threatcl

Uses HashiCorp Configuration Language, making threat models easy to write, read, and version control, as shown in the example HCL snippet for defining assets and threats.

Automatically generates PNG or DOT data flow diagrams from HCL definitions, visualizing system architecture without manual drawing, leveraging the go-dfd package.

Offers a GraphQL API server and CLI queries for integrating threat model data into CI/CD pipelines, enabling automated checks and statistics extraction.

Exports threat models to JSON, OpenThreatModel (OTM), or back to HCL, ensuring compatibility with other security tools and facilitating data exchange.

Automatically generates information asset blocks from Terraform state or plan files, keeping threat models synchronized with infrastructure-as-code deployments.