务器进行威胁建模的示例

注意： 在使用这些提示之前，您必须先完成安装过程来设置 MCP 服务器。

启动一个威胁模型```

"Threat model this project using the threat modeling MCP Server"

在提示中明确要求使用威胁建模MCP服务器将确保客户端（Cline/Kiro等）遵循准确的阶段和方法，而不是走捷径并引入结果幻觉。

### 对子项目进行威胁建模或将范围缩小到子文件夹```
"Threat model this subfolder using the threat modeling MCP Server"

在子文件夹上运行会将威胁模型和代码的范围限制在该子文件夹内，并将结果保存为该子文件夹下的.threatmodel目录。

保存威胁模型的结果```

"Save the threat model report"

### 验证威胁建模过程的完整性```
"Please complete all the phases in the threat model plan and then generate the final report."

将架构图图像作为输入```

"Threat model this project using the threat model MCP server and consider this architecture_image.png attached for this review"

### 尝试缓解威胁```
"Can you see if you can implement mitigation controls in the code based on the threats reported in the threat model"

基于代码修复重新生成威胁模型```

"Can you updated the threat model based on the code fixes which mitigated the reported threats"

### 更多示例```bash
# Set up context
"Set business context for an e-commerce payment system"

# Add architecture
"Add a web server component using AWS EC2"
"Add a database component using AWS RDS"

# Identify threats
"Add a threat where an attacker with network access performs SQL injection"

# Add mitigations
"Add a mitigation for input validation"

# Export results
"Export the threat model to my_model.json"

主要特点

• 全面的威胁建模：识别、评估和处理安全风险的结构化方法
• 自动代码验证：检测项目目录中的代码，并自动验证威胁模型与代码的一致性
• 业务上下文分析：理解系统的业务价值和关键性
• 架构分析：记录系统的技术架构和数据流
• 威胁行为者分析：识别潜在对手并评估其能力
• 信任边界分析：识别信任区域并验证边界处的安全控制
• 资产流分析：跟踪系统中的关键资产
• 威胁识别：使用STRIDE方法系统性地识别潜在威胁
• 缓解计划：制定应对已识别威胁的策略
• 假设管理：在威胁模型中添加、列出、更新和删除假设的工具
• 威胁生成器：在模型中添加和管理威胁的工具
• 缓解管理：管理缓解措施并将其与威胁关联的工具
• 威胁模型指南：逐步指导完成威胁建模过程
• 数据模型类型：探索可用数据模型类型和枚举的工具

前提条件

在安装威胁建模MCP服务器之前，请确保满足以下要求：

安装要求

1. 从 Astral 或 GitHub README 安装 uvx
   • uvx 是 uv 包管理器的一部分
   • 验证安装：uvx --version

安装

安装并验证 uvx 正常工作后，将以下配置添加到您的 mcp.json 配置文件中。根据您使用的客户端类型（kiro/cline/amazon-q），mcp.json 的位置会有所不同。添加配置并重启 IDE 后，威胁建模 MCP 服务器将自动通过 uvx 直接从本 GitHub 仓库安装。

注意： 此MCP服务器用于威胁建模的工具已添加到 autoApprove 中，以提升用户体验，实现无缝操作，无需对每个工具调用进行手动批准提示。所有工具均为服务器内部工具，不进行外部API调用。如果您希望每次调用时审查并批准每个工具，则需要将 autoApprove 数组替换为："autoApprove": []

