diff --git a/Taskfile.yml b/Taskfile.yml
index 27019756..c378d7ab 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -157,6 +157,14 @@ tasks:
       - rm -f /tmp/recent-prs.json /tmp/changelog-content.md /tmp/plugin-changes.html
       - echo "✅ Temporary files cleaned"
 
+  version:
+    desc: Show current plugin version
+    vars:
+      CURRENT_VERSION:
+        sh: grep -E '^version\s*=' build.gradle.kts | head -n1 | sed 's/.*"\(.*\)".*/\1/'
+    cmds:
+      - echo "DevoxxGenie plugin version {{.CURRENT_VERSION}}"
+
   build:
     desc: Build the plugin using Gradle
     cmds:
@@ -207,6 +215,111 @@ tasks:
       - build
       - test
 
+  release:patch:
+    desc: 📦 Release a patch version (e.g. 0.5.6 → 0.5.7)
+    summary: |
+      Bumps the patch version in build.gradle.kts, generates changelog, creates a git tag, and pushes to remote.
+    preconditions:
+      - sh: git diff-index --quiet HEAD --
+        msg: "You have uncommitted changes. Please commit or stash them before releasing."
+    vars:
+      CURRENT_VERSION:
+        sh: grep -E '^version\s*=' build.gradle.kts | head -n1 | sed 's/.*"\(.*\)".*/\1/'
+      NEW_VERSION:
+        sh: |
+          current="{{.CURRENT_VERSION}}"
+          major=$(echo "$current" | cut -d'.' -f1)
+          minor=$(echo "$current" | cut -d'.' -f2)
+          patch=$(echo "$current" | cut -d'.' -f3)
+          new_patch=$((patch + 1))
+          echo "$major.$minor.$new_patch"
+    prompt: "Release patch version {{.NEW_VERSION}}? (current: {{.CURRENT_VERSION}})"
+    deps:
+      - check-tools
+    cmds:
+      - task: test
+      - |
+        sed -i.bak -E 's/^(version[[:space:]]*=[[:space:]]*")[^"]+(".*)$/\1{{.NEW_VERSION}}\2/' build.gradle.kts
+        rm -f build.gradle.kts.bak
+        echo "✅ Updated build.gradle.kts to version {{.NEW_VERSION}}"
+      - task: generate-changelog
+        vars: {VERSION: "{{.NEW_VERSION}}"}
+      - git add build.gradle.kts CHANGELOG.md {{.PLUGIN_XML}}
+      - 'git commit -m "chore(release): prepare release v{{.NEW_VERSION}}"'
+      - 'git tag -a "v{{.NEW_VERSION}}" -m "Release v{{.NEW_VERSION}}"'
+      - git push origin HEAD
+      - 'git push origin "v{{.NEW_VERSION}}"'
+      - echo "✅ Released v{{.NEW_VERSION}}"
+
+  release:minor:
+    desc: 📦 Release a minor version (e.g. 0.5.6 → 0.6.0)
+    summary: |
+      Bumps the minor version in build.gradle.kts, generates changelog, creates a git tag, and pushes to remote.
+    preconditions:
+      - sh: git diff-index --quiet HEAD --
+        msg: "You have uncommitted changes. Please commit or stash them before releasing."
+    vars:
+      CURRENT_VERSION:
+        sh: grep -E '^version\s*=' build.gradle.kts | head -n1 | sed 's/.*"\(.*\)".*/\1/'
+      NEW_VERSION:
+        sh: |
