<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Behavioral Detection Models

## Agent Tools

| Tool | Description |
|---|---|
| Baseline Builder | `build_baseline(data, feature)` — Statistical profiling |
| Anomaly Scorer | `score_anomaly(value, mean, std)` — Z-score detection |
| Risk Aggregator | `aggregate_risk(scores)` — Entity risk scoring |

## CLI Usage

```bash
# Build baseline
node agent.js baseline --data '[8, 9, 10, 9, 8]' --feature login_hour

# Score anomaly
node agent.js score --value 23 --mean 9.0 --std 1.5

# Aggregate risk
node agent.js risk --scores '[{"risk_score": 7.2}]'
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