配置

将以下内容添加到您的MCP客户端配置中：

对于 Amazon Q (~/.aws/amazonq/mcp.json):```json { "mcpServers": { "threat-modeling-mcp-server": { "command": "uvx", "args": [ "--from", "git+https://github.com/awslabs/threat-modeling-mcp-server.git", "threat-modeling-mcp-server" ], "env": { "FASTMCP_LOG_LEVEL": "ERROR" }, "disabled": false, "autoApprove": ["add_asset","add_assumption","add_component","add_component_to_zone","add_conn_to_crossing","add_connection","add_crossing_point","add_data_store","add_flow","add_mitigation","add_threat","add_threat_actor","add_trust_boundary","add_trust_zone","advance_phase","analyze_threat_actors","clear_architecture","clear_asset_flows","clear_business_context","clear_threat_actors","clear_trust_boundaries","delete_asset","delete_assumption","delete_component","delete_connection","delete_crossing_point","delete_data_store","delete_flow","delete_mitigation","delete_threat","delete_threat_actor","delete_trust_boundary","delete_trust_zone","execute_code_validation_step","execute_final_export_step","export_comprehensive_threat_model","export_threat_model_with_remediation_status","follow_threat_modeling_plan","generate_remediation_report","get_architecture_analysis_plan","get_asset","get_asset_flow_analysis_plan","get_assumption","get_business_context","get_business_context_analysis_plan","get_business_context_features","get_crossing_point","get_current_phase_status","get_data_model_types","get_flow","get_mitigation","get_phase_1_guidance","get_phase_2_guidance","get_phase_3_guidance","get_phase_4_guidance","get_phase_5_guidance","get_phase_6_guidance","get_phase_7_5_guidance","get_phase_7_guidance","get_phase_8_guidance","get_phase_9_guidance","get_threat","get_threat_actor","get_threat_model_progress","get_threat_modeling_plan","get_trust_boundary","get_trust_boundary_analysis_plan","get_trust_boundary_detection_plan","get_trust_zone","link_mitigation_to_threat","list_assets","list_assumptions","list_components","list_connections","list_crossing_points","list_data_models","list_data_stores","list_flows","list_mitigations","list_threat_actors","list_threats","list_trust_boundaries","list_trust_zones","remove_component_from_zone","remove_conn_from_crossing","reset_asset_flows","reset_threat_actors","set_business_context","set_threat_actor_priority","set_threat_actor_relevance","unlink_mitigation_from_threat","update_asset","update_assumption","update_component","update_connection","update_crossing_point","update_data_store","update_flow","update_mitigation","update_threat","update_threat_actor","update_trust_boundary","update_trust_zone","validate_business_context_completeness","validate_security_controls","validate_threat_model_against_code","validate_threat_remediation"] } } }

**对于 VSCode Cline**```json
{
  "mcpServers": {
    "threat-modeling-mcp-server": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/awslabs/threat-modeling-mcp-server.git",
        "threat-modeling-mcp-server"
      ],
      "env": {
        "FASTMCP_LOG_LEVEL": "ERROR"
      },
      "disabled": false,
      "autoApprove": ["add_asset","add_assumption","add_component","add_component_to_zone","add_conn_to_crossing","add_connection","add_crossing_point","add_data_store","add_flow","add_mitigation","add_threat","add_threat_actor","add_trust_boundary","add_trust_zone","advance_phase","analyze_threat_actors","clear_architecture","clear_asset_flows","clear_business_context","clear_threat_actors","clear_trust_boundaries","delete_asset","delete_assumption","delete_component","delete_connection","delete_crossing_point","delete_data_store","delete_flow","delete_mitigation","delete_threat","delete_threat_actor","delete_trust_boundary","delete_trust_zone","execute_code_validation_step","execute_final_export_step","export_comprehensive_threat_model","export_threat_model_with_remediation_status","follow_threat_modeling_plan","generate_remediation_report","get_architecture_analysis_plan","get_asset","get_asset_flow_analysis_plan","get_assumption","get_business_context","get_business_context_analysis_plan","get_business_context_features","get_crossing_point","get_current_phase_status","get_data_model_types","get_flow","get_mitigation","get_phase_1_guidance","get_phase_2_guidance","get_phase_3_guidance","get_phase_4_guidance","get_phase_5_guidance","get_phase_6_guidance","get_phase_7_5_guidance","get_phase_7_guidance","get_phase_8_guidance","get_phase_9_guidance","get_threat","get_threat_actor","get_threat_model_progress","get_threat_modeling_plan","get_trust_boundary","get_trust_boundary_analysis_plan","get_trust_boundary_detection_plan","get_trust_zone","link_mitigation_to_threat","list_assets","list_assumptions","list_components","list_connections","list_crossing_points","list_data_models","list_data_stores","list_flows","list_mitigations","list_threat_actors","list_threats","list_trust_boundaries","list_trust_zones","remove_component_from_zone","remove_conn_from_crossing","reset_asset_flows","reset_threat_actors","set_business_context","set_threat_actor_priority","set_threat_actor_relevance","unlink_mitigation_from_threat","update_asset","update_assumption","update_component","update_connection","update_crossing_point","update_data_store","update_flow","update_mitigation","update_threat","update_threat_actor","update_trust_boundary","update_trust_zone","validate_business_context_completeness","validate_security_controls","validate_threat_model_against_code","validate_threat_remediation"],
      "timeout": 60,
      "type": "stdio"
    }
  }
}