+          current="{{.CURRENT_VERSION}}"
+          major=$(echo "$current" | cut -d'.' -f1)
+          minor=$(echo "$current" | cut -d'.' -f2)
+          new_minor=$((minor + 1))
+          echo "$major.$new_minor.0"
+    prompt: "Release minor version {{.NEW_VERSION}}? (current: {{.CURRENT_VERSION}})"
+    deps:
+      - check-tools
+    cmds:
+      - task: test
+      - |
+        sed -i.bak -E 's/^(version[[:space:]]*=[[:space:]]*")[^"]+(".*)$/\1{{.NEW_VERSION}}\2/' build.gradle.kts
+        rm -f build.gradle.kts.bak
+        echo "✅ Updated build.gradle.kts to version {{.NEW_VERSION}}"
+      - task: generate-changelog
+        vars: {VERSION: "{{.NEW_VERSION}}"}
+      - git add build.gradle.kts CHANGELOG.md {{.PLUGIN_XML}}
+      - 'git commit -m "chore(release): prepare release v{{.NEW_VERSION}}"'
+      - 'git tag -a "v{{.NEW_VERSION}}" -m "Release v{{.NEW_VERSION}}"'
+      - git push origin HEAD
+      - 'git push origin "v{{.NEW_VERSION}}"'
+      - echo "✅ Released v{{.NEW_VERSION}}"
+
+  release:major:
+    desc: 📦 Release a major version (e.g. 0.5.6 → 1.0.0)
+    summary: |
+      Bumps the major version in build.gradle.kts, generates changelog, creates a git tag, and pushes to remote.
+    preconditions:
+      - sh: git diff-index --quiet HEAD --
+        msg: "You have uncommitted changes. Please commit or stash them before releasing."
+    vars:
+      CURRENT_VERSION:
+        sh: grep -E '^version\s*=' build.gradle.kts | head -n1 | sed 's/.*"\(.*\)".*/\1/'
+      NEW_VERSION:
+        sh: |
+          current="{{.CURRENT_VERSION}}"
+          major=$(echo "$current" | cut -d'.' -f1)
+          new_major=$((major + 1))
+          echo "$new_major.0.0"
+    prompt: "Release major version {{.NEW_VERSION}}? (current: {{.CURRENT_VERSION}})"
+    deps:
+      - check-tools
+    cmds:
+      - task: test
+      - |
+        sed -i.bak -E 's/^(version[[:space:]]*=[[:space:]]*")[^"]+(".*)$/\1{{.NEW_VERSION}}\2/' build.gradle.kts
+        rm -f build.gradle.kts.bak
+        echo "✅ Updated build.gradle.kts to version {{.NEW_VERSION}}"
+      - task: generate-changelog
+        vars: {VERSION: "{{.NEW_VERSION}}"}
+      - git add build.gradle.kts CHANGELOG.md {{.PLUGIN_XML}}
+      - 'git commit -m "chore(release): prepare release v{{.NEW_VERSION}}"'
+      - 'git tag -a "v{{.NEW_VERSION}}" -m "Release v{{.NEW_VERSION}}"'
+      - git push origin HEAD
+      - 'git push origin "v{{.NEW_VERSION}}"'
+      - echo "✅ Released v{{.NEW_VERSION}}"
+
   preview-changes:
     desc: Preview what changes would be made without updating files
     summary: |
@@ -253,6 +366,11 @@ tasks:
           preview-changes    - Preview changes without updating files
           clean-temp         - Clean temporary files
 
