<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detection Coverage Analysis

## Agent Tools

| Tool | Description |
|---|---|
| Coverage Mapper | `map_coverage(rules)` — Map to ATT&CK |
| Gap Finder | `find_gaps(coverage, priority)` — Identify blind spots |
| Heatmap Generator | `generate_heatmap_data(coverage)` — Visualization data |

## CLI Usage

```bash
# Map coverage
node agent.js map --rules '[{"tags": ["attack.t1059.001"]}]'

# Find gaps
node agent.js gaps --coverage '{"T1059.001": 3}' --priority '["T1059.001", "T1078"]'

# Heatmap
node agent.js heatmap --coverage '{"T1059.001": {"score": 3}}'
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
