runThreatModelWorkflow

Signature

function runThreatModelWorkflow(
  input: ThreatModelWorkflowInput,
): Promise<ThreatModelWorkflowResult>;

Analyzes a codebase with Apex’s built-in threat-model skill and writes a Markdown threat model to outputPath. This is what pensar threat-model runs. Pass the result to runPentestAgent as threatModel to steer a pentest.

Import

import { runThreatModelWorkflow } from "@pensar/apex/core/api";

Parameters

codebasePath

stringRequired

Path to the codebase to analyze.

outputPath

stringRequired

Where to write the threat model Markdown file.

model

AIModelDefaults to claude-sonnet-4-5

Model ID. See Models.

authConfig

AIAuthConfig

AI provider credentials.

session

SessionInfo

Session to reuse. One is created when omitted.

eventBus

AgentEventBus

Streaming events. See AgentEventBus.

abortSignal

AbortSignal

Cancels the run.

reasoning

ReasoningSetting

Extended-thinking setting. See Reasoning.

Returns

Promise<ThreatModelWorkflowResult>

outputPath

string

Absolute path of the written threat model.

session

SessionInfo

The session used, whether provided or created.

Example

Threat model, then pentest

import { readFileSync } from "node:fs";
import { buildAuthConfig } from "@pensar/apex/core/ai";
import { runPentestAgent, runThreatModelWorkflow } from "@pensar/apex/core/api";
import { config } from "@pensar/apex/core/config";
import { sessions } from "@pensar/apex/core/session";
const authConfig = buildAuthConfig(await config.get());
const model = "claude-opus-4-6";
const { outputPath } = await runThreatModelWorkflow({
  codebasePath: "./my-app",
  outputPath: "./threat-model.md",
  model,
  authConfig,
});
const target = "http://localhost:3000";
await runPentestAgent({
  target,
  cwd: "./my-app",
  session: await sessions.create({ name: "Threat-model-guided", targets: [target] }),
  model,
  authConfig,
  threatModel: readFileSync(outputPath, "utf8"),
});