Skip to content
SPECIFICTION
Get listed

ThreatForge

threatforge.dev

Free plan WebWindowsmacOSLinux
Visit threatforge.dev
Spec score 7.5 #16 of 23 in Threat Modeling Software

What it is

ThreatForge is an open-source app for building threat models with diagrams, automated STRIDE analysis, and AI-assisted threat discovery. Its drag-and-drop canvas has 44 typed components across 10 categories, plus trust boundaries, annotations, and automatically routed connections. A built-in rules engine generates threats from component types and data-flow patterns, and works offline. Users can also chat with Claude or GPT about a model to suggest threats, propose mitigations, or ask security questions; this uses their own API key. Models are human-readable YAML files that can be compared in Git diffs, reviewed in pull requests, and versioned. Six templates cover cloud microservices, e-commerce, mobile banking, SaaS, IoT smart buildings, and healthcare systems. ThreatForge supports Linux, macOS, Windows, and the web. The maker says there is no telemetry and models stay on the user's machine. No account is required to start. The full app is available for free under Apache 2.0, with no freemium upsells or enterprise-only features. The maker describes the download as approximately 10 MB.

Spec sheet

Product
Threat Forge is an open-source desktop app for threat modeling with visual diagrams, automated STRIDE analysis, and AI-assisted threat discovery.Read 7 Oct 2026 · exitzerolabs.com
Intended users
The maker positions Threat Forge as a developer-friendly alternative for teams seeking threat modeling without an enterprise procurement cycle.Read 7 Oct 2026 · exitzerolabs.com
Platforms
The desktop app runs on macOS, Windows, and Linux.Read 7 Oct 2026 · exitzerolabs.com
Privacy
The maker says there is no telemetry and threat models stay on the user's machine.Read 7 Oct 2026 · exitzerolabs.com
License
The application is released under the Apache 2.0 license, with no freemium upsells or enterprise-only features.Read 7 Oct 2026 · exitzerolabs.com
Account
No account is required to get started.Read 7 Oct 2026 · exitzerolabs.com
AI analysis
The app supports chatting with Claude or GPT about a threat model and can suggest threats, propose mitigations, and answer security questions; it uses BYOK.Read 7 Oct 2026 · exitzerolabs.com
Diagrams
Its drag-and-drop canvas has 44 typed components across 10 categories, with trust boundaries, text annotations, and automatically routed connections.Read 7 Oct 2026 · exitzerolabs.com
Download size
The maker describes the download as approximately 10 MB.Read 7 Oct 2026 · exitzerolabs.com
File format
Threat models use human-readable, git-diffable YAML files that can be reviewed in pull requests and versioned over time.Read 7 Oct 2026 · exitzerolabs.com
STRIDE
The built-in rule engine generates threats from element types and data-flow patterns and works fully offline.Read 7 Oct 2026 · exitzerolabs.com
Templates
Six templates cover Cloud Microservices, E-Commerce, Mobile Banking, SaaS Platform, IoT Smart Building, and Healthcare System.Read 7 Oct 2026 · exitzerolabs.com

Plans and prices

Threat Forge Free Free and open source under Apache 2.0 · no account required · full application available to everyone Read 7 Oct 2026 · exitzerolabs.com

Every ThreatForge plan and price →

Strong points and limits

Strong points

  • STRIDE analysis works fully offline.
  • Models are human-readable, diffable YAML.
  • No account is required to get started.
  • No telemetry, according to the maker.
  • Full application is free under Apache 2.0.

Limits

  • AI assistance requires your own API key.
  • Threat models stay on the user's machine, according to the maker.

Who it suits

ThreatForge is positioned for developers and teams seeking threat modeling without an enterprise procurement cycle. Its offline rules engine and Git-friendly YAML may suit teams that want to keep models local and review changes in pull requests.

Verdict

ThreatForge pairs visual modeling with offline rules and optional AI assistance. Its local model storage and BYOK approach are important considerations for teams deciding how to handle threat models and AI access.

Where Specifiction places it

Alternatives to ThreatForgeAll alternatives →