[{"data":1,"prerenderedAt":1295},["ShallowReactive",2],{"page-\u002Fdethereal\u002Fgetting-started":3,"navigation":976},{"id":4,"title":5,"body":6,"description":964,"extension":965,"meta":966,"navigation":304,"path":972,"seo":973,"stem":974,"__hash__":975},"docs\u002F03.dethereal\u002F01.getting-started.md","Getting Started with Dethereal",{"type":7,"value":8,"toc":932},"minimark",[9,13,17,20,25,61,63,67,72,75,85,88,113,116,137,141,148,254,257,261,276,321,325,370,393,399,404,411,413,417,420,426,429,432,438,452,458,462,468,474,476,480,486,492,496,539,543,563,565,569,572,576,582,585,600,604,610,622,641,645,651,654,658,664,667,669,673,676,682,689,693,725,728,732,739,765,767,771,774,780,782,786,789,793,803,807,810,836,848,850,854,857,889,903,909,917,919,928],[10,11,5],"h1",{"id":12},"getting-started-with-dethereal",[14,15,16],"p",{},"This guide walks you through installing the Dethereal plugin, connecting to the Dethernety platform, and creating your first threat model.",[18,19],"hr",{},[21,22,24],"h2",{"id":23},"prerequisites","Prerequisites",[26,27,28,41,51],"ul",{},[29,30,31,35,36,40],"li",{},[32,33,34],"strong",{},"Claude Code"," — the Anthropic CLI (",[37,38,39],"code",{},"claude","), VS Code extension, or JetBrains plugin",[29,42,43,46,47,50],{},[32,44,45],{},"Node.js 20 or later"," — required for the MCP server; the plugin will not install or start on Node 18. ",[32,48,49],{},"pnpm"," as well, if you build from source",[29,52,53,56,57,60],{},[32,54,55],{},"A Dethernety platform instance"," — local (",[37,58,59],{},"http:\u002F\u002Flocalhost:3003",") or hosted over HTTPS",[18,62],{},[21,64,66],{"id":65},"installation","Installation",[68,69,71],"h3",{"id":70},"from-the-plugin-marketplace-recommended","From the Plugin Marketplace (Recommended)",[14,73,74],{},"Add the Dethernety marketplace and install the plugin:",[76,77,82],"pre",{"className":78,"code":80,"language":81},[79],"language-text","\u002Fplugin marketplace add dether-net\u002Fclaude-plugins\n\u002Fplugin install dethereal@dether.net\n","text",[37,83,80],{"__ignoreMap":84},"",[14,86,87],{},"Or via CLI:",[76,89,93],{"className":90,"code":91,"language":92,"meta":84,"style":84},"language-bash shiki shiki-themes github-light github-dark-dimmed","claude plugin install dethereal@dether.net\n","bash",[37,94,95],{"__ignoreMap":84},[96,97,100,103,107,110],"span",{"class":98,"line":99},"line",1,[96,101,39],{"class":102},"sOLd2",[96,104,106],{"class":105},"s-HuK"," plugin",[96,108,109],{"class":105}," install",[96,111,112],{"class":105}," dethereal@dether.net\n",[14,114,115],{},"Set the platform URL as an environment variable:",[76,117,119],{"className":90,"code":118,"language":92,"meta":84,"style":84},"export DETHERNETY_URL=https:\u002F\u002Fdethernety.example.com\n",[37,120,121],{"__ignoreMap":84},[96,122,123,127,131,134],{"class":98,"line":99},[96,124,126],{"class":125},"s7YZ4","export",[96,128,130],{"class":129},"sYgZi"," DETHERNETY_URL",[96,132,133],{"class":125},"=",[96,135,136],{"class":129},"https:\u002F\u002Fdethernety.example.com\n",[68,138,140],{"id":139},"for-team-projects","For Team Projects",[14,142,143,144,147],{},"Add to your project's ",[37,145,146],{},".claude\u002Fsettings.json"," so the plugin is available to all team members:",[76,149,153],{"className":150,"code":151,"language":152,"meta":84,"style":84},"language-json shiki shiki-themes github-light github-dark-dimmed","{\n  \"extraKnownMarketplaces\": {\n    \"dether.net\": {\n      \"source\": { \"source\": \"github\", \"repo\": \"dether-net\u002Fclaude-plugins\" }\n    }\n  },\n  \"enabledPlugins\": {\n    \"dethereal@dether.net\": true\n  }\n}\n","json",[37,154,155,160,170,178,210,216,222,230,242,248],{"__ignoreMap":84},[96,156,157],{"class":98,"line":99},[96,158,159],{"class":129},"{\n",[96,161,163,167],{"class":98,"line":162},2,[96,164,166],{"class":165},"snmFh","  \"extraKnownMarketplaces\"",[96,168,169],{"class":129},": {\n",[96,171,173,176],{"class":98,"line":172},3,[96,174,175],{"class":165},"    \"dether.net\"",[96,177,169],{"class":129},[96,179,181,184,187,190,193,196,199,202,204,207],{"class":98,"line":180},4,[96,182,183],{"class":165},"      \"source\"",[96,185,186],{"class":129},": { ",[96,188,189],{"class":165},"\"source\"",[96,191,192],{"class":129},": ",[96,194,195],{"class":105},"\"github\"",[96,197,198],{"class":129},", ",[96,200,201],{"class":165},"\"repo\"",[96,203,192],{"class":129},[96,205,206],{"class":105},"\"dether-net\u002Fclaude-plugins\"",[96,208,209],{"class":129}," }\n",[96,211,213],{"class":98,"line":212},5,[96,214,215],{"class":129},"    }\n",[96,217,219],{"class":98,"line":218},6,[96,220,221],{"class":129},"  },\n",[96,223,225,228],{"class":98,"line":224},7,[96,226,227],{"class":165},"  \"enabledPlugins\"",[96,229,169],{"class":129},[96,231,233,236,238],{"class":98,"line":232},8,[96,234,235],{"class":165},"    \"dethereal@dether.net\"",[96,237,192],{"class":129},[96,239,241],{"class":240},"sviXB","true\n",[96,243,245],{"class":98,"line":244},9,[96,246,247],{"class":129},"  }\n",[96,249,251],{"class":98,"line":250},10,[96,252,253],{"class":129},"}\n",[14,255,256],{},"Team members get prompted to install when they trust the project folder.",[68,258,260],{"id":259},"from-source-contributors","From Source (Contributors)",[14,262,263,264,271,272,275],{},"If you're developing from a clone of ",[265,266,270],"a",{"href":267,"rel":268},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss",[269],"nofollow","dether-net\u002Fdethernety-oss",", run these from the repository root after ",[37,273,274],{},"pnpm install",":",[76,277,279],{"className":90,"code":278,"language":92,"meta":84,"style":84},"# Build the plugin\npnpm --filter \"@dether.net\u002Fdethereal...\" build\n\n# Load it locally\nclaude --plugin-dir apps\u002Fdethereal\n",[37,280,281,287,300,306,311],{"__ignoreMap":84},[96,282,283],{"class":98,"line":99},[96,284,286],{"class":285},"sDN9O","# Build the plugin\n",[96,288,289,291,294,297],{"class":98,"line":162},[96,290,49],{"class":102},[96,292,293],{"class":240}," --filter",[96,295,296],{"class":105}," \"@dether.net\u002Fdethereal...\"",[96,298,299],{"class":105}," build\n",[96,301,302],{"class":98,"line":172},[96,303,305],{"emptyLinePlaceholder":304},true,"\n",[96,307,308],{"class":98,"line":180},[96,309,310],{"class":285},"# Load it locally\n",[96,312,313,315,318],{"class":98,"line":212},[96,314,39],{"class":102},[96,316,317],{"class":240}," --plugin-dir",[96,319,320],{"class":105}," apps\u002Fdethereal\n",[68,322,324],{"id":323},"configuration","Configuration",[326,327,333],"div",{"className":328,"tabIndex":330,"role":331,"ariaLabel":332},[329],"table-frame",0,"region","Table: Configuration",[334,335,336,352],"table",{},[337,338,339],"thead",{},[340,341,342,346,349],"tr",{},[343,344,345],"th",{},"Environment Variable",[343,347,348],{},"Default",[343,350,351],{},"Purpose",[353,354,355],"tbody",{},[340,356,357,363,367],{},[358,359,360],"td",{},[37,361,362],{},"DETHERNETY_URL",[358,364,365],{},[37,366,59],{},[358,368,369],{},"Platform URL",[14,371,372,388,389,392],{},[32,373,374,376,377,198,380,383,384,387],{},[37,375,362],{}," must use HTTPS unless the host is ",[37,378,379],{},"localhost",[37,381,382],{},"127.0.0.1",", or ",[37,385,386],{},"::1","."," Plain ",[37,390,391],{},"http:\u002F\u002F"," to any other host — a self-hosted instance on an internal address, for example — is rejected at startup with a configuration error:",[394,395,396],"blockquote",{},[14,397,398],{},"DETHERNETY_URL must use HTTPS for non-localhost connections. HTTP is only permitted for localhost, 127.0.0.1, and ::1.",[14,400,401,402,387],{},"The MCP server exits rather than starting, so inside Claude Code this looks like the Dethereal tools simply not being there. If your commands have vanished, check the scheme first. Put a TLS-terminating proxy in front of a remote instance, or reach it over an SSH tunnel to ",[37,403,379],{},[14,405,406,407,410],{},"In no-auth mode the platform runs with authentication disabled (",[37,408,409],{},"ENABLE_NOAUTH=true","), and Dethereal detects this automatically.",[18,412],{},[21,414,416],{"id":415},"your-first-session","Your First Session",[14,418,419],{},"When you start Claude Code with the plugin loaded and no models tracked yet, you'll see an orientation message:",[76,421,424],{"className":422,"code":423,"language":81},[79],"Dethereal threat modeling plugin is active.