feat(mcp-bridge): add MCP annotations + outputSchema to all tools; Teranga scoped surface

[hyperpolymath]

Summary

Quality upgrade to the MCP bridge surface: every advertised tool now
carries MCP-spec annotations and a JSON-Schema outputSchema, and a
new BOJ_TOOL_SCOPE env var lets operators shrink the advertised
surface (a Glama Server Coherence lever) without losing any capability.
No existing description or inputSchema was rewritten or shortened —
the AAA-tier 120-char min / 200-char mean coherence floor is preserved.

Stale-score finding

The previous Glama C grade was a stale pre-AAA inspection. The
tool descriptions and input schemas had already been upgraded to
AAA-tier (rich prose, enums, ranges, patterns, sibling
disambiguation). The only remaining gaps — confirmed by grep — were
zero MCP annotations, zero outputSchema, and 41+ tools always
advertised. This PR closes exactly those gaps so a re-inspection
reflects the current surface, not the old one.

Per-task changes

1. MCP annotations (mcp-bridge/lib/tools.js)
Every tool (object literals + every ghTools/glTools entry via an
ann field) gets an annotations block: Title-Case title plus the
four boolean hints. Derived honestly from documented semantics:

• openWorldHint:false for coord_* (loopback bus) and the local
  discovery/dispatch core; true for all external-system tools.
• destructiveHint:true only for boj_github_merge_pr,
  coord_approve, coord_reject, boj_gitlab_setup_mirror.
• idempotentHint:true for status/health/setter-style coord ops and
  boj_health.

2. outputSchema (mcp-bridge/lib/tools.js)
A type:"object" return descriptor with a non-empty top-level
description and an explicit additionalProperties on every tool.
Fields fully enumerated where the description already states the shape;
honest pass-through (additionalProperties:true) for opaque upstream
cartridge/provider payloads — no invented fields.

3. main.js wiring
tools/list passes whole tool objects through verbatim (no field
whitelisting), so annotations + outputSchema reach the wire
unmodified. tools capability now advertises listChanged:true.

4. Teranga scoped surface
BOJ_TOOL_SCOPE read in buildToolList():

• unset / full — every tool (DEFAULT, fully backward-compatible).
• core — boj_health, boj_menu, boj_cartridges,
  boj_cartridge_info, boj_cartridge_invoke + all coord_*.
• CSV of prefixes (core,github,browser) — core + named groups.
  Verified counts: full=65, core=28 (5 + 23 coord_*),
  core,github,browser=49. Every explicit boj_<domain>_* tool stays
  reachable via boj_cartridge_invoke in every mode — the
  unified-endpoint thesis is intact. Documented in glama.json env block
  and docs/glama/SERVER_CONFIGURATION.md.

Test additions (mcp-bridge/tests/dispatch_test.js)

Existing 8 tests untouched. Added 3:

• every tool has a complete annotations block (non-empty string
  title + four boolean hints);
• every tool has a typed, described outputSchema (type:"object",
  non-empty description, explicit additionalProperties);
• BOJ_TOOL_SCOPE unset advertises the full surface (back-compat) and
  core is a strict subset that keeps boj_cartridge_invoke + the
  coord_* unit.

npm test: 11/11 pass. eslint clean on all changed files.

Post-merge

• Publish a new npm version of @hyperpolymath/boj-server so the
  registry artifact carries the new annotations/outputSchema surface.
• Trigger a fresh Glama re-inspection to clear the stale C grade.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 28 issues detected

Severity	Count
🔴 Critical	17
🟠 High	4
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🔍 Hypatia Security Scan

Findings: 28 issues detected

Severity	Count
🔴 Critical	17
🟠 High	4
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence