Skip to main content
This guide covers how to respond to security requirements Oplane raises on your pull requests (GitHub) or merge requests (GitLab), and how to run threat modeling locally before pushing.

​
Responding to requirements

When Oplane reviews your PR/MR, it posts a comment with security requirements. You have several ways to respond:

​
Fix the issue

Implement the security requirement in your code and push a new commit. Oplane will re-analyse the PR/MR automatically and update the requirement status.

​
Use MCP tools in your IDE

If you have Oplane connected via MCP, you can interact with requirements directly from your editor:

​
Re-trigger a review

After making changes, you can re-trigger Oplane’s analysis by commenting on the PR or MR:
  • @oplane review
  • oplane review
Alternatively, pushing a new commit triggers a review automatically (if your workspace is configured for automatic reviews).
Assessments you’ve manually set (via MCP or the dashboard) are preserved across re-analyses unless the underlying code contradicts them.

​
Running local checks

You can run threat modeling locally before pushing, catching issues early in your development workflow.

​
Using MCP in your IDE

With Oplane connected via MCP (in Cursor, GitHub Copilot, Claude Code, or another MCP-compatible tool), you can create a threat model for your current changes:
  1. Describe your changes — Tell your AI assistant what you’re working on and ask it to use Oplane to create a threat model.
  2. Review requirements — Oplane generates security requirements specific to your described changes.
  3. Get implementation advice — For each requirement, ask for guidance on how to implement it in your codebase.
  4. Record your assessment — Mark each requirement as implemented, accepted risk, or not applicable.

​
Quick reference: local MCP workflow

Use the guided prompt autonomous_threat_modeling to have your AI assistant run the entire workflow end-to-end automatically.

Statuses & Severity

Reference for what each status icon, severity level, and check status means.