Reporting scanner mistakes

A scanner is a set of claims about the live world, and an assistant reading them can test many of those claims itself. The server tells every connected assistant to do exactly that before presenting a finding as fact, and gives it a channel for what it finds.

Plan: Enterprise, from the account's own API keys carrying the scans and write scopes. A dashboard session cannot file one.

The two tools

Tool	What it does
`report_scanner_issue`	One thing the scanner got wrong: what it said, what is true, how the assistant knows, what to change. Takes `domain_id`, `category`, `title`, `detail`. Reports for one domain collect into a review
`submit_scanner_review`	Closes the review for a domain and sends it to the operators as one message. Called once per domain, when done

Categories cover a false positive, a missed problem, a wrong count or record, and a check that errored. A repeat of the same report is folded into the existing one rather than duplicated.

Limits

Limit	Value
Reports per account per day	30
Per domain review	10
Messages	One per review; the batch is flushed after 30 minutes if not submitted

Over the limit the tool answers 429 report_limit_reached; below Enterprise it answers 402.

What happens to a report

The message goes to a person at NHM. The fix comes back as a code change with a test, and the scanner-accuracy corpus that pins real sites' answers is extended so the mistake does not return.

What it does not change

Reporting never softens what you are told. The assistant says what the scanner said and what it found, and the finding stays until a scan clears it.

Endpoints

POST /api/scanner-reports, POST /api/scanner-reports/submit. Operators read them with list_scanner_reports.

Common questions

I found a mistake by hand, not through Claude. Use Ask for help in the dashboard or the app; attach the domain and the finding. The MCP channel is narrow on purpose so that automated reports carry evidence.