add_attacker
Add a new attacker to a threat model. Creates a new version.
Instructions
Add a new attacker to a threat model. Creates a new version.
Authoring contract: capability names the operations the
attacker can perform from its position and what they achieve —
not just the access or vantage point. Phrase it as "From
[position], the attacker can [concrete operations] …" (e.g. "From
the network path between the API server and the database, the
attacker can read and alter requests and responses to exfiltrate
data in transit or inject forged responses"). A capability that
states only access is flagged with a quality_warning and the
control objectives derived from it may be under-specified.
The caller supplies identity-bearing fields (capability, position,
archetype, trust_boundary_ids); the backend LLM-reasons the factor
decomposition. Override any factor post-create via edit_attacker
with a change_reason. Mirror of add_asset semantics.
Three outcomes (normal create / auto-restore / similar-rejection)
mirror add_asset. 503 on factor-reasoning or restore-candidate
evaluator outage, 502 on malformed restore-candidate response.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| model_id | Yes | ID of the threat model. | |
| position | No | Position/access level. | |
| archetype | No | Archetype (e.g., "insider", "external"). | |
| capability | Yes | Attacker capability description (required). | |
| server_version | Yes | ||
| trust_boundary_ids | No | Comma-separated trust boundary IDs. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||