Reporting scanner mistakes

A scanner is a set of claims about the live world, and an assistant reading them can test many of those claims itself. The server tells every connected assistant to do exactly that before presenting a finding as fact, and gives it a channel for what it finds.

Plan: Pro and Enterprise, from the account's own API keys carrying the scans scope. A read-only key is enough, because a report changes none of your data. A dashboard session cannot file one.

Most reports now come from agent verification: when an agent disputes one of the claims on its task list, the report is filed for it. These two tools are for mistakes that aren't on the list.

The two tools

Tool	What it does
`report_scanner_issue`	One thing the scanner got wrong: what it said, what is true, how the assistant knows, what to change. Takes `domain_id`, `category`, `title`, `detail`. Reports for one domain collect into a review
`submit_scanner_review`	Closes the review for a domain and sends it to the operators as one message. Called once per domain, when done

Categories cover a false positive, a missed problem, a wrong count or record, and a check that errored. A repeat of the same report is folded into the existing one rather than duplicated.

Limits

Limit	Value
Reports per account per day	30
Reports per domain per day	10
Reports per review (batch)	10
Messages to NHM	One per review, at most 3 per account per day (and 25 a day across all accounts); the batch is flushed after 30 minutes if not submitted

Over the account's daily limit the tool answers 429 report_limit_reached; over the per-domain limit, 429 domain_report_limit_reached; a full review, 429 batch_full. Past the message cap, reports are kept (held) rather than sent that day. On Free and Starter the tool answers 402.

What happens to a report

The message goes to a person at NHM. The fix comes back as a code change with a test, and the scanner-accuracy corpus that pins real sites' answers is extended so the mistake does not return.

What it does not change

Reporting never softens what you are told. The assistant says what the scanner said and what it found, and the finding stays until a scan clears it.

Endpoints

POST /api/scanner-reports, POST /api/scanner-reports/submit. Operators read them with list_scanner_reports.

Common questions

I found a mistake by hand, not through Claude. Use Ask for help in the dashboard or the app; attach the domain and the finding. The MCP channel is narrow on purpose so that automated reports carry evidence.