🎯 ThreatCanvas

Describe your system architecture in plain English → get a full visual threat model in seconds.

AI-powered STRIDE threat modeling with interactive attack surface visualization, risk-ranked findings, kill chain mapping, and actionable mitigation recommendations.

Hackathon Submission — Microsoft Agents League · Battle #1: Creative Apps with GitHub Copilot

---

Demo

Open http://localhost:5173 after starting both servers (see Quick Start below).

Input: "A React SaaS app with Node.js API, PostgreSQL, Redis, Stripe integration, and OAuth via Auth0"

Output:

• 🗺️ Interactive attack surface graph with trust zone overlays
• ⚠️ 10-15 STRIDE threats with CVSS scores and MITRE ATT&CK mapping
• 🔗 Multi-step attack paths (kill chains) highlighted on the graph
• ✅ Actionable mitigation recommendations for every finding
• 📊 Overall risk score with top-3 critical risks

---

What It Does

Step	Description
1. Describe	Write your system architecture in plain English — no diagrams, no forms, no YAML
2. Analyze	Copilot SDK agent runs a full STRIDE analysis using 4 custom tools in sequence
3. Visualize	Interactive ReactFlow graph shows components, data flows, and trust zones
4. Explore	Click any component → see threats with severity, CVSS, attack vectors, mitigations
5. Trace	Click an attack path → kill chain highlights the full route through your system

---

Tech Stack

Layer	Technology
AI Engine	GitHub Copilot SDK (github-copilot-sdk on PyPI)
Agent Runtime	Copilot CLI (server mode, JSON-RPC)
Backend	Python 3.11+ · FastAPI · Uvicorn
Frontend	React 18 · ReactFlow · Tailwind CSS · Vite
Methodology	STRIDE · MITRE ATT&CK · CVSS Scoring
Layout	Dagre (automatic directed graph layout)

---

Project Structure

ThreatCanvas/
├── backend/
│   ├── agent.py          # Copilot SDK agentic loop + STRIDE tools
│   ├── main.py           # FastAPI server
│   └── requirements.txt
├── frontend/
│   ├── src/
│   │   ├── components/
│   │   │   ├── Header.jsx         # Top bar with branding
│   │   │   ├── InputPanel.jsx     # System description input
│   │   │   ├── ThreatGraph.jsx    # ReactFlow interactive graph
│   │   │   ├── ComponentNode.jsx  # Custom graph node
│   │   │   ├── FindingsPanel.jsx  # Threat details sidebar
│   │   │   └── SummaryBar.jsx     # Risk score & attack path selector
│   │   ├── App.jsx
│   │   ├── main.jsx
│   │   └── index.css
│   ├── index.html
│   ├── package.json
│   ├── vite.config.js
│   ├── tailwind.config.js
│   └── postcss.config.js
├── .env.example
├── .gitignore
└── README.md

---

Quick Start

Prerequisites

1. GitHub Copilot subscription (free tier works)
2. GitHub Copilot CLI installed and authenticated:

# Install the Copilot CLI
# See: https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli
copilot --version  # verify it works

3. Python 3.11+ and Node.js 18+

1. Clone & configure

git clone https://github.com/ivproduced/ThreatCanvas.git
cd ThreatCanvas
cp .env.example .env

2. Backend

cd backend
pip install -r requirements.txt
python main.py
# Runs on http://localhost:8000

3. Frontend

cd frontend
npm install
npm run dev
# Runs on http://localhost:5173

The Copilot SDK communicates with the CLI in server mode automatically — no API keys needed (uses your logged-in Copilot CLI user).

---

How GitHub Copilot SDK Powers ThreatCanvas

ThreatCanvas uses the GitHub Copilot SDK as its AI brain — not a raw LLM API call. The SDK manages the full agentic loop: planning, tool invocation, and response synthesis.

from copilot import CopilotClient, Tool, PermissionHandler

client = CopilotClient()
await client.start()  # spawns Copilot CLI in server mode

session = await client.create_session({
    "model": "gpt-4.1",
    "tools": [register_components, add_stride_threats, add_attack_paths, set_summary],
    "system_message": SYSTEM_MESSAGE,
    "on_permission_request": PermissionHandler.approve_all,
})

await session.send_and_wait({"prompt": "Analyze this architecture..."})

Agentic Tool Chain

Copilot autonomously decides which tools to call, in what order, and with what arguments:

User Input → Copilot SDK Agent
    ├── 1. register_components()   → Extract components + data flows
    ├── 2. add_stride_threats()    → STRIDE analysis (called N times)
    ├── 3. add_attack_paths()      → Multi-step kill chains
    └── 4. set_summary()           → Risk score + top risks

Tool	Purpose	Called
register_components	Parse architecture into typed components with trust zones and data flows	Once
add_stride_threats	Generate STRIDE threats per component with CVSS, attack vectors, mitigations	1-3×
add_attack_paths	Build realistic multi-step kill chains chaining threats across components	Once
set_summary	Compute overall risk score (0-100) and identify top risks	Once

This is the same agentic execution loop that powers Copilot CLI — ThreatCanvas gives it a cybersecurity domain to work in.

---

STRIDE Methodology

ThreatCanvas implements the full STRIDE framework:

Letter	Threat	Example
S	Spoofing	Attacker impersonates a legitimate user
T	Tampering	Modification of data in transit or at rest
R	Repudiation	Deny performing an action without audit trail
I	Information Disclosure	Unauthorized data exposure
D	Denial of Service	Making a component unavailable
E	Elevation of Privilege	Gaining access beyond authorization

---

Example Systems to Try

• "A React SaaS app with Node.js API, PostgreSQL, Redis, and Stripe integration"
• "A HIPAA healthcare platform with patient portal, EHR integration, and mobile apps"
• "An IoT platform with 10,000 MQTT sensors, time-series DB, and remote firmware updates"
• "A Kubernetes microservices platform with API gateway, service mesh, and secrets vault"

---

Evaluation Criteria Alignment

Criteria	How ThreatCanvas Addresses It
Accuracy & Relevance (20%)	Produces system-specific STRIDE threats with realistic CVSS scores — not generic boilerplate
Reasoning & Multi-step Thinking (20%)	4-tool agentic pipeline: decompose → analyze → chain → summarize. Agent decides tool order autonomously
Creativity & Originality (15%)	Novel intersection of AI + cybersecurity. Interactive threat model from plain English — no existing tool does this
User Experience & Presentation (15%)	Dark-themed ReactFlow graph, trust zone overlays, click-to-explore threats, animated kill chains
Reliability & Safety (20%)	No secrets in repo, Copilot SDK handles auth, CORS-restricted backend, input validation

---

Contributing

This is a hackathon project. Issues and PRs welcome after the contest.

License

MIT