<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Threat-Informed Detections

## Agent Tools

| Tool | Description |
|---|---|
| TTP Extractor | `extract_ttps(report)` — Parse TTPs from CTI text |
| Coverage Checker | `check_coverage(ttps, rules)` — Identify gaps for TTPs |
| Actor Profiler | `build_actor_profile(actor, ttps, sectors)` — Threat actor mapping |

## CLI Usage

```bash
# Extract TTPs
node agent.js extract --report "The actor used T1566.001 and T1059.001"

# Check coverage
node agent.js coverage --ttps '["T1566.001"]' --rules '{"T1566.001": 3}'

# Build profile
node agent.js profile --actor APT29 --ttps '["T1566.001"]' --sectors '["government"]'
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
