chore(mcp): add outputSchema to every tool that lacks it

[oktofeesh1]

Fixes #550. (This PR was repurposed from the now-superseded check_slop_risk work — #531 was implemented upstream in #716 — onto a fresh, unbuilt hardening issue.)

Pure non-visual hardening: 18 of the MCP tools (preflight / score / local-branch / agent) had no outputSchema, so clients couldn't machine-validate their results. This adds one to each.

What this adds

• An outputSchema for every previously-unschematized tool in src/mcp/server.ts, mirroring the existing *OutputSchema style — documented top-level keys, all optional, complex values as z.unknown().
• No behavior change: toolResult already emits structuredContent for every tool; this only declares the schema that describes it.
• An mcp-output-schemas test asserting that every registered tool (now 36/36) exposes a machine-validatable outputSchema, so the gap can't regress.

Notes

• Schemas are accurate to each tool's payload top-level keys (traced from the handler/builder return shapes).
• The package bin is a thin proxy and does not mirror per-tool schemas, so it's untouched.
• npm run test:ci green; 97%+ branch & function coverage.

🤖 Generated with Claude Code

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#637 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds comprehensive output schemas for all MCP tools that previously lacked them and introduces tests to verify their presence and runtime validation. The changes are consistent with existing patterns and do not alter runtime behavior.

Suggestions

• Confirm that none of the newly exposed fields in public‑facing tools contain forbidden public terms or private context data.
• Consider exporting the schema objects (or documenting them) for easier future reference.

Worth double-checking

• If any tool input validation changes, the new output schemas might become out‑of‑sync and cause validation errors.
• Heavy test suite may increase CI runtime; monitor for timeouts.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds output schemas to several MCP tools that previously lacked them, ensuring that MCP clients can machine-validate their results. The changes are well-documented and include corresponding tests to validate the schemas.

Suggestions

• Consider adding a comment to the test file explaining the purpose of the new test cases added for the previously-unschematized tools.
• Ensure that the upsertBounty import in the test file is necessary and used appropriately.

Worth double-checking

• Verify that the new output schemas accurately reflect the actual output structure of the corresponding tools.
• Ensure that the tests cover all possible edge cases and that the schemas are robust against future changes in the tool outputs.

[JSONbored]

Nice — and good that buildSlopRiskReport wraps the existing buildSlopAssessment (single source of truth). Two things before merge:

1. The churn signal is dead via the CLI (high). bin/gittensory-mcp.js sends changedFiles as bare path strings (additions/deletions dropped) and doesn't forward changedLineCount, so trivial_whitespace_churn can never fire through the published npm tool — slopRisk is capped at 30 (missing-tests only). Forward per-file {path, additions, deletions} or a top-level changedLineCount (like preflight_local_diff does), and add a bin-level test that would catch it.
2. Rebase — DIRTY: a trivial import-block conflict in test/unit/slop.test.ts + reconcile the FORBIDDEN_PUBLIC_TERMS regex drift to main's.

Privacy/contract/schemas are otherwise merge-quality.

[oktofeesh1]

Heads up — this PR was repurposed. The original check_slop_risk work (#531) was implemented upstream in #716, so I reset this branch and it now implements #550 (add outputSchema to every MCP tool that lacks one). The earlier changes requested review refers to the old slop content and no longer applies. It's conflict-free against current main and CI is green; ready for a fresh review whenever you have a moment. 🙏