Convert ArchiMate 3.x architecture models into threat-modeling artifacts, preserving logical trust zones, host containment, and connection semantics. Two output targets ship: IriusRisk-compatible draw.io and OWASP Threat Dragon v2 JSON. The codebase is structured so further targets slot in without rework.
Threat-modeling tools that consume diagrams expect specific input formats (draw.io for IriusRisk, .tm7 for Microsoft TMT, JSON for OWASP Threat Dragon). None ingest ArchiMate directly. Organizations doing serious EA in ArchiMate (TOGAF, BiZZdesign, Sparx EA) have no path from authoritative architecture into their threat model except manual reconstruction. archithreat closes that gap.
Architecture models for critical infrastructure describe attack surfaces and frequently cannot leave their owning organization. archithreat ships three surfaces, no hosted service:
- CLI — local conversion for engineers and CI pipelines.
- Browser app — static site (Pyodide); runs entirely in your browser, no upload.
- Self-hosted container — FastAPI image you run inside your trust zone.
pip install archithreat[cli]
archithreat convert input.xml output.drawio --target iriusrisk
archithreat convert input.xml output.json --target threatdragon
archithreat targetsOpen the published GitHub Pages site, drop your .xml in, pick a target from the dropdown, download the .drawio or .json. Nothing leaves your browser.
docker run --rm -p 8000:8000 ghcr.io/rondlite/archithreat:latest
# open http://localhost:8000- docs/concepts.md — modeling discipline behind the conversion
- docs/mapping-table.md — YAML schema + customization
- docs/patterns.md — supported patterns
- docs/limitations.md — known gaps and future work
- docs/self-hosting.md — Docker deployment
- docs/browser.md — browser app capabilities
- docs/privacy.md — what each surface does and does not see
- docs/targets.md — supported output targets
- docs/adding-a-target.md — contributor guide for new emitters
v3.2.0. See CHANGELOG.md and ROADMAP.
Apache 2.0 — see LICENSE. For third-party / vendored components and their licenses (Pyodide, drawio viewer, HTMX, declared Python deps), see SBOM.md.