Investigation support

Use these surfaces to diagnose an investigation without exposing incident evidence.

Service health

Dependency readiness for Correlate and Evidence is reported live. A degraded dependency prevents factual synthesis.

The API and MCP schemas describe supported inputs, stream events, and tool behavior.

Include the public run ID and trace ID when reporting a failure. Never include API keys, raw credentials, or unsanitized incident data.