\n\n  \u002Fdethereal:create   -- Create or import your first threat model\n  \u002Fdethereal:status   -- Check connection and auth status\n  \u002Fdethereal:help     -- See all available commands\n\n  Or just describe your system in natural language:\n  \"I have a React frontend talking to a Go API with a PostgreSQL database\"\n",[37,425,423],{"__ignoreMap":84},[14,427,428],{},"That last block is not decoration. You do not have to start with a command — describing your system in plain language is a first-class entry point, and the plugin turns the description into a model.",[14,430,431],{},"If the plugin can't reach a platform, one more line follows:",[76,433,436],{"className":434,"code":435,"language":81},[79],"  Platform: not connected (run \u002Fdethereal:login to connect)\n",[37,437,435],{"__ignoreMap":84},[14,439,440,441,443,444,448,449,451],{},"You'll see it when ",[37,442,362],{}," is unset ",[445,446,447],"em",{},"and"," nothing is answering on ",[37,450,59],{},". It is a hint, not a blocker — you can create and enrich a model entirely offline, and connect later.",[14,453,454,455,387],{},"Once you have models, this orientation is replaced by a short resume hint. With a single model it names the model, its quality score, and its workflow state; with several it gives the count and points you at ",[37,456,457],{},"\u002Fdethereal:status",[68,459,461],{"id":460},"checking-connection-status","Checking Connection Status",[14,463,464,465,467],{},"Run ",[37,466,457],{}," to verify everything is connected:",[76,469,472],{"className":470,"code":471,"language":81},[79],"Dethernety Connection Status\n─────────────────────────────────────────\nPlatform URL:  https:\u002F\u002Fdethernety.example.com\nAuth status:   Not authenticated — run \u002Fdethereal:login\n─────────────────────────────────────────\n\nNo local models found. Run \u002Fdethereal:create to get started.\n",[37,473,471],{"__ignoreMap":84},[18,475],{},[21,477,479],{"id":478},"authentication","Authentication",[14,481,464,482,485],{},[37,483,484],{},"\u002Fdethereal:login"," to authenticate with the platform. This opens your browser to the login page:",[76,487,490],{"className":488,"code":489,"language":81},[79],"> \u002Fdethereal:login\n\nOpening browser for authentication...\n\nAuthenticated successfully.\nPlatform:     https:\u002F\u002Fdethernety.example.com\nUser:         user@example.com\nToken valid:  60 minutes remaining\n",[37,491,489],{"__ignoreMap":84},[68,493,495],{"id":494},"how-authentication-works","How Authentication Works",[26,497,498,504,514,520,533],{},[29,499,500,503],{},[32,501,502],{},"OAuth 2.0 with PKCE"," — secure browser-based login, no passwords in the terminal",[29,505,506,509,510,513],{},[32,507,508],{},"Local session"," — the plugin's MCP server keeps your session under ",[37,511,512],{},"~\u002F.dethernety\u002F"," in your home directory, keyed by platform URL. The tokens stay inside the server: no tool returns them, and the commands check your session through the server rather than by reading that directory",[29,515,516,519],{},[32,517,518],{},"Auto-refresh"," — an expired session is refreshed transparently on the next command when a valid refresh token exists",[29,521,522,525,526,528,529,532],{},[32,523,524],{},"Desktop browser required"," — sign-in opens the browser on the machine the plugin runs on, and there is no fallback yet. Over SSH or in a headless container, ",[37,527,484],{}," fails (",[445,530,531],{},"Sign-in needs a desktop browser on this machine",") or times out waiting for the browser; run it where a browser is available",[29,534,535,538],{},[32,536,537],{},"Auth-disabled mode"," — if the platform has auth disabled (no-auth), all tools work without login",[68,540,542],{"id":541},"token-security","Token Security",[26,544,545,551,554,560],{},[29,546,547,548,550],{},"Never