对于 Kiro (~/.kiro/settings/mcp.json):```json { "mcpServers": { "threat-modeling-mcp-server": { "command": "uvx", "args": [ "--from", "git+https://github.com/awslabs/threat-modeling-mcp-server.git", "threat-modeling-mcp-server" ], "env": { "FASTMCP_LOG_LEVEL": "ERROR" }, "disabled": false, "autoApprove": ["add_asset","add_assumption","add_component","add_component_to_zone","add_conn_to_crossing","add_connection","add_crossing_point","add_data_store","add_flow","add_mitigation","add_threat","add_threat_actor","add_trust_boundary","add_trust_zone","advance_phase","analyze_threat_actors","clear_architecture","clear_asset_flows","clear_business_context","clear_threat_actors","clear_trust_boundaries","delete_asset","delete_assumption","delete_component","delete_connection","delete_crossing_point","delete_data_store","delete_flow","delete_mitigation","delete_threat","delete_threat_actor","delete_trust_boundary","delete_trust_zone","execute_code_validation_step","execute_final_export_step","export_comprehensive_threat_model","export_threat_model_with_remediation_status","follow_threat_modeling_plan","generate_remediation_report","get_architecture_analysis_plan","get_asset","get_asset_flow_analysis_plan","get_assumption","get_business_context","get_business_context_analysis_plan","get_business_context_features","get_crossing_point","get_current_phase_status","get_data_model_types","get_flow","get_mitigation","get_phase_1_guidance","get_phase_2_guidance","get_phase_3_guidance","get_phase_4_guidance","get_phase_5_guidance","get_phase_6_guidance","get_phase_7_5_guidance","get_phase_7_guidance","get_phase_8_guidance","get_phase_9_guidance","get_threat","get_threat_actor","get_threat_model_progress","get_threat_modeling_plan","get_trust_boundary","get_trust_boundary_analysis_plan","get_trust_boundary_detection_plan","get_trust_zone","link_mitigation_to_threat","list_assets","list_assumptions","list_components","list_connections","list_crossing_points","list_data_models","list_data_stores","list_flows","list_mitigations","list_threat_actors","list_threats","list_trust_boundaries","list_trust_zones","remove_component_from_zone","remove_conn_from_crossing","reset_asset_flows","reset_threat_actors","set_business_context","set_threat_actor_priority","set_threat_actor_relevance","unlink_mitigation_from_threat","update_asset","update_assumption","update_component","update_connection","update_crossing_point","update_data_store","update_flow","update_mitigation","update_threat","update_threat_actor","update_trust_boundary","update_trust_zone","validate_business_context_completeness","validate_security_controls","validate_threat_model_against_code","validate_threat_remediation"] } } }

### 使用 Kiro CLI 运行

要通过 `kiro-cli` 运行 MCP 服务器，并自动批准所有工具：```bash
kiro-cli chat --trust-tools="@threat-modeling-mcp-server/*"

这会信任来自 threat-modeling-mcp-server MCP 服务器的所有工具，因此您无需单独批准每个工具调用。

使用自定义 Kiro CLI 代理运行

此仓库包含一个预配置的 Kiro CLI 代理，可提供引导式的 9 阶段威胁建模体验。代理配置文件位于 .kiro/agents/threat-modeler.json。

