<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Container Detection Rules

## Agent Tools

| Tool | Description |
|---|---|
| Author Rule | `author_rule(name, condition, priority)` — Author a Falco container detection rule. |
| Validate Rules | `validate_rules(rules_path)` — Validate Falco rules file syntax. |
| Scan Image | `scan_image(image)` — Scan a container image for vulnerabilities. |

## CLI Usage

```bash
# Author rule
node agent.js author --name "Container Escape" --condition "spawned_process and container and proc.name=nsenter" --priority critical
```

```bash
# Validate rules
node agent.js validate --rules-path rules/container_rules.yaml
```

```bash
# Scan image
node agent.js scan --image nginx:latest
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
