Summary

Fixes all 7 issues from Manufact's automated app-directory readiness check against Cedar's public MCP server (https://api.mail.cedarcopilot.com/mcp), ahead of submission to the Claude and OpenAI (Codex) app directories.

• tool-hints-present / tool-title-present / claude-tool-hints-present , every externally-registered MCP tool (all 33: the 28 shared family tools, the 4 external-only document splits, and board) now declares a top-level title and annotations.{readOnlyHint,destructiveHint,openWorldHint} reflecting its real behavior, via one EXTERNAL_TOOL_METADATA table in server.ts that throws loudly if a tool is registered without an entry. The 5 individually-registered tools (load-skill, load-brain-skills, cedar-staff-debug, record-message, record-tool-call) each got their own title/annotations at their own registerTool call.
• claude-code-metadata-length , the 7 flagged tools (document, table, config-read, debug, run-sql, conversation-read, mail) were trimmed. The reported byte counts turned out to be the source description plus the Armature telemetry hint Cedar's analytics wrapper appends when ANALYTICS_INGEST_API_KEY is set (171 bytes before this PR's telemetry patch, 156 after) , tool-description-length.test.ts was rewritten to measure real UTF-8 bytes (not .length, which undercounts every em dash/curly quote in this codebase's own house style) against budget minus that hint reserve, computed dynamically via appendTelemetryHint('') so it can't drift from the patched package. That stricter check caught two more real, previously-undetected bugs: board's description was also over budget (invisible to Manufact's live scan only because board has no scope mapping yet), and buildSessionInstructions's company-background truncation math was also .length-based and could land a few bytes over the real ceiling.
• policy-review (telemetry over-collection) , patched @armature-tech/mcp-analytics@0.6.36 (via pnpm patch, same mechanism as the existing postgres/@superglue/client patches) so its telemetry.agent_thinking field description reads as genuinely optional rather than "include on every call... even when marked optional." The underlying Zod schema was already .optional(); only the coercive wording changed. Cedar's own first-party agents (including Cedar staff connecting their own Claude over external OAuth, which goes through this exact same code path) can keep sending it voluntarily.
• policy-review (document tool scope) , split the external registration of document into four risk-grouped tools: document-read (read/list/search), document-write, document-manage (delete/restore/move), document-share. The internal Mastra documentTool itself is untouched and stays in FAMILY_TOOLS unsplit, because that array is also consumed directly by the in-app chat harness (workflows/chat/harness/mcp-server.ts) and other first-party callers that must keep seeing one consolidated tool , the external registration loop in server.ts explicitly skips document there and registers the four split tools (document-external-tools.ts) in its place instead. scope-map.ts carries matching document-read/write/manage/share entries that preserve the exact per-action scope requirements the single document id used to resolve, plus a document entry retained solely for the in-app viewer-role gate.
• policy-review (exposed identifiers) , the MCP session instructions text no longer echoes the caller's literal userId/orgId. Identity is already resolved server-side per request; no external tool's input schema asks the model to supply its own userId/orgId as an argument (no-bare-user-id-inputs.test.ts enforces this structurally , every surviving userId-shaped field is a deprecated targetUserId alias for cross-user delegation, never "tell us who you are"). One judgment call: run-sql's free-text SQL query genuinely needs the caller