全局安装（可从任何目录使用）：```bash ./install-kiro-agent.sh

卸载: `./install-kiro-agent.sh --remove`

**本地安装**（项目特定）:```bash
cp -r /path/to/threat-modeling-mcp-server/.kiro /path/to/your-project/.kiro

使用方法：```bash

Non-interactive: run full threat model and exit

kiro-cli chat --agent threat-modeler --no-interactive "Threat model this project"

Interactive: start a session with the agent

kiro-cli chat --agent threat-modeler

**Agent 包含的内容**：
- **系统提示词**（`.kiro/prompts/threat-modeler.md`）：针对 9 阶段 STRIDE 方法论的详细指导
- **技能文件**（`.kiro/skills/`）：关于 9 个威胁建模阶段的每个阶段的参考资料
- **自动批准的 MCP 工具**：所有威胁建模工具无需手动批准提示即可运行

## 输出文件管理

威胁建模服务器生成的所有输出文件会自动保存到项目根目录下的 `.threatmodel` 目录中。包括：

- 导出的威胁模型（JSON 格式）
- 验证报告
- 分析结果

`.threatmodel` 目录会在需要时自动创建。

## 快速参考

### 入门必备工具

| 工具 | 用途 | 示例 |
|------|------|------|
| `get_threat_modeling_plan()` | 获取全面计划 | 从这开始概览 |
| **`get_phase_1_guidance()`** | **获取集中的阶段 1 指导** | **推荐起点** |
| `get_current_phase_status()` | 检查进度 | 跟踪完成状态 |
| `set_business_context(desc)` | 定义系统上下文 | “电子商务支付系统” |
| `add_component(name, type)` | 添加架构组件 | “API 网关”、“网络” |
| `add_threat(source, prereq, action, impact)` | 识别威胁 | “攻击者”、“网络访问”、“SQL 注入”、“数据泄露” |
| `add_mitigation(content)` | 添加安全控制 | “输入验证和参数化查询” |
| `link_mitigation_to_threat(m_id, t_id)` | 将控制与威胁关联 | 将缓解措施连接到特定威胁 |
| **`execute_code_validation_step()`** | **自动执行阶段 7.5** | **确保代码验证完成** |
| **`execute_final_export_step()`** | **自动执行阶段 9** | **生成所有必需文件** |

### 🚀 分步指导

**推荐方法**：使用阶段特定的指导工具，而非全面计划：

| 阶段 | 工具 | 用途 |
|------|------|------|
| 1 | `get_phase_1_guidance()` | 业务上下文分析 |
| 2 | `get_phase_2_guidance()` | 架构分析 |
| 3 | `get_phase_3_guidance()` | 威胁行为者分析 |
| 4 | `get_phase_4_guidance()` | 信任边界分析 |
| 5 | `get_phase_5_guidance()` | 资产流分析 |
| 6 | `get_phase_6_guidance()` | 威胁识别 |
| 7 | `get_phase_7_guidance()` | 缓解计划 |
| 7.5 | `execute_code_validation_step()` | 代码验证（自动） |
| 8 | `get_phase_8_guidance()` | 残余风险分析 |
| 9 | `execute_final_export_step()` | 最终导出（自动） |

