AI Agent for Security User Story Generation from Cornucopia

Development teams using OWASP Cornucopia for threat modelling have no automated way to turn played cards into actionable Jira user stories - this translation is done manually, inconsistently, and often skipped altogether. This project builds a proof-of-concept AI agent that closes that gap. Given a card ID from a played session, the agent calls the Cornucopia REST API, retrieves semantically similar context from a Qdrant vector store, and uses Google Gemini to generate a security requirement, a Gherkin user story, and two BDD test cases. A human reviewer approves the output before any Jira ticket is created - keeping security decisions with the team. Deliverables: a working end-to-end pipeline with Jira integration, human-in-the-loop review, unit and integration tests, and full setup and usage documentation. The foundation is designed to continue developing beyond GSoC.