Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-10 | ✗→✓ | ▲ Improved | -66% | 0% |
| case-04 | ✗→✓ | ▲ Improved | -26% | 0% |
| case-05 | ✗→✓ | ▲ Improved | -61% | 0% |
| case-06 | ✗→✓ | ▲ Improved | -62% | 0% |
| case-07 | ✗→✓ | ▲ Improved | -30% | 0% |
The companion to harness-mcp-scan for enterprise security reviews. Where mcp-scan is a per-server static lint, threat-model produces a categorized report suitable for sharing with an InfoSec team.
Implementation: scripts/threat-model.mjs.
harness binary (metaharness@~0.3.0, resolved from alocal install or the one-time ~/.ruflo/metaharness-cache-<pin> cache — never @latest): harness threat-model <path> --json.
{ worst, findings[] }.--fail-on <severity>: exit 1 when worst >= fail-on. Default high.| Severity | Rank | |---|---:| | clean | 0 | | low | 1 | | medium | 2 | | high | 3 |
packet sent to security.
oia-audit backgroundworker (ADR-150 Phase 2) to detect MCP-surface drift.
Same pattern as the other skills: when harness is absent, emit { degraded: true } and exit 0. ADR-150 architectural constraint.
Other measured skills in the registry, with their headline benchmark lift.