← All demos

MCP Threat-Model Template

For teams connecting AI agents to internal toolsLiveOpen live demo

Built with: STRIDE · Next.js · Markdown template

The problem

MCP servers give an AI agent real tools and real access. That is untrusted input meeting privileged action, the oldest problem in security with a new interface. Most teams skip the threat model, not because they don't care, but because starting from zero is expensive and nobody owns it.

Who it's for

Platform and security engineers about to connect an agent to something that matters (a ticketing system, a database, a code repository) who need a defensible "yes, with these gates" before they ship.

How it works

  • An interactive checklist: eighteen "can someone…?" questions across the six STRIDE categories, with progress saved locally in the browser.
  • A downloadable Markdown worksheet: data-flow sketch, per-tool blast-radius table, impact × likelihood ranking, approval-gate list, and a sign-off verdict.
  • One closing question that decides every connection: if a malicious instruction reached this agent through the data it reads, what is the worst tool it could reach, and is that gated?

Try it

Open the interactive checklist and work through it for one tool you already use. The reasoning behind each question is in Threat-Modelling Your First MCP Server.

The 30-second pitch

"Every team wiring agents into internal systems needs to threat-model it, and almost none do because the blank page is too expensive. This makes it one afternoon, produces an artefact a reviewer can sign off, and points straight at the tools that need an approval gate."

What I'd ask in a first call:

  1. How many agent or MCP integrations are live or planned, and who approves them?
  2. Which of them can write or delete, not just read?
  3. If an agent did something it shouldn't, how would you find out, and how would you stop it?

Trade-offs and limits

  • A checklist structures judgement; it does not replace it. The output is only as good as the honesty of the answers.
  • It covers one server at a time. Risk that emerges from combining several tools needs a system-level review on top.
  • Progress lives in your browser only. Nothing is shared or synced, which is a privacy feature and a collaboration limit.