Skip to main content
When Oplane is connected to your AI assistant over MCP, you can ask it questions about your organisation’s threat models, security requirements, and workspaces in plain language. It can count and break down findings, show how they change week by week, work out how long fixes take, and pull up the exact requirements behind a number with links into Oplane. Use it when the Analytics dashboard doesn’t show the view you need, or when you want the answer without leaving the tool you’re already working in.
The video uses made-up data for an example organisation called Acme. It shows an AI assistant connected to Oplane MCP, answering three questions.
  1. You ask “Break down our open requirements by severity.” The assistant calls the analyze tool and answers that Acme has 214 open requirements, 79 of them critical or high. A table lists 18 critical, 61 high, 84 medium, 40 low, and 11 info.
  2. You ask “How many new requirements did we get each week since August?” The assistant calls analyze and answers that Acme got 395 new requirements since 3 August. A weekly table shows between 19 and 28 new requirements a week until the week of 14 September, then between 58 and 71 a week. Most of them are already resolved.
  3. You ask “For each workspace, how many requirements from the last 3 months are open and how many are resolved?” The assistant calls analyze and get_workspaces and answers that 455 requirements came in and 85% of them are resolved. A table lists each workspace, and acme/checkout-web has the most still open, 29 out of 150.
The video ends on an empty message box that asks “What’s your question?”

​
Before you start

This works in any AI assistant that supports MCP, whether that’s an IDE like Cursor, a terminal tool like Claude Code or Codex, or a chat app like Claude. If you already use Oplane MCP for threat modeling, you’re set, because the same server answers these questions. If not, add the Oplane MCP server to your assistant first. Answers only cover workspaces you have access to, so two people asking the same question can get different numbers. An org admin sees every shared and repository workspace in the organisation, while an org member sees the workspaces they have access to. See Roles and permissions for how access works. Each question covers one organisation. If you belong to more than one, name the organisation in your prompt. Otherwise Oplane returns a list of your organisations, so your assistant can pick one or ask you. To ask from a CI pipeline or a script, use an application with Read on Contents.

​
What you can ask

​
How your assistant gets the answer

For counts, breakdowns, trends, and durations, your assistant calls the analyze tool. Oplane computes the result on its side and returns just the numbers, so one call covers thousands of requirements without your assistant reading through them. A breakdown can split the results by up to two things at once, such as workspace and open or resolved, and group dates by day, week, or month. A breakdown returns the top 20 groups by default and up to 100 if you ask for more. To show the records themselves, your assistant first finds the matching threat models, requirements, or workspaces, and then fetches their details. Each record includes a link that opens it in the Oplane app. See How read tools work for the details.

​
How Oplane counts

A requirement counts as open while it’s not assessed, not implemented, or partially implemented. It counts as resolved once it’s implemented, accepted as a risk, out of scope, or not applicable. See Statuses and severity for what each status means. Time to resolve runs from when Oplane created the requirement to the first time it reached a resolved status. If it later goes back to open, the first resolution still counts. When you ask about threat models from pull requests, Oplane only counts pull requests that merged into the repository’s production branch, which is the repository’s default branch unless your team set another one. That way the numbers reflect code that shipped. To include pull requests that are still open or never merged, say so in your prompt, for example Include all pull requests, merged or not.
  • Analytics, for the organisation and workspace dashboards in the Oplane app.
  • MCP tools, for every tool your assistant can call.
  • Statuses and severity, for what each status and severity counts as.