<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing Cloud Threat Modeling — API Reference

## agent.js CLI

```bash
node scripts/agent.js --action enumerate --input cloud_config.json
node scripts/agent.js --action analyze --input cloud_config.json
node scripts/agent.js --action threats --input assets.json
node scripts/agent.js --action report --input threats.json --output report.json
```

## Cloud Threat Categories

| Category | Example Threats |
|----------|----------------|
| iam | Over-privileged roles, missing MFA |
| network | Public exposure, unrestricted SGs |
| storage | Public buckets, unencrypted data |
| compute | SSRF via IMDS, root containers |
| logging | Disabled audit logs, mutable storage |

## Cloud Config JSON Schema

```json
{
  "services": [
    {"name": "prod-api", "provider": "aws", "category": "compute", "public": true, "encrypted": false}
  ]
}
```
