Diagnostics

Precall: integrity outcomes

precall troubleshooting · 4 integrity statuses: unchanged, changed, unreachable, not_registered · Machine form: /v1/diagnostics/precall-integrity · Markdown

A pre-call answer's integrity block compares the tool definitions a server serves now with the fingerprint recorded earlier, and reports exactly one of four statuses. Unchanged is the only status that says the definitions match the record — and it is not a finding that a tool is safe. Changed carries a plain diff of how the definitions differ. Unreachable means the server could not be probed for this check, so nothing can be said about its current definitions — it is never reported as unchanged. Not registered means the server was probed for this answer only: there is no recorded fingerprint to compare against, the fingerprint in the answer is what it serves now, computed for the answer and not stored, and checking a server does not register it.

Entry points

• precall: /v1/security/precall
• external_servers: /v1/store/external
• definition_changes: /v1/security/changes

Checks to run

• GET /v1/security/precall?url=<server URL> — read integrity.status, integrity.detail and, when present, integrity.diff.
• GET /v1/security/changes — the definition-change feed the integrity check feeds, for what changed and when.
• GET /v1/store/external — the registry record a registered server's fingerprint and history live on.

Outcomes

• unchanged — The definitions the server serves now match the fingerprint recorded earlier. Next step: Read the rest of the answer before relying on the tool — the scan, the standing flags and the review aggregate are separate evidence, and unchanged is not a finding that a tool is safe.
• changed — The definitions differ from the record; the answer's diff says how. Next step: Read the diff in the answer and the definition-change feed, then decide from the new definitions — re-run the pre-call check after any fix so the answer reflects what the server serves now.
• unreachable — The server could not be probed for this check, so nothing can be said about its current definitions. Next step: Check the URL and that the server is up, then run the pre-call check again; the tool focus in such an answer rests on the last recorded definitions, and says so.
• not_registered — The server is not in the registry, so there is no recorded fingerprint and no history to read; it was probed for this answer only. Next step: Decide from this answer's fresh probe and scan, or register the server (POST /v1/store/external) so later checks compare against a recorded fingerprint. If the URL redirected, register the destination directly — the answer names it as the effective URL.