commit ",[37,549,512],{}," to version control, and never copy its token file between machines by hand — sign in on each machine instead",[29,552,553],{},"Tokens are specific to each platform URL — switching instances requires separate auth",[29,555,556,557,559],{},"Use ",[37,558,484],{}," to re-authenticate if your session expires",[29,561,562],{},"Signing out through the plugin deletes the local session only; it does not revoke it at the identity provider, and signing out of the platform's web interface does not necessarily end it either. A session copied elsewhere stays valid until its refresh token expires, unless an identity-provider administrator revokes it",[18,564],{},[21,566,568],{"id":567},"creating-your-first-model","Creating Your First Model",[14,570,571],{},"There are four ways to create a model. For your first time, describing your system in natural language is the easiest:",[68,573,575],{"id":574},"option-1-describe-your-system-recommended","Option 1: Describe Your System (Recommended)",[76,577,580],{"className":578,"code":579,"language":81},[79],"> \u002Fdethereal:create a web application with a React frontend served by nginx,\n  a Node.js API backend, a PostgreSQL database, and user authentication via OAuth\n",[37,581,579],{"__ignoreMap":84},[14,583,584],{},"The plugin will:",[586,587,588,591,594,597],"ol",{},[29,589,590],{},"Ask about your most valuable assets (crown jewels)",[29,592,593],{},"Ask about compliance requirements",[29,595,596],{},"Identify components and trust boundaries from your description",[29,598,599],{},"Present everything for your confirmation before writing files",[68,601,603],{"id":602},"option-2-start-from-a-template","Option 2: Start From a Template",[76,605,608],{"className":606,"code":607,"language":81},[79],"> \u002Fdethereal:create template web_app\n",[37,609,607],{"__ignoreMap":84},[14,611,612,613,198,616,198,619,387],{},"Available templates: ",[37,614,615],{},"web_app",[37,617,618],{},"api_service",[37,620,621],{},"microservices",[14,623,624,625,628,629,632,633,636,637,640],{},"Two further example models exist — ",[37,626,627],{},"simple"," (the tool's default) and ",[37,630,631],{},"database"," — but ",[37,634,635],{},"\u002Fdethereal:create"," deliberately offers only the three above. Those two are minimal, one- and two-component skeletons; they are reachable through the ",[37,638,639],{},"get_example_models"," tool and are useful as schema references, not as a starting point for a real model.",[68,642,644],{"id":643},"option-3-import-from-infrastructure-files","Option 3: Import From Infrastructure Files",[76,646,649],{"className":647,"code":648,"language":81},[79],"> \u002Fdethereal:create from .\u002Finfrastructure\u002F\n",[37,650,648],{"__ignoreMap":84},[14,652,653],{},"Point it at a directory containing Terraform, Kubernetes manifests, Dockerfiles, or other infrastructure definitions. The plugin's discovery agent scans the files and builds a model from what it finds.",[68,655,657],{"id":656},"option-4-pull-from-the-platform","Option 4: Pull From the Platform",[76,659,662],{"className":660,"code":661,"language":81},[79],"> \u002Fdethereal:create pull\n",[37,663,661],{"__ignoreMap":84},[14,665,666],{},"Lists models on the platform and exports one to local files for enrichment.",[18,668],{},[21,670,672],{"id":671},"what-gets-created","What Gets Created",[14,674,675],{},"After creating a model, you'll have a directory structure like this:",[76,677,680],{"className":678,"code":679,"language":81},[79],".\u002Fthreat-models\u002Fmy-web-app\u002F\n├── manifest.json          # Model metadata (name, description, modules)\n├── structure.json         # Boundary and component hierarchy\n├── dataflows.json         # Data flow connections\n├── data-items.json        # Data classifications (empty initially)\n├── README.md              # Auto-generated summary\n├── .dethereal\u002F            # Workflow metadata (per-model)\n│   ├── state.json         # Current workflow state\n│   ├── scope.json         # Scope definition (crown jewels, compliance)\n│   └── control-audit.log  # Append-only ledger of shared-ownership decisions\n│                          # (created on first \u002Fdethereal:enrich --focus controls; commit)\n├── attributes\u002F            # Security attributes (populated during enrichment)\n│   ├── boundaries\u002F\n│   ├── components\u002F\n│   ├── dataFlows\u002F\n│   └── dataItems\u002F\n└── controls\u002F              # Per-Control library files (created when first Control\n    └── ...                # is referenced by an element; one file per Control)\n",[37,681,679],{"__ignoreMap":84},[14,683,684,685,688],{},"The plugin also creates a project-level registry at ",[37,686,687],{},".dethernety\u002Fmodels.json"," that tracks all local models.",[68,690,692],{"id":691},"the-model-files","The Model Files",[26,694,695,701,707,713,719],{},[29,696,697,700],{},[32,698,699],{},"manifest.json"," — model metadata: name, description, which modules it uses",[29,702,703,706],{},[32,704,705],{},"structure.json"," — the hierarchy of trust boundaries and components with visual coordinates",[29,708,709,712],{},[32,710,711],{},"dataflows.json"," — directed connections between components (who talks to whom)",[29,714,715,718],{},[32,716,717],{},"data-items.json"," — what sensitive data flows carry (PII, credentials, etc.)",[29,720,721,724],{},[32,722,723],{},"attributes\u002F"," — per-element security properties (authentication, encryption, logging, etc.)",[14,726,727],{},"These are plain JSON files that work well with git — you can diff them, review them in PRs, and track changes over time.",[68,729,731],{"id":730},"the-metadata-directory","The Metadata Directory",[14,733,734,735,738],{},"The ",[37,736,737],{},".dethereal\u002F"," directory inside each model holds workflow state:",[26,740,741,747,753,759],{},[29,742,743,746],{},[32,744,745],{},"state.json"," — where you are in the modeling process (6 states from INITIALIZED to REVIEWED)",[29,748,749,752],{},[32,750,751],{},"scope.json"," — what you said about the system's crown jewels, compliance requirements, and trust assumptions",[29,754,755,758],{},[32,756,757],{},"quality.json"," — quality score cache (created after first quality check)",[29,760,761,764],{},[32,762,763],{},"sync.json"," — sync metadata (created after first platform push\u002Fpull)",[18,766],{},[21,768,770],{"id":769},"example-walkthrough","Example Walkthrough",[14,772,773],{},"Here's a complete first-model session:",[76,775,778],{"className":776,"code":777,"language":81},[79],"> \u002Fdethereal:create I have a React SPA, a Node.js API, and PostgreSQL\n\nI'll create a threat model for your system. Let me ask a few questions first.\n\nWhat are the most valuable assets in this system? (These are your \"crown jewels\"\n— the data or capabilities an attacker would target.)\n\n> User account data and session tokens\n\nAny compliance requirements? (e.g., SOC2, HIPAA, GDPR, PCI-DSS)\n\n> SOC2\n\nWhat do you explicitly trust? (e.g., cloud provider infrastructure, corporate VPN)\n\n> AWS infrastructure\n\nHere's what I've identified:\n\nComponents:\n  1. [PROCESS] React SPA — in DMZ\n  2. [PROCESS] Node.js API — in Internal Network\n  3. [STORE] PostgreSQL — in Data Tier\n  4. [EXTERNAL_ENTITY] End Users — in Internet Zone\n\nBoundaries:\n  Internet Zone \u002F DMZ \u002F Internal Network \u002F Data Tier\n\nData Flows:\n  1. End Users → React SPA: HTTPS requests\n  2. React SPA → Node.js API: Internal API calls\n  3. Node.js API → PostgreSQL: SQL queries\n\nConfirm or adjust?\n\n> confirm\n\n[done] Model \"My Web App\" created with 4 components, 3 data flows. Quality: 28\u002F100.