Tachi

What it is

Tachi (repo davidmatousek/tachi) is a Claude Code plugin that threat-models an architecture description rather than source code. The summary covers its taxonomy and outputs; what it does not tell you is how to stand it up, what it depends on, and the actual command surface — which is what an engineer deciding to try it needs.

Preconditions

• Claude Code, installed as agents + slash commands into a project's .claude/ directory.
• Two required external CLIs for full functionality: typst (compiles the PDF security report) and @mermaid-js/mermaid-cli / mmdc (renders attack-path diagrams). /tachi.security-report aborts at preflight with an install hint if either is missing when attack-trees are present.
• Optional: GEMINI_API_KEY (from Google AI Studio) only if you want .jpg infographic images; all text outputs work without it.
• A docs/security/architecture.md describing your system in any of five auto-detected formats (Mermaid, free-text, ASCII, PlantUML, C4).

What to do

Install dependencies (macOS shown; page also gives Debian/Ubuntu and WSL variants):

brew install typst
npm install -g @mermaid-js/mermaid-cli

Clone and install into your project:

git clone https://github.com/davidmatousek/tachi.git ~/Projects/tachi
~/Projects/tachi/scripts/install.sh

Pin a version or point at a non-default clone location:

~/Projects/tachi/scripts/install.sh --version v4.48.0
~/Projects/tachi/scripts/install.sh --source /path/to/tachi

Restart Claude Code after install (reopen the VS Code window or start a new CLI session) so it picks up the new agents and commands — otherwise nothing registers. Then run the single entry command:

/tachi.threat-model

Five post-pipeline commands enrich results: /tachi.risk-score, /tachi.compensating-controls, /tachi.infographic, /tachi.security-report, /tachi.architecture (the last auto-generates the architecture description if you don't want to write it by hand).

Caveats

• The "50/50 across five frameworks" claim is the vendor's own coverage attestation (docs/standards/OWASP_COVERAGE.md, sample reports under examples/*/sample-report/); the Web/API slot is one combined 20-item bucket, not two independent tens.
• It analyzes an architecture description you supply — coverage is only as good as that document. It reasons over logic-level risks and explicitly does not replace SAST/SCA/secrets scanning; it runs as a parallel column.
• Report generation hard-fails without typst/mmdc present, so budget for those installs before relying on PDF/diagram output.