<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detection-as-Code Frameworks

## Agent Tools

| Tool | Description |
|---|---|
| Repo Scaffolder | `scaffold_repo(name, tactics)` — Create DaC structure |
| Pipeline Validator | `validate_pipeline(dir)` — Run CI validation |
| CI Config Gen | `generate_ci_config(platform, siem)` — Build pipeline config |

## CLI Usage

```bash
# Scaffold repo
node agent.js scaffold --name "detections" --tactics '["execution"]'

# Validate
node agent.js validate --rules-dir rules/

# CI config
node agent.js ci-config --platform github_actions --siem splunk
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
