<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Building Threat Scenario Libraries — API Reference

## agent.js CLI

```bash
node scripts/agent.js --action init --query web
node scripts/agent.js --action create --input scenario.json
node scripts/agent.js --action validate --input library.json
node scripts/agent.js --action search --query T1190 --input library.json
node scripts/agent.js --action report --input library.json --output report.json
```

## Scenario JSON Schema

```json
{
  "id": "TS-WEB-001",
  "title": "SQL Injection to Data Exfiltration",
  "domain": "web",
  "actor": "apt | cybercrime | insider | hacktivist",
  "mitre_techniques": ["T1190", "T1059.007"],
  "impact": "critical | high | medium | low",
  "likelihood": "high | medium | low",
  "mitigations": ["Input validation", "WAF rules"],
  "status": "draft | reviewed | approved"
}
```

## Supported Domains

| Domain | Seeded ATT&CK Techniques |
|--------|--------------------------|
| web | T1190, T1059.007, T1071.001, T1078, T1110 |
| cloud | T1078.004, T1537, T1580, T1552.005, T1098 |
| mobile | T1474, T1407, T1417, T1421, T1516 |
| iot | T0800, T0836, T0855, T0862, T0882 |