\n[next] \u002Fdethereal:discover (scan codebase for additional infrastructure)\n",[37,779,777],{"__ignoreMap":84},[18,781],{},[21,783,785],{"id":784},"what-to-do-next","What to Do Next",[14,787,788],{},"After creating your model, you have two paths:",[68,790,792],{"id":791},"the-guided-workflow-recommended","The Guided Workflow (Recommended)",[14,794,464,795,798,799,387],{},[37,796,797],{},"\u002Fdethereal:threat-model"," to walk through all 11 steps — from discovery and classification through enrichment, validation, and platform sync. This is the most thorough approach and is recommended for new models. See ",[265,800,802],{"href":801},"\u002Fdethereal\u002Fguided-workflow","The 11-Step Guided Workflow",[68,804,806],{"id":805},"individual-commands","Individual Commands",[14,808,809],{},"Use individual commands to work on specific aspects:",[26,811,812,818,824,830],{},[29,813,814,817],{},[37,815,816],{},"\u002Fdethereal:discover"," — scan your codebase for infrastructure components the description missed",[29,819,820,823],{},[37,821,822],{},"\u002Fdethereal:classify"," — assign classes to components (enables security analysis)",[29,825,826,829],{},[37,827,828],{},"\u002Fdethereal:enrich"," — add security attributes (authentication, encryption, logging)",[29,831,832,835],{},[37,833,834],{},"\u002Fdethereal:review"," — check model quality and get recommendations",[14,837,838,839,843,844,847],{},"See the ",[265,840,842],{"href":841},"\u002Fdethereal\u002Fcommand-reference","Command Reference"," for all available commands, or run ",[37,845,846],{},"\u002Fdethereal:help"," for context-aware suggestions.",[18,849],{},[21,851,853],{"id":852},"version-control","Version Control",[14,855,856],{},"Since threat models are plain JSON files, commit them alongside your source code:",[76,858,860],{"className":90,"code":859,"language":92,"meta":84,"style":84},"git add threat-models\u002F .dethernety\u002Fmodels.json\ngit commit -m \"feat: initial threat model for web application\"\n",[37,861,862,876],{"__ignoreMap":84},[96,863,864,867,870,873],{"class":98,"line":99},[96,865,866],{"class":102},"git",[96,868,869],{"class":105}," add",[96,871,872],{"class":105}," threat-models\u002F",[96,874,875],{"class":105}," .dethernety\u002Fmodels.json\n",[96,877,878,880,883,886],{"class":98,"line":162},[96,879,866],{"class":102},[96,881,882],{"class":105}," commit",[96,884,885],{"class":240}," -m",[96,887,888],{"class":105}," \"feat: initial threat model for web application\"\n",[14,890,891,894,895,899,900,902],{},[32,892,893],{},"What to gitignore:"," per-user sync state, discovery provenance, and a few transient working files and backups. Copy the full list from ",[265,896,898],{"href":897},"\u002Fdethereal\u002Fsync-and-version-control#what-to-commit","What to Commit"," — and use its per-file rules rather than ignoring the whole ",[37,901,737],{}," directory.",[14,904,905,906,908],{},"Token storage (",[37,907,512],{},") is in your home directory, outside the repository — no gitignore entry needed.",[14,910,911,912,916],{},"See ",[265,913,915],{"href":914},"\u002Fdethereal\u002Fsync-and-version-control","Sync and Version Control"," for the full version control workflow.",[18,918],{},[14,920,921,924,925,927],{},[32,922,923],{},"Next:"," ",[265,926,802],{"href":801}," — walk through the complete modeling process",[929,930,931],"style",{},"html pre.shiki code .sYgZi, html code.shiki .sYgZi{--shiki-default:#24292E;--shiki-dark:#ADBAC7}html pre.shiki code .snmFh, html code.shiki .snmFh{--shiki-default:#005CC5;--shiki-dark:#8DDB8C}html pre.shiki code .s-HuK, html code.shiki .s-HuK{--shiki-default:#032F62;--shiki-dark:#96D0FF}html pre.shiki code .sviXB, html code.shiki .sviXB{--shiki-default:#005CC5;--shiki-dark:#6CB6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sOLd2, html code.shiki .sOLd2{--shiki-default:#6F42C1;--shiki-dark:#F69D50}html pre.shiki code .s7YZ4, html code.shiki .s7YZ4{--shiki-default:#D73A49;--shiki-dark:#F47067}html pre.shiki code .sDN9O, html code.shiki .sDN9O{--shiki-default:#6A737D;--shiki-dark:#768390}",{"title":84,"searchDepth":172,"depth":172,"links":933},[934,935,941,944,948,954,958,959,963],{"id":23,"depth":162,"text":24},{"id":65,"depth":162,"text":66,"children":936},[937,938,939,940],{"id":70,"depth":172,"text":71},{"id":139,"depth":172,"text":140},{"id":259,"depth":172,"text":260},{"id":323,"depth":172,"text":324},{"id":415,"depth":162,"text":416,"children":942},[943],{"id":460,"depth":172,"text":461},{"id":478,"depth":162,"text":479,"children":945},[946,947],{"id":494,"depth":172,"text":495},{"id":541,"depth":172,"text":542},{"id":567,"depth":162,"text":568,"children":949},[950,951,952,953],{"id":574,"depth":172,"text":575},{"id":602,"depth":172,"text":603},{"id":643,"depth":172,"text":644},{"id":656,"depth":172,"text":657},{"id":671,"depth":162,"text":672,"children":955},[956,957],{"id":691,"depth":172,"text":692},{"id":730,"depth":172,"text":731},{"id":769,"depth":162,"text":770},{"id":784,"depth":162,"text":785,"children":960},[961,962],{"id":791,"depth":172,"text":792},{"id":805,"depth":172,"text":806},{"id":852,"depth":162,"text":853},"Install the plugin, authenticate, and create your first threat model","md",{"category":967,"position":162,"tags":968},"documentation",[969,970,65,971],"dethereal","getting-started","tutorial","\u002Fdethereal\u002Fgetting-started",{"title":5,"description":964},"03.dethereal\u002F01.getting-started","432nhkG36dzGDFmHBBPUlLby8EL-RBCvehj6dsG1MX0",[977,1032,1067,1112,1146,1190,1205,1275],{"title":978,"description":979,"path":980,"stem":981,"children":982,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[983,987,992,997,1002,1007,1012,1017,1022,1027],{"title":984,"path":980,"stem":985,"description":986},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":988,"path":989,"stem":990,"description":991},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":993,"path":994,"stem":995,"description":996},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":998,"path":999,"stem":1000,"description":1001},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1003,"path":1004,"stem":1005,"description":1006},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1008,"path":1009,"stem":1010,"description":1011},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1013,"path":1014,"stem":1015,"description":1016},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1018,"path":1019,"stem":1020,"description":1021},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1023,"path":1024,"stem":1025,"description":1026},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1028,"path":1029,"stem":1030,"description":1031},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1033,"description":1034,"path":1035,"stem":1036,"children":1037,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1038,1042,1047,1052,1057,1062],{"title":1039,"path":1035,"stem":1040,"description":1041},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1043,"path":1044,"stem":1045,"description":1046},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1048,"path":1049,"stem":1050,"description":1051},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1053,"path":1054,"stem":1055,"description":1056},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1058,"path":1059,"stem":1060,"description":1061},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1063,"path":1064,"stem":1065,"description":1066},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1068,"description":1069,"path":1070,"stem":1071,"children":1072,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1073,1077,1078,1081,1084,1089,1094,1097,1102,1107],{"title":1074,"path":1070,"stem":1075,"description":1076},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":5,"path":972,"stem":974,"description":964},{"title":802,"path":801,"stem":1079,"description":1080},"03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":842,"path":841,"stem":1082,"description":1083},"03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1085,"path":1086,"stem":1087,"description":1088},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1090,"path":1091,"stem":1092,"description":1093},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":915,"path":914,"stem":1095,"description":1096},"03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1098,"path":1099,"stem":1100,"description":1101},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1103,"path":1104,"stem":1105,"description":1106},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1108,"path":1109,"stem":1110,"description":1111},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