Four paths. Same destination.

import { createEngine } from 'agent-threat-rules';

const engine = createEngine();
const verdict = engine.evaluate({
  type: 'llm_input',
  content: userMessage,
  timestamp: new Date().toISOString(),
});

if (verdict.outcome === 'deny') {
  // Block the request
}

from atr import ATREngine

engine = ATREngine()
result = engine.evaluate(event={
    "type": "llm_input",
    "content": user_message,
})

if result.outcome == "deny":
    # Block the request

# Point your scanner at rules/ directory
# Each .yaml file follows ATR schema v1.0
# Parse with any YAML library
# Schema: spec/atr-schema.yaml

rules/
  prompt-injection/    # 22 rules
  tool-poisoning/      # 11 rules
  agent-manipulation/  # 10 rules
  ...

# Convert ATR rules to SIEM query language
atr convert splunk    # Output SPL queries
atr convert elastic   # Output Elasticsearch Query DSL
atr convert sarif     # Output SARIF v2.1.0 for CI/CD