<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — False Positive Analysis

## Agent Tools

| Tool | Description |
|---|---|
| FP Rate Analyzer | `analyze_fp_rate(rule, total, tp)` — Calculate FP severity |
| FP Categorizer | `categorize_fp(samples)` — Root cause analysis |
| Filter Generator | `generate_filter(field, values)` — Create exclusion filters |

## CLI Usage

```bash
# Analyze FP rate
node agent.js rate --rule 5e1c0d42 --total 200 --tp 130

# Categorize
node agent.js categorize --samples '[{"cause": "environmental"}]'

# Generate filter
node agent.js filter --field SourceImage --values '["\\backup.exe"]'
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