1113,"description":1114,"path":1115,"stem":1116,"children":1117,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1118,1121,1126,1131,1136,1141],{"title":1113,"path":1115,"stem":1119,"description":1120},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1122,"path":1123,"stem":1124,"description":1125},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1127,"path":1128,"stem":1129,"description":1130},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1132,"path":1133,"stem":1134,"description":1135},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1137,"path":1138,"stem":1139,"description":1140},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1142,"path":1143,"stem":1144,"description":1145},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1147,"description":1148,"path":1149,"stem":1150,"children":1151,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1152,1156,1161,1166,1171,1176,1180,1185],{"title":1153,"path":1149,"stem":1154,"description":1155},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1157,"path":1158,"stem":1159,"description":1160},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1162,"path":1163,"stem":1164,"description":1165},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1167,"path":1168,"stem":1169,"description":1170},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1172,"path":1173,"stem":1174,"description":1175},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1127,"path":1177,"stem":1178,"description":1179},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1181,"path":1182,"stem":1183,"description":1184},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1186,"path":1187,"stem":1188,"description":1189},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1191,"description":1192,"path":1193,"stem":1194,"children":1195,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1196,1200],{"title":1197,"path":1193,"stem":1198,"description":1199},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1201,"path":1202,"stem":1203,"description":1204},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1206,"description":1207,"path":1208,"stem":1209,"children":1210,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1211,1215,1220,1225,1230,1235,1240,1245,1250,1255,1260,1265,1270],{"title":1212,"path":1208,"stem":1213,"description":1214},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1216,"path":1217,"stem":1218,"description":1219},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1221,"path":1222,"stem":1223,"description":1224},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1226,"path":1227,"stem":1228,"description":1229},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1231,"path":1232,"stem":1233,"description":1234},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1236,"path":1237,"stem":1238,"description":1239},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1241,"path":1242,"stem":1243,"description":1244},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1246,"path":1247,"stem":1248,"description":1249},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1251,"path":1252,"stem":1253,"description":1254},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1256,"path":1257,"stem":1258,"description":1259},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1261,"path":1262,"stem":1263,"description":1264},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1266,"path":1267,"stem":1268,"description":1269},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1271,"path":1272,"stem":1273,"description":1274},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1276,"description":1277,"path":1278,"stem":1279,"children":1280,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1281,1285,1290],{"title":1282,"path":1278,"stem":1283,"description":1284},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1286,"path":1287,"stem":1288,"description":1289},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1291,"path":1292,"stem":1293,"description":1294},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184212]