<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Security Program Strategy

## Agent Tools

| Tool | Description |
|---|---|
| Maturity Assessor | `assess_maturity(scores)` — Evaluate maturity across NIST CSF functions |
| Roadmap Generator | `generate_roadmap(gaps, years)` — Build phased improvement plan |
| Charter Builder | `build_charter(org, ciso)` — Generate program charter template |

## CLI Usage

```bash
# Assess maturity
node agent.js assess --scores '{"governance": 2, "detection": 1}'

# Generate roadmap
node agent.js roadmap --gaps '{"detection": 1}' --years 3

# Build charter
node agent.js charter --org "Acme" --ciso "Jane"
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
