mamori doctor and status

Both are thin clients of a running process’s admin endpoint (mamori.WithAdminHTTP / mamori.Handler, see Observability). They GET /, render the mamori.Report that comes back, and resolve nothing themselves. doctor is a one-shot health check with drift detection; status is the same table, optionally on a loop.

For the library-side preflight you run in CI before deploying, see Doctor: pre-deploy check. That runs your exact wiring inside your build; mamori doctor runs from anywhere against a process that is already running.

doctor

mamori doctor --endpoint <ep> [--insecure] [--json] [--compare "<patterns>"]

• --json emits the admin endpoint’s raw response body unchanged, byte for byte, instead of a table.
• --compare takes space-separated Go package patterns. It statically extracts source: refs (the same walk explain uses) and flags any field present in source but missing from the live report, or present live but not in source. It needs a buildable source tree and does not change the exit code.

$ mamori doctor --endpoint https://svc.internal:9090 --compare ./...
PATH            SCHEME  REF                     VERSION  STALE  LAST_KIND  LAST_ERROR  SENSITIVE
Redis.Addr      env     env://REDIS_ADDR        3        false  -          -           false
Redis.Password  aws-sm  aws-sm://prod/redis-pw  3        false  -          -           true

HEALTHY: 2 field(s), snapshot 3 (live 3), generated 2026-07-26T10:00:00Z

compare: source vs. live field paths
  no drift: source and live field sets match

status

Renders the same report table as doctor, without --compare or --json.

mamori status --endpoint <ep> [--insecure] [--watch] [--interval <dur>]

• --watch renders immediately, then again on every tick of --interval (default 2s) until interrupted with Ctrl-C.
• --interval <dur> sets the poll interval when --watch is set (e.g. 5s).

$ mamori status --endpoint unix:///run/app-admin.sock --watch --interval 5s
PATH        SCHEME  REF               VERSION  STALE  LAST_KIND  LAST_ERROR  SENSITIVE
Redis.Addr  env     env://REDIS_ADDR  3        false  -          -           false

HEALTHY: 1 field(s), snapshot 3 (live 3), generated 2026-07-26T10:00:00Z
# ...re-renders every 5s until Ctrl-C

Exit codes

Both live commands share one exit-code table, so a script can tell “my config is broken” (1) apart from “I couldn’t even see my config” (2/3/4).

Branch on this directly: 1 means fix the config; 2/3 mean fix connectivity (or wire up mamori.WithAdminHTTP); 4 means fix the credential. --watch never returns these mid-loop: each poll’s outcome is only printed, and the command returns 0 once you interrupt it.

Endpoint forms

--endpoint accepts three forms, matching what the admin endpoint and the config server serve:

• https://host:port
• unix:///path/to.sock
• http://host:port, only with --insecure passed explicitly; a plain http:// endpoint is refused otherwise.

Auth flags

Credentials reuse the same Authenticator schemes the admin endpoint supports. Bearer and basic are mutually exclusive.

Prefer the file/stdin forms. --bearer/--basic put the credential in os.Args, visible to anything that can read this process’s argv (e.g. ps). The -file forms (including - for stdin) keep the token out of both shell history and argv.

Custom provider schemes with —compare

--compare is the only part of doctor that reads source, so it is the only part affected by the scheme set. If you wrote your own provider, name its scheme so drift detection classifies its fields as secrets:

mamori doctor --endpoint https://svc:9090 --compare ./... --secret-schemes=mysecrets

The flag is validated before any network call, so a typo fails immediately rather than after the round trip. See mamori vet for the built-in set.

See also

CLI overview. Observability covers the Report shape these render; Config server shares the same endpoint forms and auth schemes.