---
name: Threat Model
slug: threat-model
category: Quality
description: Threat Model renders MCP scan findings as a PR-ready security artifact with allowed and denied tools, permission counts, secrets reachability, and network or shell exposure. Use it when reviewing harness changes or permissions before release.
github: "https://github.com/ruvnet/metaharness/tree/main/.claude-plugin/skills/threat-model"
language: TypeScript
stars: 609
forks: 72
install: "npx degit https://github.com/ruvnet/metaharness/tree/main/.claude-plugin/skills/threat-model ~/.claude/skills/threat-model"
installs_to: ~/.claude/skills/threat-model
source_path: .claude-plugin/skills/threat-model/SKILL.md
collection_size: 16
category_size: 1354
collection_url: "https://dirskills.com/collections/ruvnet/metaharness"
added: 2026-08-25T05:12:53.744Z
last_synced: 2026-08-25T05:12:53.744Z
canonical_url: "https://dirskills.com/skills/threat-model"
---

# Threat Model

Threat Model renders MCP scan findings as a PR-ready security artifact with allowed and denied tools, permission counts, secrets reachability, and network or shell exposure. Use it when reviewing harness changes or permissions before release.

**Install:**

```bash
npx degit https://github.com/ruvnet/metaharness/tree/main/.claude-plugin/skills/threat-model ~/.claude/skills/threat-model
```

## README

# threat-model

> Codex skill: MCP threat-model artifact for PR / compliance review
> (iter 112 → iter 114). User-labelled "enterprise gold."

## What it does

Renders the existing `mcp-scan` findings as a clean threat-model artifact
in the shape a security / compliance reviewer wants to see attached to a
PR:

```
MCP Threat Model

  Allowed tools:         3
  Denied tools:          14
  Dangerous permissions: 0
  Secrets reachable:     no
  Network access:        no
  Shell access:          no
  File write:            no
  Default-deny policy:   yes
  Audit log:             yes

Verdict: clean (exit 0)
```

Same underlying scan as `mcp-scan`, presented as a single-screen artifact.

| Verdict | Exit | Triggers |
|---|---|---|
| `clean` | 0 | no dangerous perms, no secret exposure |
| `medium` | 1 | network OR file-write granted, OR no audit log |
| `high` | 2 | shell granted OR default-deny OFF OR secrets reachable |

The "secrets reachable" heuristic is conservative: true when MCP is in
use AND deny rules don't guard `.env*` AND allow rules include any
`Read(...)` grant.

## Usage from Codex

```
/threat-model path=./my-harness
/threat-model path=./my-harness bundle=true
```

## Equivalent CLI

```bash
harness threat-model ./my-harness                # text artifact
harness threat-model ./my-harness --json         # full envelope
harness threat-model ./my-harness --bundle       # ADR-031 schema-1
harness threat-model ./my-harness --out tm.json  # write to file
```

## When to attach this to a PR

- Adding a new MCP server / tool
- Loosening a permission allow rule
- Pulling in a new dependency that exposes shell/network capabilities
- Any change to `.harness/mcp-policy.json` or `.claude/settings.json`
  permissions

The artifact is small enough to paste verbatim into the PR description.

## Related skills

- `validate-harness` (iter 22) — release-readiness umbrella (includes
  mcp-scan)
- `score-harness` (iter 114) — broader 0-100 scorecard; MCP safety is
  one of its 5 dimensions
- `repo-genome` (iter 114) — pre-scaffold readiness; MCP risk is one of
  its 7 sections

## See also

- ADR-022 — MCP primitive · ADR-030 — Discovery Loop · ADR-031 — Bundle Pattern