<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# STRIDE Threat Modeling — API Reference

## pytm CLI

```bash
# Generate data flow diagram
python3 tm.py --dfd | dot -Tpng -o dfd.png

# Generate sequence diagram
python3 tm.py --seq | dot -Tpng -o seq.png

# Generate threat report
python3 tm.py --report threats.html

# List all identified threats
python3 tm.py --describe
```

## OWASP Threat Dragon CLI

```bash
# Install Threat Dragon
npm install -g owasp-threat-dragon

# Open model
threat-dragon open --model model.json

# Export diagram
threat-dragon export --model model.json --format png --output dfd.png
```

## agent.js CLI

```bash
# Enumerate threats from DFD elements
node scripts/agent.js --action enumerate --elements elements.json

# Score threats with DREAD
node scripts/agent.js --action score --threats threats.json

# Generate full report
node scripts/agent.js --action report --threats threats.json --output report.json
```

## STRIDE Category Reference

| Code | Category | Security Property | Controls |
|------|----------|-------------------|----------|
| S | Spoofing | Authentication | MFA, certificates, tokens |
| T | Tampering | Integrity | Signatures, HMAC, checksums |
| R | Repudiation | Non-repudiation | Audit logs, timestamps |
| I | Information Disclosure | Confidentiality | Encryption, ACLs |
| D | Denial of Service | Availability | Rate limits, redundancy |
| E | Elevation of Privilege | Authorization | RBAC, least privilege |

## DFD Element JSON Schema

```json
{
  "name": "Component Name",
  "type": "process | data_store | data_flow | external_entity",
  "crosses_boundary": true,
  "boundary": "DMZ | Internal | Database",
  "properties": {
    "authenticatesSource": true,
    "isEncrypted": true,
    "sanitizesInput": true
  }
}
```
