Quick Start: Client-Led Loop

Prefer to drive the LLM call yourself (a custom agent, the bundled example agent script, or any MCP client)? Use the ingest → loop → report workflow instead.

1. Fetch the ruleset

curl http://localhost:8000/terraform-plan/rules > rules.md

2. Ingest a plan

curl -X POST http://localhost:8000/terraform-plan/my-namespace/ingest \
  -H "Content-Type: text/plain" \
  --data-binary @terraform_plan.txt

Response:

[
  {
    "hash": "9c2a7e1f...",
    "type": "aws_iam_role",
    "name": "ci_deploy",
    "action": "update",
    "body": "resource \"aws_iam_role\" \"ci_deploy\" { ... }",
    "metadata": {}
  }
]

3. Poll and submit analysis

# Get next resource
curl http://localhost:8000/my-namespace/resource/next

# Submit analysis  (HTTP 208 means all done)
curl -X PUT http://localhost:8000/resource/9c2a7e1f.../analysis \
  -H "Content-Type: application/json" \
  -d '{
    "summary": "Trust policy allows any AWS principal to assume this role.",
    "findings": [{
      "title": "Overly permissive trust policy",
      "severity": "CRITICAL",
      "rule_id": "TFSEC-030",
      "risk": "Any AWS account can assume this role.",
      "why_it_matters": "A wildcard trust principal is a direct path to account compromise.",
      "suggested_next_step": "Scope Principal to your actual CI provider/account ARN.",
      "confidence": "HIGH",
      "evidence": ["\"Principal\": {\"AWS\": \"*\"}"],
      "resource_address": "aws_iam_role.ci_deploy",
      "tags": ["iam", "privilege-escalation"]
    }]
  }'

4. Get the report

# Markdown
curl "http://localhost:8000/my-namespace/report?raw=true"

# HTML
curl "http://localhost:8000/my-namespace/report?format=html&raw=true" > report.html

See LLM Agent Workflow for the full loop, error handling, and multi-analyzer namespaces.

---

Next steps

See Triage a Finding to suppress a finding, or Authentication to set up a real multi-tenant deployment. Prefer a single call with no loop to drive? See Server-Side Analysis.