[Naoray]

Unattended Codex runs can reject Seyk tool calls when approval is unavailable. Declare explicit tool annotations and document server-scoped default_tools_approval_mode = "approve", including the per-run -c override.

search and extract advertise readOnlyHint=false: search can index inline and update/prune its derived local cache; extraction can lazily initialize the engine, open the cache, and start its scrubber. index_status only observes existing state and never initializes the engine or indexes inline, so it advertises true. Independent watchers can still write while status is read. All three advertise destructiveHint=false, idempotentHint=true, and openWorldHint=false. Seyk only adds/prunes its own derived, rebuildable cache and never modifies or deletes user files. Repetition converges for unchanged sources/model/configuration; results can change as indexing progresses.

Checked the camelCase wire names against the MCP 2026-07-28 schema and the locked rmcp 3.5.1 ToolAnnotations serialization/macro fields. Codex documents that writes prompts for tools that are not read-only: it auto-approves status but still prompts for search/extract even with destructiveHint=false. approve supports unattended use when the binary and configured roots are trusted.

Validation:

• cargo fmt --all --check
• cargo clippy --locked --bin seyk --test cli -- -D warnings
• cargo test --locked --test cli mcp_server_lists_search_tool_without_loading_the_model -- --exact: passed; asserts all four wire annotations for all three tools through tools/list.
• Codex CLI 0.164.0 codex exec with default noninteractive approval policy and the documented server approval override successfully called lexical search over an invented note. Returned the correct three-attempt policy, degraded.reason=no_model, and segments_embedded=0. Explicit empty model directory; no model downloads or loads.
• Commit created with git commit -S; verified its gpgsig header before pushing.

Resolves Solo todo #5218