<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Threat Model Review Process — API Reference

## agent.js CLI

```bash
node scripts/agent.js --action assess --input threat_model.json
node scripts/agent.js --action validate --input threat_model.json
node scripts/agent.js --action gates --input threat_model.json
node scripts/agent.js --action report --input threat_model.json --output review.json
```

## Quality Gates

| Gate | Stage | Checks |
|------|-------|--------|
| completeness | Design | has_dfd, has_components, has_data_flows, has_trust_boundaries |
| coverage | Development | stride_applied, boundary_crossings_covered |
| mitigations | Pre-release | high_threats_mitigated, critical_threats_mitigated |
| validation | Release | mitigations_tested, test_evidence_linked |

## Threat Model JSON Schema

```json
{
  "last_updated": "2025-01-15",
  "components": [{"name": "API Gateway"}],
  "threats": [{"id": "T-001", "mitigations": ["WAF"]}],
  "has_dfd": true,
  "has_components": true
}
```