## 工具概览

威胁建模 MCP 服务器提供了 **100 多个工具**，分为以下几类：

| 类别 | 工具数 | 描述 |
|------|------|------|
| **威胁建模计划** | 1 个工具 | 生成全面的威胁建模计划 |
| **假设管理** | 5 个工具 | 添加、列出、获取、更新和删除假设 |
| **业务上下文分析** | 13 个工具 | 分析业务上下文和需求 |
| **架构分析** | 13 个工具 | 记录和分析系统架构 |
| **威胁行为者分析** | 10 个工具 | 识别和分析潜在威胁行为者 |
| **信任边界分析** | 18 个工具 | 分析信任区域、边界和交叉点 |
| **信任边界检测** | 1 个工具 | 基于 AI 的信任边界检测 |
| **资产流分析** | 12 个工具 | 跟踪和分析系统中的资产流 |
| **威胁生成** | 4 个工具 | 添加、列出、获取和删除威胁 |
| **缓解措施管理** | 7 个工具 | 管理缓解措施并将其链接到威胁 |
| **威胁模型指南** | 3 个工具 | 逐步指导整个过程 |
| **数据模型类型** | 2 个工具 | 探索可用的数据模型类型 |
| **代码安全验证** | 3 个工具 | 验证代码中的安全控制 |
| **威胁模型验证** | 2 个工具 | 验证威胁模型与代码的一致性 |
| **步骤协调器** | 12 个工具 | 阶段特定的指导和步骤执行 |

## 威胁建模方法论

### STRIDE 框架

服务器使用 STRIDE 方法论进行系统化的威胁识别：

| 类别 | 描述 | 示例威胁 |
|------|------|----------|
| **欺骗** | 冒充某人或某物 | 认证绕过、身份盗窃 |
| **篡改** | 修改数据或代码 | 数据损坏、代码注入 |
| **抵赖** | 声称未执行某个操作 | 日志篡改、抵赖失败 |
| **信息披露** | 向未授权用户暴露信息 | 数据泄露、隐私泄露 |
| **拒绝服务** | 拒绝或降低服务 | 资源耗尽、可用性攻击 |
| **权限提升** | 未经授权获取能力 | 权限提升、未授权访问 |

### 威胁建模过程

全面的威胁建模过程包括以下阶段：

1. **业务上下文分析**：理解系统的业务价值和关键性
2. **架构分析**：记录系统的技术架构
3. **威胁行为者分析**：识别潜在对手及其能力
4. **信任边界分析**：识别信任区域和边界交叉点
5. **资产流分析**：跟踪关键资产在系统中的流动
6. **威胁识别**：使用 STRIDE 系统化地识别潜在威胁
7. **缓解计划**：制定应对已识别威胁的策略
8. **代码验证**：验证威胁与现有安全控制的一致性
9. **残余风险分析**：评估缓解后的剩余风险

每个阶段都包括特定的目标、活动和输出，以指导威胁建模过程。

### 威胁严重级别

- **严重**：需要立即采取行动，系统可能被攻陷
- **高**：重大风险，应尽快处理
- **中**：中等风险，在正常开发周期中处理
- **低**：低风险，方便时处理
- **信息**：信息性发现，无需立即采取行动

### 缓解措施类型

- **预防性**：防止威胁发生的控制
- **检测性**：检测威胁发生的控制
- **纠正性**：响应并纠正威胁的控制
- **补偿性**：当主要控制不可行时的替代控制

## 威胁建模中的假设

假设是我们接受为真而无需进一步验证的陈述。它们通过建立边界和约束来帮助限定威胁模型的范围。常见示例包括：

- “VPC 中的所有网络连接都已传输加密”
- “AWS KMS 密钥无法通过暴力破解发现”
- “国家级威胁行为者对此系统不构成威胁”

通过记录假设，我们可以：
- 防止产生无意义的威胁
- 避免推荐不必要的缓解措施
- 聚焦于相关的安全关注点
- 明确记录威胁模型的范围和局限性

## 开发

### 贡献

若要为此项目做贡献：

1. 克隆仓库
2. 使用 `uv pip install -e .` 安装开发依赖
3. 使用 `python run_server.py` 在本地运行服务器
4. 使用 `python -m pytest` 运行测试

## 安全

请参阅 [CONTRIBUTING](https://github.com/awslabs/threat-modeling-mcp-server/blob/HEAD/CONTRIBUTING.md#security-issue-notifications) 了解更多信息。

## 许可证

本项目使用 Apache-2.0 许可证。详细信息请参阅 [LICENSE](https://github.com/awslabs/threat-modeling-mcp-server/blob/HEAD/LICENSE) 文件。