Context

chats.list and chats.messages were built to let the agent answer "how many threads do I have?" and read a conversation. With one shared MCP token they returned every user's threads, because the server has no way to know who is asking.

Decision

Remove them. The UI renders conversations from SQLite, where ownership is already enforced on every route. The agent does not need to enumerate threads, and a tool that does not exist cannot be talked into leaking.

Consequences

• Calling either tool now returns isError: true, unknown tool — verified live.
• users.list keeps a per-login thread count (one grouped query), because an account's conversation count is useful context and the threads themselves are not.
• A regression test pins the removal, so the tools cannot quietly come back without a scoping story.
• If per-user bots land, the question becomes moot in a different way: a bot with one user's token could safely have the tools — but by then the UI still owns the conversation, so there is no reason to add them back.

Rendered from nx-master/decisions/drop-chats-tools.md · OKF bundle · regenerate with npm run render