<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Blast Radius Analysis — API Reference

## agent.js CLI

```bash
# Analyze blast radius for a target system
node scripts/agent.js --action analyze --target web-api-01 --scenario rce

# Map system dependencies
node scripts/agent.js --action dependencies --target web-api-01

# Score blast radius from scenario file
node scripts/agent.js --action score --scenario scenario.json

# Generate containment plan
node scripts/agent.js --action contain --target web-api-01 --scenario rce --output plan.json
```

## Scenario Types

| Type | Description | Typical Score |
|------|-------------|---------------|
| `rce` | Remote Code Execution | 5.5 |
| `credential_compromise` | Credential theft/leak | 6.5 |
| `supply_chain` | Supply chain compromise | 8.3 |
| `misconfiguration` | Security misconfiguration | 3.8 |

## Blast Radius Dimensions

| Dimension | Weight | Description |
|-----------|--------|-------------|
| Direct Impact | 2 | Systems immediately affected |
| Lateral Reach | 3 | Reachable systems via trust/network |
| Data Exposure | 4 | Accessible data and classification |
| Privilege Level | 3 | Attainable permissions |
| Detection Gap | 2 | Inverse of detection probability |
| Recovery Cost | 1 | Difficulty restoring to known-good |

## Infrastructure Discovery Commands

```bash
# AWS — Map IAM role trust
aws iam list-roles --query 'Roles[].{Name:RoleName,Trust:AssumeRolePolicyDocument}'

# AWS — Map security group access
aws ec2 describe-security-groups --query 'SecurityGroups[].{Name:GroupName,Ingress:IpPermissions}'

# Kubernetes — Map service dependencies
kubectl get services -A -o json | jq '.items[] | {name:.metadata.name,selector:.spec.selector}'

# Kubernetes — Map network policies
kubectl get networkpolicy -A -o yaml
```

## Risk Level Thresholds

| Score | Level | Response |
|-------|-------|----------|
| ≥ 8.0 | Critical | Immediate IR activation |
| ≥ 6.0 | High | Priority remediation |
| ≥ 4.0 | Medium | Planned mitigation |
| < 4.0 | Low | Monitor and review |
