Return runtime information for the API-only Cross Review MCP server, including version, data directory and active security mode.

Return the stable cross-review runtime capability contract and active tool list.

Query official provider APIs to discover available models for the current API keys, select the highest-capability documented model, and verify provider reachability.

Create a durable cross-review session after probing provider availability and model selection. This does not call reviewer models yet. AI callers should submit raw proof through the evidence field of the subsequent review starter; the runtime will persist it automatically without session_attach_evidence or human intervention.

List durable sessions saved under the local data directory. The default response is paginated and summary-only to keep stdio transports bounded; use session_read for one full session or detail='full' for a bounded page of full metadata.

Read a durable session meta.json by session_id.

Run a real API review round against selected peers. AI evidence supplied in evidence is persisted durably and transported automatically; no separate attachment step is required. Runtime default uses real provider APIs; stubs run only when CROSS_REVIEW_STUB=1. When session_id names an existing session, requires the verified capability token of that session's persisted petitioner; opening a new session does not.

Start a real peer-review round in the background and return immediately with a session_id/job_id for polling. AI evidence supplied in evidence is persisted durably and transported automatically; no separate attachment step is required. When session_id names an existing session, requires the verified capability token of that session's persisted petitioner; opening a new session does not.

Generate or revise a draft and continue real API peer-review rounds until unanimous READY or the configured max_rounds is reached. AI evidence supplied in evidence is persisted durably and transported automatically; no separate attachment step is required. v2.11.0: when caller is set to a peer id (claude|codex|gemini|deepseek|grok|perplexity), the relator lottery activates: omit lead_peer to have the server randomly select a non-caller peer as relator (modeled on judicial panels), or supply an explicit lead_peer that is NOT the caller. An explicit lead_peer === caller is rejected at the server with caller_cannot_be_lead_peer — an agent never reviews itself (workspace HARD GATE).

Start real API generation/revision rounds in the background until unanimity, max_rounds or budget limit. AI evidence supplied in evidence is persisted durably and transported automatically; no separate attachment step is required. v2.11.0: same caller + relator-lottery semantics as run_until_unanimous — see that tool for details. When session_id names an existing session, requires the verified capability token of that session's persisted petitioner; opening a new session does not.

Request cancellation for running background jobs in a durable session. The reason accepts at most 300 characters. Requires the verified capability token of the persisted session petitioner; another peer cannot cancel the job. Provider calls receive AbortSignal where the provider client supports it.

Mark unfinished sessions with stale in-flight rounds as recovered after a MCP host restart so they can be resumed explicitly. Requires your own verified capability token, and recovers only the sessions you own.

Return durable session state and background job status without waiting for provider calls to finish. Default detail=summary keeps prior-round peer text/raw payloads out of polling responses; use detail=full or session_read only when full forensic data is required.

Return aggregate observability metrics across all sessions, or only one session when session_id is provided.

Read-only per-peer reliability telemetry: READY/NEEDS_EVIDENCE/NOT_READY counts, parser warnings, provider errors, unresolved evidence asks, fabrication events, latency and cost. Observational only; does not change peer selection or mutate sessions.

Operational audit across durable sessions: open/stale/blocked cases, legacy self-lead metadata, open evidence asks (with per-peer item type drill-down + chronic blockers since v2.22), Grok provider errors, and token-event noise. Read-only by default (does not modify sessions). Terminal max-rounds and terminal not_resurfaced history stay in totals but are not default operational findings; pass include_terminal_findings=true to enumerate that historical inventory. Pass include_legacy=true to enumerate per-session self_lead_metadata entries (hidden by default since v2.22 because pre-v2.16 sessions carry the legacy artifact at ~38% rate; totals.self_lead_metadata count is always visible). v3.6.0: pass repair=true (opt-in) to recompute convergence_health for sessions stuck in the contradictory outcome="converged"+health="blocked" state left by pre-v3.2.0 corruption — only that specific contradiction is touched, only when explicitly requested; the repaired array lists what was fixed. The read-only pass needs no token; repair requires your own verified capability token and touches only the sessions you own.

