threat-modeling-mcp-server: Skill for Kiro

Phase 9: Output Generation and Documentation

Objective

Generate final deliverables: Threat Composer-compatible JSON export and human-readable Markdown report. All files are saved to the .threatmodel/ directory.

Tools Reference

export_threat_model

Exports the current model and includes a state summary in the response.

• Omit output_path to use a timestamped filename
• Pass output_path="my_model.json" to choose a base path and filename
• Generates BOTH .tc.json and .md files
• Saves both files to the adjacent .threatmodel/ directory
• JSON is Threat Composer compatible (schema version 1)

The comprehensive export includes current threat and mitigation statuses. Extended JSON and Markdown also include residual-risk assessments; the standard Threat Composer fields remain unchanged.

Progress Tools

• manage_workflow(action="progress") -- Final progress summary with phase completion
• manage_assumptions(action="list") -- All documented assumptions

Output Files

JSON Export (Threat Composer Compatible)

.threatmodel/comprehensive_threat_model_YYYYMMDD_HHMMSS.tc.json

Schema (version 1):

{
  "schema": 1,
  "applicationInfo": { "name": "", "description": "" },
  "architecture": { "description": "" },
  "dataflow": { "description": "" },
  "assumptions": [...],
  "mitigations": [...],
  "assumptionLinks": [],
  "mitigationLinks": [...],
  "threats": [...]
}

Threat Composer Field Constraints

Field	Max Length
threatSource	200 chars
prerequisites	200 chars
threatAction	200 chars
threatImpact	200 chars
statement	1400 chars
tags (each)	30 chars

Threat Composer Status Values

Threats	Mitigations
threatIdentified	mitigationIdentified
threatResolved	mitigationInProgress
threatResolvedNotUseful	mitigationResolved
	mitigationResolvedWillNotAction

Markdown Export (Human-Readable)

.threatmodel/comprehensive_threat_model_YYYYMMDD_HHMMSS.md