REST + CLI slop-risk and issue-slop routes leak the numeric score MCP deliberately blunts

[JSONbored]

Context

Two MCP tools deliberately blunt their response before returning it:

• loopover_check_slop_risk (src/mcp/server.ts:3617-3625, checkSlopRisk): // Return band + findings only — omit the exact numeric score and rubric thresholds to prevent weight reverse-engineering via controlled inputs (#mcp-slop-blunt)
• loopover_check_issue_slop (src/mcp/server.ts:3654-3661, checkIssueSlop): same { band, findings }-only shape, same intent.

Their REST mirrors do not blunt at all:

• POST /v1/lint/slop-risk (src/api/routes.ts:3372) returns { ...buildSlopAssessment(parsed.data), rubric: SLOP_RUBRIC_MARKDOWN } — the full numeric slopRisk score plus the rubric text.
• POST /v1/lint/issue-slop (src/api/routes.ts:3493) returns { ...buildIssueSlopAssessment(parsed.data), rubric: ISSUE_SLOP_RUBRIC_MARKDOWN } — same leak.

The CLI mirrors call these REST routes and print the raw score straight through: slopRiskCli (packages/loopover-mcp/bin/loopover-mcp.js:3667-3671) prints payload.slopRisk directly, and issueSlopCli (line ~3752) does the same for its payload. Same underlying computation as the MCP tools, but the REST/CLI surfaces leak exactly what the MCP blunting was built to withhold — anyone can get the exact score and rubric by calling REST/CLI instead of MCP.

Requirements

• POST /v1/lint/slop-risk and POST /v1/lint/issue-slop must return the same blunted { band, findings } shape the MCP tools already return — no numeric score, no rubric text in the response body.
• slopRiskCli and issueSlopCli must stop printing the numeric score (they should print band and findings only, matching the MCP tool's own output).
• Do not change buildSlopAssessment/buildIssueSlopAssessment themselves, or the underlying scoring logic — this issue is scoped to what the REST/CLI surfaces expose, not the computation.
• If a rubric-reference use case genuinely needs the full rubric text separately, that's out of scope for this issue — file a follow-up rather than restoring it here.

Deliverables

• POST /v1/lint/slop-risk response no longer includes the numeric score or rubric
• POST /v1/lint/issue-slop response no longer includes the numeric score or rubric
• slopRiskCli output no longer prints the numeric score
• issueSlopCli output no longer prints the numeric score
• Test asserting REST/CLI output for both routes matches the MCP tool's blunted shape for identical input

Test Coverage Requirements

99%+ Codecov patch coverage on every changed line and branch, plus the parity test above.

Expected Outcome

The #mcp-slop-blunt anti-gaming intent (preventing weight reverse-engineering via controlled inputs) actually holds across every surface — REST, CLI, and MCP all return the same blunted { band, findings } shape instead of MCP-only.

Links & Resources

src/mcp/server.ts:3617-3625,3654-3661 — the MCP tools' existing blunting (the precedent this issue mirrors into REST/CLI). src/api/routes.ts:3372,3493 — the two leaking routes. packages/loopover-mcp/bin/loopover-mcp.js:3667-3671 (slopRiskCli) and issueSlopCli — the two leaking CLI commands.

[linear-code]

JSO-4755