Read a bounded page of durable session events. Token-delta telemetry is excluded by default; opt in only for streaming forensics. Continue with next_seq while has_more is true.

Generate and save a Markdown report with convergence, peer decisions, failures, costs and latest events.

Return the latest durable convergence state, health and scope for a saved session without calling providers.

Run the same enabled evidence and truthfulness gates used by a real review round, without calling providers. Peer-submitted inline/structured evidence is checked as review material and requires no separate attachment step.

Backward-compatible alias for session_preflight_check. Its top-level pass now reflects both enabled runtime gates, eliminating truthfulness-only false positives.

Attach one durable evidence artifact to an existing session, out of band from a review round. Only the session's own petitioner may call it, and the artifact carries the same caller_submitted_unverified provenance as material passed through the evidence field of a review starter — this tool promotes nothing. Prefer the evidence field for the routine path; this one exists for material that does not belong to a specific round. Requires the verified capability token of the persisted session petitioner; a peer cannot attach evidence to someone else's session.

LLM satisfied-detection for the Evidence Broker. The configured judge peer reads each currently-open checklist item against the supplied draft and returns a structured judgment; a peer can never judge its own evidence ask. The runtime promotes only items where satisfied=true AND confidence='verified'; everything else stays open. Terminal statuses and already-addressed items are never touched. Optional shadow_mode records non-mutating decisions. Requires the verified capability token of the persisted session petitioner, because the pass spends that petitioner's budget on paid provider calls.

Multi-peer evidence judgment. Requires at least two distinct enabled judge peers. A peer is forbidden from ruling on its own evidence ask; any self-judge member makes that item's consensus fail closed. Active mode promotes only unanimous verified-satisfied judgments with non-empty rationales and zero parser warnings; shadow mode never mutates state. Requires the verified capability token of the persisted session petitioner, because the pass spends that petitioner's budget on paid provider calls.

v2.14.0 — compute precision/recall/F1 of the shadow judge against the empirical ground truth (whether peers raised the same ask in a subsequent round). Walks session.evidence_judge_pass.shadow_decision events across all sessions (or a single session via session_id, or filtered by judge peer / since timestamp), correlates each decision with the subsequent evidence_checklist resurfacing behavior, and returns per-peer TP/FP/TN/FN counts plus precision/recall/F1. Decisions whose item.last_round equals the judge round AND no later round exists are excluded as 'no ground truth' (we cannot tell if the ask would have come back). Operator uses this to decide whether to flip a peer from shadow to active mode (item 2 / v2.13).

v2.14.0 — formally contest a final verdict and open a new deliberation cycle. The reason accepts at most 4,000 characters. Requires the verified capability token of the persisted session petitioner (pass caller explicitly as that peer identity). Petitioner READY → nothing to do: the runtime already sealed converged; petitioner NOT_READY → contest_verdict. Stamps the original session's meta with a contestation record (timestamp + reason + original_outcome + new_session_id) and initializes a NEW session whose contests_session_id points back to the contested session, preserving the chain of custody append-only across sessions. The original session must be in a final state (converged/aborted/max-rounds); contesting an in-flight session throws cannot_contest_in_flight_session. Once contested, a session cannot be contested again (chain-of-custody invariant) — contest the LATEST session in the chain.

Finalize unfinished sessions whose metadata has been idle for at least 24 hours. The terminal reason accepts at most 200 characters. v3.7.5 (B1): opt-in prune_corrupt also removes stale entries from the corrupt_sessions/ quarantine directory. Requires a verified capability token. Sweep is the one mutation that acts ACROSS owners, so the token is not the affected petitioner's — but a self-declared identity is refused, and it is therefore no way out of a token-file failure.

Close a non-terminal durable session as aborted with an optional reason of at most 200 characters. Requires the verified capability token of the persisted session petitioner: the peer host must pass caller explicitly as its own identity, and a caller that contradicts that host's own token or clientInfo is refused as identity forgery. converged is sealed only by the runtime, when the petitioner and every required peer are READY and every evidence gate passes; max-rounds is written only by the runtime or the idle sweep.