Compare network address sets exactly.

This is bounded IPv4/IPv6 set arithmetic for public, non-secret JSON inputs. IPv4 and IPv6 are compared separately, and duplicates, overlaps, and input order do not change the result.

Browser-agent action

When this guide is open in a browser that exposes document.modelContext, a browser agent can call network_set_evidence with the same public, non-secret before and after arrays. The optional page bridge sends the existing same-origin JSON POST and returns its unchanged response; the HTTP and MCP paths below remain available when it is not supported.

Use the endpoint

• GET /api/yumi/network-set-evidence returns the service descriptor.
• GET /api/yumi/network-set-evidence?request=... accepts one URL-encoded JSON request.
• POST /api/yumi/network-set-evidence accepts oneapplication/json request body.
• POST /api/yumi/mcp can call the network_set_evidence tool with the same before and after arrays through tools/call; it returns the same JSON result.
• OPTIONS describes the anonymous cross-origin HTTP boundary; other methods return 405.

The ordinary encoded GET example compares 10.0.0.0/25 with 10.0.0.0/24. The endpoint itself has no form, account, client library, or required frontend dependency; this guide may optionally register the browser-agent bridge above when document.modelContext is available.

GET requests are also subject to the hosting provider's URL length limit; use POST when the encoded URL would be larger, within the same 16,384-byte request ceiling.

What the result means

normalized gives a minimal canonical CIDR decomposition for each input set. added is after \ before and removed is before \ after. Each delta has canonical CIDRs and an exact decimal-string address_count. Counts include every address, including network and broadcast addresses.

A non-empty IPv4 or IPv6 delta also has a smallest witness withbefore_contains and after_contains checks. IPv6 output follows lowercase RFC 5952 formatting, including the longest zero run with the first-run tie break.

This is not a firewall, routing, security-policy, configuration, reachability, host-usability, or access-decision check. It does not enumerate addresses, inspect a host, or infer whether a service is reachable.

Strict request grammar and limits

The parsed JSON object must contain exactly before andafter; each is an array of at most 64 CIDR strings, and the serialized request must be at most 16,384 UTF-8 bytes. Each string is at most 60 characters. IPv4 uses four decimal octets without leading zeroes; IPv6 accepts hexadecimal hextets and one case-insensitive :: compression marker. Prefixes use canonical decimal notation, and host bits must be zero.

Zones, dotted or IPv4-mapped IPv6, hostnames, URLs, unknown keys, duplicate query parameters, malformed JSON, and unsupported forms are refused. The complete response is capped at 512 CIDRs and 65,536 UTF-8 bytes after its producer metadata is included. A limit failure rejects the whole result; it never truncates a set or count.

Privacy and alternatives

The route performs no external fetch, model call, authentication, request storage, application logging, or tracking. Submit only public non-secret inputs. The hosting provider may process request metadata, so this is not a promise of zero provider-side metadata.

A local workflow can use Python's standard-library ipaddress with collapse_addresses andaddress_exclude, or the Gowee cidr-aggregator native alternative. This endpoint makes no superiority, uniqueness, security, or adoption claim over those alternatives.

Illustrative request

{
  "before": ["10.0.0.0/25"],
  "after": ["10.0.0.0/24"]
}