Skip to content

Back to the catalog

Precogly
github.comrepo

Precogly

Precogly is an open-source, now-OWASP threat modeling platform (React/TypeScript frontend, Django REST Framework/PostgreSQL backend) offering a collaborative DFD editor with trust zones, TM-BOM import/export, and community library packs linked to MITRE ATT&CK, CAPEC, STRIDE, and LINDDUN. It's positioned as compliance-aware, tracing threats and countermeasures to DORA, the EU Cyber Resilience Act, ASVS, NIST CSF, and SOC 2, and exposes a full OpenAPI REST API meant as scaffolding for AI-driven threat modeling assistants.

TL;DR Open-source, OWASP-backed threat modeling tool with a DFD editor, taxonomy-linked library packs, and compliance framework traceability.
Open original ↗
Document

What it is

Precogly is an Apache 2.0 threat modeling platform that joined OWASP as a project. The page shows release v0.4.0 (September 2026), which adds MCP and AI agent support. The stack is React 19, TypeScript, Tailwind CSS, shadcn/ui and React Flow on the frontend, and Django 5.2, Django REST Framework and PostgreSQL 16 on the backend. Production uses Docker and nginx.

What to do

To try it locally, clone the tagged release and start it with Docker Compose:

git clone --branch v0.4.0 https://github.com/precogly/precogly.git
cd precogly
docker compose up --build

Open http://localhost:5173 and log in with admin@precogly.dev / admin123. The seed also creates two more demo accounts, so roles and multi-tenancy can be tried locally. The seed prints all three accounts when it finishes. These are demo credentials, so change or remove them before exposing any instance beyond a local machine.

Roadmap and fit

Releases already shipped: 0.3 (DFD editor features, July 2026) and 0.4 (MCP and AI agents support, September 2026). Planned releases:

  • 0.5: program management, with reporting on risk ownership, treatment status and overdue actions by business unit, team and product. It also aligns the system model with the TM-BOM System concepts in the upcoming CycloneDX 2.0.
  • 0.6: a risk register that combines risks from threat modeling, vulnerabilities and assessments, with owners, treatment decisions and residual risk. It also adds risk assessment reports for compliance, including the EU CRA.
  • 0.7: security controls management, with verification steps, evidence recording, and control libraries at product and organization levels. Integrations start with GitHub and DefectDojo, and ISO/IEC 27034 concepts are applied.

Until those land, the risk register, evidence tracking and tool integrations are not available. The current value is the DFD editor, library packs and collaboration workspace. The editor supports nested components, typed zones, boundaries and flows. Packs exist for AWS, Azure, GCP, banking and compliance frameworks. TM-BOM style JSON import and export is the interoperability path with other tools.

Caveats

The page does not describe how the MCP support works, what the API covers beyond "full OpenAPI docs", or how mature the packs are. It gives no benchmarks, scale limits or hardening guidance for production beyond naming nginx. The page says it is designed for enterprise workflows but that smaller organizations can also use the editor, packs and workspace. The authors argue that AI is better used ahead of time to build curated threat libraries linked to standards than on a live system during modeling, because it gives fewer hallucinations and more consistency. This is the project's own position, not a tested result.

Organisations named here

  • ASVS
  • DORA
  • EU Cyber Resilience Act
  • STRIDE

Technologies named here

  • Precogly
  • Docker
  • nginx
  • Django 5.1 / Django REST Framework
  • PostgreSQL 16
  • React
  • TypeScript
  • Django
  • PostgreSQL
  • MITRE ATT&CK
  • OWASP
  • NIST CSF
  • SOC 2

Techniques named here

  • STRIDE
  • LINDDUN
  • MITRE ATT&CK
  • CAPEC
  • CWE

Related in AppSec