Dethereal
July 2, 2026 · View on GitHub
Dethereal is a Claude Code plugin that guides you through building structured threat models using conversational AI. You describe your system in natural language, and the plugin discovers infrastructure, maps trust boundaries and data flows, places each boundary on a trust gradient with approved channels (see Boundary Trust Zones), enriches security attributes, and publishes the model to the Dethernety platform for analysis.
The plugin provides 14 slash commands, 4 specialized AI agents, 22 MCP tools, and an 11-step guided workflow that takes you from a system description to a fully enriched, analysis-ready threat model. A per-Control library mirrors the platform's reusable security controls into local files (controls/<id>.json) with shared-ownership safety prompts on push — see Sync and Version Control.
Documentation
| Guide | Description |
|---|---|
| Getting Started | Installation, authentication, and creating your first model |
| Guided Workflow | The 11-step threat modeling process from scope to sync |
| Command Reference | All 14 slash commands with syntax, arguments, and examples |
| Model Concepts | Components, boundaries, data flows, classes, quality scoring |
| Discovery and Enrichment | Infrastructure scanning, security attributes, MITRE, credentials |
| Sync and Version Control | Push/pull, conflict handling, git integration |
| Review and Analysis | Quality review, attack surface analysis |
| Agents, Tools, and Hooks | AI agents, MCP tools, hooks, state machine |
| Glossary | Plugin-specific terminology |
Quick Start
- Getting Started — Install the plugin, connect to your platform, create your first model
- Guided Workflow — Run
/dethereal:threat-modelto walk through all 11 steps - Model Concepts — Understand what the model contains and how quality scoring works
Prerequisites
- Claude Code — CLI (
claude), VS Code extension, or JetBrains plugin - Node.js 18+ and pnpm — for running the MCP server
- Dethernety platform — a running instance for sync and analysis (local or hosted)
Relationship to Platform Documentation
These docs cover the Claude Code plugin experience — working with threat models through conversational AI in your terminal or IDE.
For the platform GUI experience (web-based diagram editor, analysis dashboard, issue tracking), see the platform user documentation:
- Building Your First Model — GUI-based tutorial
- Security Analysis Workflow — Running analysis on the platform
- Working with Security Controls — Creating controls in the GUI
- Component Configuration Guide — Component setup in the GUI
- Boundary Trust Zones — Zoning boundaries and declaring approved channels (conduits) in the GUI
Both workflows produce the same threat model format. You can create a model with Dethereal, push it to the platform, and continue editing in the GUI — or pull a GUI-created model and enrich it locally.
Next: Getting Started — install the plugin and create your first model