Usage / Ai tool

Threat Dragon AI Tool

A desktop application that automatically generates STRIDE threats and mitigations for OWASP Threat Dragon models using LLMs, then adds them to the model’s .json file.

Threat Dragon AI Tool

Quick Start

  1. Download the latest version of the application for your operating system from the InfoSecOTB Threat Dragon AI Tool releases page.
  2. Move the downloaded compressed file to a folder of your choice and extract it.
  3. Run the td-ai-tool executable.
  4. Configure the settings:
    • Required
      • API Key - API key for accessing the LLM service.
      • LLM Model - LLM model identifier, for example openai/gpt-5, anthropic/claude-sonnet-4-5, or xai/grok-4.
      • Response Format - Enables structured JSON output. Should be enabled for supported models such as openai/gpt-5 or xai/grok-4. If it is enabled for an unsupported model, or disabled for a supported model, the request may fail.
    • Optional (defaults are usually fine)
      • Temperature - Lower values make output more deterministic; higher values increase creativity and randomness. Valid range: 0 to 2.
      • API Base URL - Custom API base URL. Most hosted AI providers do not require this because LiteLLM handles it automatically.
      • Log Level - Logging level: INFO or DEBUG.
      • Timeout - Request timeout in seconds for LLM API calls. Default: 900 seconds (15 minutes).
  5. Click Save Config to persist the settings.
    • Non-secret settings are saved to config.json in the same folder as the executable.
    • The API key is saved separately in the OS secure credential store (via keyring) and is not written to config.json.
  6. Click Open Model (or File → Open Model) and select a Threat Dragon .json file.
  7. Click Generate Threats and Mitigations. A warning dialog will appear - read it, then confirm.
  8. Wait while the tool processes the model. The console on the right shows progress. Depending on the model size and LLM provider, this can take from a few seconds to several minutes.
  9. When complete, the tool writes threats directly into your .json file and runs a validation pass. Open the file in Threat Dragon to see the results.

Resources

You can find more information about the Threat Dragon AI Tool in the following locations:

  1. GitHub Repository
  2. Articles on InfoSecOTB blog: