The open, cross-platform successor to the Microsoft Threat Modeling Tool. Author, validate, and report on threat models as code: lossless .tm7, a CI-grade rule engine with SARIF, git-native diff/merge, and a browser Studio, CLI, and HTTP API over one .NET engine.
Install
npx skills add Hacks4Snacks/tmforgegh skill install Hacks4Snacks/tmforgegit clone --depth 1 https://github.com/Hacks4Snacks/tmforgeSkills in this collection
- Threat ModelingMark D. GrayCreate deterministic, evidence-backed STRIDE threat models. Use for scope discovery, data-flow diagrams, trust boundaries, assets, security controls, threat enumeration, risk scoring, model verification, and structured threat-model reports.
- Threat Modeling TmforgeMark D. GrayCreate, update, verify, analyze, render, convert, or troubleshoot Microsoft Threat Modeling Tool .tm7 files and declarative tmforge manifests. Use whenever tmforge, .tm7, model manifests, generated threats, persisted triage, stencils, or tmforge properties are involved.
- Tmforge VscodeMark D. GrayCreate, inspect, analyze, and update draft threat-model diagrams using the tmforge VS Code extension tools and Studio. Use for extension-based model creation, open .tm7 or .tmforge.json edits, properties, findings, and triage.