# Problems and what to do

A leader sees these in the app's dialog on the **Connections** tab: when saving, under the
field, and when checking, under the address. People who get the app see the same words in
one quiet line in their chat, followed by "The assistant is working without it." The chat
goes on: the assistant is told the app is unavailable, and a tool of the app's that it
tries anyway fails and says so.

In the messages below, Attendance stands for your app's name.

## When saving

| Code | What it says | What to do |
|---|---|---|
| `identity.app_name_invalid` | An app's name is 1 to 40 characters: letters, digits, spaces and the marks - ' & , . ( ). It can't look like a web address or a phone number. | Choose a plainer name. |
| `identity.app_name_taken` | This team already has an app with that name. | Choose another, or edit the one you have. Names are compared without capitals. |
| `identity.app_name_kept` | That name is kept for Theorem itself, or reads too much like it. Choose another name. | Choose a name without "Theorem". |
| `identity.app_address_invalid` | An app's address is where its MCP server answers: https:// and a host name such as tools.example.com, with no user name, password or # part, 300 characters at most. | Use the `https://` address of your MCP endpoint, with a host name, not an IP address or `localhost`. |
| `identity.app_for_invalid` | Say who the app is for: "for": "everyone", or "for": "roles" with one or more of the team's roles in "roles". | Choose **Everyone**, or tick at least one role. |
| `identity.too_many_apps` | This team has 25 apps, which is as many as a team may have. Delete one first. | Delete an app you no longer use. |
| `identity.role_not_found` | This team has no such role. It may have been deleted. | Close the dialog, open the app again and choose from the roles the team has now. |

## When checking: the address

Theorem looks up your app's host each time it connects, and connects only to the address
it checked. It follows no redirect.

| What it says | What to do |
|---|---|
| Attendance can't be used: its address can't be read as one. | Correct the address. |
| Attendance can't be used: its address must begin with https://. | Serve the app over HTTPS. |
| Attendance can't be used: its address carries a user name or a password. | Remove them. The token is the only credential. |
| Attendance can't be used: the name in its address was not found. | Check the host name and its DNS record. |
| Attendance can't be used: its address leads to Theorem's own machine, and an app must be on the internet. | Use the address your app has on the internet. |
| ... leads to a private network ... | The host resolves to a private address, such as 10.0.0.0/8 or 192.168.0.0/16. Give it a public address. |
| ... leads to a link-local network ... | The same, for 169.254.0.0/16 or fe80::/10. |
| ... leads to a carrier's shared network ... | The same, for 100.64.0.0/10. |
| ... leads to no machine at all ... | The host resolves to 0.0.0.0 or ::. |
| ... leads to a multicast address ... | The host resolves to a multicast address. |
| ... leads to an address that is not on the internet ... | The host resolves to a reserved or documentation address. |

If a host has several addresses, every one must be on the internet.

## When checking: the app

| What it says | What to do |
|---|---|
| Attendance could not be reached at its address. | Check the app is running and its HTTPS answers from the internet. |
| Attendance took too long to answer. | Answer within 3 seconds to connect and 8 to list tools. |
| Attendance refused Theorem's token. An app must accept a token that Theorem signed and whose audience is the app's own ID. | Check the app's `APP_ID` is the ID on the **Connections** tab, and that it reads Theorem's keys. See [The token](/developers/token). |
| Attendance answered, but not as an MCP server does. Its address must be the address of its MCP endpoint itself: a redirect is not followed. | Use the endpoint's full address, often ending in `/mcp`, with no redirect in between. |
| Attendance could not list its tools. | Look at your app's log for the failed `tools/list`. |
| Attendance can't be used: its tools come to more than 250,000 characters as it lists them, the most an app's may. | Shorten descriptions and schemas, or split the app. See [Tools](/developers/tools). |
| Theorem can't sign a token for Attendance right now. Try again in a moment. | Try again. |

## When the check cannot run

| What it says | What to do |
|---|---|
| The check could not be run. | Try **Check again** in a moment. If it keeps failing, the app may have been deleted, or you may no longer lead its team: open the **Connections** tab again. |
| You're signed out. Sign in again to check this app. | Sign in again. |
| You've checked apps many times in the last minute. Wait a moment and try again. | One person can check 10 times a minute. |
| Your teams' apps can't be looked up right now. Try again in a moment. | Try again. |

## Only in a chat

| What it says | What it means |
|---|---|
| This person doesn't get that app and doesn't lead its team, or there is no such app. | The app was deleted, or is no longer for this person, while their chat was open. |
| Your teams' apps can't be listed right now, so the assistant is working without them. | Theorem could not say which apps the person gets. The next message tries again. |