<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Email Detection Rules

## Agent Tools

| Tool | Description |
|---|---|
| Author Rule | `author_rule(name, threat_type, conditions)` — Author an email detection rule. |
| Analyze Headers | `analyze_headers(eml_path)` — Analyze email headers for threat indicators. |
| Check Url | `check_url(url)` — Check a URL against reputation services. |

## CLI Usage

```bash
# Author rule
node agent.js author --name "BEC Executive Spoof" --threat-type bec --conditions "display_name_match" "external_sender" "dmarc_fail"
```

```bash
# Analyze headers
node agent.js analyze --eml-path samples/phish.eml
```

```bash
# Check URL
node agent.js check-url --url "https://suspicious-domain.com/login"
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
