Home

Welcome to TMI

TMI (Threat Modeling Improved) is a collaborative threat modeling platform that makes security analysis easier, faster, and more accurate.

Try it yourself at https://www.tmi.dev

What is TMI?

TMI is a server-based web application that enables collaborative threat modeling with:

• Real-time collaborative diagram editing via WebSockets
• Role-based access control (reader, writer, owner)
• OAuth and SAML authentication
• Multiple threat model frameworks (STRIDE, CIA, etc.)
• Extensive extensibility
  • Rich metadata support allows you to add your own data to any TMI object
  • Webhooks allow your helper apps to subscribe to TMI object change notifications and take action
  • Addons allow your webhook helper apps to be invoked from the TMI web application
  • REST API all TMI functionality is accessible via the REST API
    • OpenAPI specification is used to build the TMI server; you can use it to generate your own clients
    • Pre-generated clients in Go, Python and Javascript

Component Ecosystem

TMI consists of multiple integrated components:

Core Components

• TMI Server - Go-based backend API server

  • REST API specified in OpenAPI 3.0
  • WebSocket support for real-time collaboration
  • PostgreSQL database with Redis caching
  • OAuth 2.0 & SAML authentication

• TMI-UX - Angular/TypeScript web application

  • Modern, responsive user interface
  • Real-time collaborative editing
  • Diagram editor with data flow visualization
  • Markdown notes with Mermaid support

Additional Components

• TMI Clients - API client libraries

  • Multiple language support
  • Simplified API integration

• TMI Terraform Analyzer - Infrastructure analysis tool

  • Automated Terraform code analysis
  • AI-powered security insights
  • Integration with threat models

• TMI Promtail Logger - Logging integration

  • Sends TMI logs to Grafana via Loki
  • Centralized log management

Quick Navigation by Role

I want to use TMI

Go to: Getting Started

Learn how to:

• Access TMI at tmi.dev
• Create threat models
• Build data flow diagrams
• Manage threats
• Collaborate with your team

I want to deploy TMI

Go to: Deployment

Learn how to:

• Plan your deployment architecture
• Deploy TMI Server
• Deploy TMI Web Application
• Set up authentication
• Configure databases
• Integrate components

I want to operate TMI

Go to: Operation

Learn how to:

• Monitor system health
• Manage databases
• Ensure security
• Scale your deployment
• Perform maintenance

I want to develop/extend TMI

Go to: Development

Learn how to:

• Set up development environment
• Understand architecture
• Integrate with APIs
• Write tests
• Contribute code
• Build extensions

I need help

Go to: Troubleshooting

Find solutions for:

• Authentication problems
• Connection issues
• WebSocket problems
• Database issues
• Performance problems

Key Features

Collaborative Threat Modeling

• Real-time editing with multiple users
• WebSocket-based synchronization
• Role-based permissions
• Conflict-free collaborative editing

Flexible Data Model

• Multiple threat model frameworks (STRIDE, CIA, etc.)
• Extensible metadata on all objects
• Custom properties and tags
• Rich markdown notes with Mermaid diagrams

Comprehensive API

• RESTful API with OpenAPI 3.0 spec
• WebSocket API with AsyncAPI spec
• OAuth 2.0 authentication
• Multi-language client libraries

Enterprise-Ready

• PostgreSQL for reliable data storage
• Redis for caching and real-time coordination
• Horizontal scalability
• Container deployment support
• Comprehensive monitoring and logging

Architecture Overview

┌─────────────────┐
│   TMI Web App   │  (Angular/TypeScript)
│    (tmi-ux)     │
└────────┬────────┘
         │ HTTPS/WSS
         ▼
┌─────────────────┐
│   TMI Server    │  (Go)
│     (tmi)       │
└────────┬────────┘
         │
    ┌────┴────┐
    ▼         ▼
┌──────┐  ┌───────┐
│ PgSQL│  │ Redis │
└──────┘  └───────┘

Documentation Structure

This wiki is organized by task area, aligned with different audiences:

1. Getting Started - For end users learning to use TMI
2. Deployment - For operators deploying TMI
3. Operation - For SREs/DevOps running TMI
4. Troubleshooting - For everyone solving problems
5. Development - For contributors and integrators
6. Integrations - For power users and developers
7. Tools - For using TMI utilities
8. API Reference - For API integration
9. Reference - For quick lookup

Getting Started

For End Users

1. Visit tmi.dev to use the hosted version
2. Read Creating Your First Threat Model
3. Explore Working with Data Flow Diagrams

For Self-Hosted Deployment

1. Review Planning Your Deployment
2. Follow Deploying TMI Server
3. Configure Setting Up Authentication

For Developers

1. Set up your Development Environment
2. Understand the Architecture and Design
3. Review API Integration guide

Community & Support

• GitHub Issues: Report bugs or request features in component repositories
• Discussions: Join conversations about TMI development and usage
• API Documentation: http://api-docs.tmi.dev.s3-website-us-east-1.amazonaws.com
• OpenAPI Specification: tmi-openapi.json

License

TMI is licensed under the Apache License 2.0, allowing for customization and commercial use.

See license.txt for details.