Skip to main content
The Oplane plugin gives your AI assistant Oplane’s threat modeling skills, a security agent, and a connection to the Oplane MCP server. This page describes what the plugin contains and what it sends to Oplane, and helps you fix common problems. To install the plugin, follow the steps for your tool in Threat model from your IDE.

​
What the plugin contains

How you start a skill depends on your tool. In Claude Code you type /oplane:analyze or /oplane:analyze-pr, and in Cursor /analyze or /analyze-pr. Codex and opencode pick the skill from your request, so you can ask them to analyse the project or a pull request for security threats.

​
Sign in

The Oplane MCP server signs you in with OAuth. When you connect the server in your tool, a browser window opens where you log in to Oplane, and tokens are then issued and refreshed for you. There are no tokens to copy. To use the plugin from a CI pipeline or another tool where nobody signs in, create an application and connect with its API key.

​
What the plugin sends to Oplane

When you run an analysis, your assistant sends Oplane the title and description of the code or change it’s threat modeling, which can include short code excerpts. It also sends git details, such as the repository URL, branch, commit SHA, and pull request URL, and the assessment it records for each security requirement, with file and line references. The plugin sends nothing to any other service. It has no hooks or scripts that run on your machine, because the skills and the agent are instructions your assistant follows. Oplane stores the results in your account as described in the privacy policy.

​
Source code and license

The plugin is open source under the Apache License 2.0. You can read every skill and configuration file in the oplane/oplane-plugin repository on GitHub.

​
Troubleshooting

​
The assistant says the Oplane tools aren’t available

The skills stop if they can’t reach the Oplane MCP server, so check the connection in your tool and sign in again if it asks you to.

​
The threat model isn’t where you expected

Oplane adds threat models you create from your assistant to your personal workspace unless you name another workspace in your prompt. See Choosing a workspace.

​
Get help

If something isn’t working as expected and isn’t covered above, email support@oplane.io. Tell us which AI assistant you use, what you asked it to do, what you expected, and what happened instead.