Skip to content
SPECIFICTION
Get listed

Threagile

threagile.io

Free plan WebLinuxAPISelf-hosted
Visit threagile.io
Spec score 7.6 #11 of 23 in Threat Modeling Software

What it is

Threagile is an open-source toolkit for agile threat modeling. It represents architecture and assets in YAML and checks those models against risk rules, then produces reports of potential risks and recommended mitigations. Mitigation status can be recorded in the YAML model so reports reflect current progress. The toolkit also generates data-flow diagrams and supports Excel and JSON output. Teams can run it from the command line, in Docker, or as a REST server. Models can be edited in developer IDEs and tracked in Git, while custom risk rules can be written as YAML scripts without compiling Go code. A web playground analyzes YAML models and links to schema and API resources; a GitHub Action can run the tool against a repository model file. Threagile is free under the MIT License and supports API, Linux, self-hosted, and web use. The project describes itself as developer-friendly for agile projects and DevSecOps workflows. Its repository says current UI attempts are not ready, and support requests can be raised as GitHub discussions or issues.

Spec sheet

Purpose
Threagile is an open-source toolkit for agile threat modeling that models architecture and assets in YAML and checks models against risk rules.Read 8 Oct 2026 · github.com
Intended users
The maker describes Threagile as developer-friendly threat modeling for agile projects and DevSecOps workflows.Read 8 Oct 2026 · threagile.io
Support
The repository invites users to create a GitHub discussion or issue, where contributors may respond.Read 8 Oct 2026 · github.com
License
The repository identifies the software as open source under the MIT License.Read 8 Oct 2026 · github.com
Headquarters
Cologne, GermanyRead 28 Sep 2026 · threagile.io
Custom rules
Custom risk rules can be written as YAML scripts without compiling Go code.Read 8 Oct 2026 · github.com
Diagrams and exports
It automatically creates data-flow diagrams and supports output formats including Excel and JSON.Read 8 Oct 2026 · threagile.io
Execution options
Threagile can run from the command line, in a Docker container, or as a REST server.Read 8 Oct 2026 · threagile.io
Integration
The project provides a GitHub Action for running Threagile against a repository model file.Read 8 Oct 2026 · github.com
Model editing
Models are editable in developer IDEs and diffable in Git, and the playground provides YAML model analysis and links to schema and API resources.Read 8 Oct 2026 · threagile.io
Risk reports
It can generate reports with potential risks and recommended mitigation actions.Read 8 Oct 2026 · threagile.io
Risk tracking
Risk tracking can be recorded in the YAML model so the current mitigation state is reported.Read 8 Oct 2026 · threagile.io
UI status
The repository says UI efforts are ongoing and current attempts are not ready.Read 8 Oct 2026 · github.com

Plans and prices

Threagile Free Open-source toolkit · MIT License Read 8 Oct 2026 · github.com

Every Threagile plan and price →

Strong points and limits

Strong points

  • Risk reports include recommended mitigation actions
  • Creates data-flow diagrams and Excel or JSON exports
  • Custom rules use YAML scripts
  • Offers command-line, Docker, and REST server execution

Limits

  • Current UI attempts are not ready
  • Support responses from contributors are not guaranteed

Who it suits

Threagile suits developers and teams doing threat modeling in agile projects or DevSecOps workflows. It is especially relevant to teams comfortable editing YAML and managing models in Git.

Verdict

Threagile puts architecture modeling, risk checks, mitigation tracking, and diagram generation into a YAML-centered workflow. Teams considering it should be comfortable working with models in developer tools while UI efforts continue.

Where Specifiction places it

Alternatives to ThreagileAll alternatives →