+        📦 Release Tasks:
+          release:major      - Release a major version (e.g. 0.5.6 → 1.0.0)
+          release:minor      - Release a minor version (e.g. 0.5.6 → 0.6.0)
+          release:patch      - Release a patch version (e.g. 0.5.6 → 0.5.7)
+
         Examples:
           # Development
           task build
@@ -260,7 +378,7 @@ tasks:
           task run-ide
           
           # Release
-          task generate-changelog VERSION=0.8.0
+          task release:patch
           task verify
           PUBLISH_TOKEN=xxx task publish
 
diff --git a/backlog/completed/task-209 - Track-feature-enablement-usage-analytics-RAG-Agent-MCP-Web-Search-....md b/backlog/completed/task-209 - Track-feature-enablement-usage-analytics-RAG-Agent-MCP-Web-Search-....md
new file mode 100644
index 00000000..8f6d0f5d
--- /dev/null
+++ b/backlog/completed/task-209 - Track-feature-enablement-usage-analytics-RAG-Agent-MCP-Web-Search-....md	
@@ -0,0 +1,288 @@
+---
+id: TASK-209
+title: 'Track feature enablement & usage analytics (RAG, Agent, MCP, Web Search, ...)'
+status: Done
+assignee: []
+created_date: '2026-04-13 13:13'
+updated_date: '2026-04-13 15:50'
+labels:
+  - analytics
+  - telemetry
+  - feature-tracking
+dependencies: []
+priority: medium
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+## Problem
+
+Today `AnalyticsService` only emits `prompt_executed` and `model_selected` with `provider_id` / `model_name` (src/main/java/com/devoxx/genie/service/analytics/AnalyticsService.java:40-79). We have no visibility into **which DevoxxGenie features developers enable vs actually use**, so product decisions about RAG, Agent, MCP, Web Search, Semantic Search, etc. are flying blind.
+
+The GenieBuilder admin panel (sibling repo `../GenieBuilder`) should be able to answer: _"What % of installs have RAG configured? How often is Agent mode actually invoked? How many MCP servers does the median install have configured?"_ — **without ever learning server names, URLs, commands, paths, project names, or custom prompt names.**
+
+## Goal
+
+Extend the existing consent-gated, anonymous, fire-and-forget GA4 pipeline (task-206 / task-208 guarantees preserved) with:
+
+1. **Feature enablement snapshot** — emitted **once per IDE session** (not per project), capturing which optional features are toggled ON and coarse counts.
+2. **Feature usage events** — emitted when a feature is actually exercised during a prompt.
+
+## Enablement vs Usage — source-of-truth mapping
+
+Enablement (settings flag) and usage (per-prompt activation) are **distinct signals** and both must be captured:
+
+| Feature          | Enablement (configured) | Usage (activated for this prompt) |
+|------------------|-------------------------|------------------------------------|
+| RAG              | `DevoxxGenieStateService.ragEnabled` | `ragActivated` (chat panel toggle; see `ChatMessageContextUtil`) |
+| Web Search       | `googleSearchEnabled` / `tavilySearchEnabled` | `webSearchActivated` |
+| Semantic Search  | RAG index present + ChromaDB reachable | `SemanticSearchService` invocation on the prompt |
+| Agent Mode       | `agentEnabled` | `AgentLoopTracker` ran ≥1 tool call |
+| MCP              | `mcpEnabled` + ≥1 configured server | MCP tool actually invoked during prompt |
+| Streaming        | `streamMode` | (same — not a per-prompt toggle) |
+| Project context  | n/a | "full project" or "selected files" attached to the prompt |
+| DEVOXXGENIE.md   | file exists at project root | auto-injected into system prompt |
+| Custom Prompts   | count of user-defined prompts | a built-in OR user-defined prompt command was used (boolean only) |
+| Chat memory      | `chatMemorySize` bucket | — |
+
+**Dropped from original draft:** Git Diff context — no `GitMergeService` / git-diff prompt feature exists in this repo. (VCS diff exists only inside Event Automation via `VcsCommitListener` and is out of scope here.) Event Automation and Spec-Driven Dev are deferred until those features ship.
+
+**Provider type:** emit `provider_type` = `local|cloud` derived from `ModelProvider` enum (src/main/java/com/devoxx/genie/model/enumarations/ModelProvider.java:10). Do **not** rely on GenieBuilder to maintain a provider map.
+
+## Event schema (resolves GA4 25-param limit)
+
+GA4 caps events at 25 params. The boolean+counts snapshot plus common params (`app_name`, `app_version`, `ide_version`, `session_id`, `engagement_time_msec`) would exceed this. **Decision:** emit **one `feature_enabled` event per enabled feature** with a shared shape, and a single `feature_used` event per usage.
+
+```
+feature_enabled
+  params: feature_id (enum), app_name, app_version, ide_version, session_id, engagement_time_msec
+feature_used
+  params: feature_id (enum), provider_type (local|cloud|none), tool_call_count (int bucket),
+          app_name, app_version, ide_version, session_id, engagement_time_msec
+feature_counts (one-shot, per session)
+  params: mcp_server_count, custom_prompt_count, chat_memory_bucket,
+          app_name, app_version, ide_version, session_id, engagement_time_msec
+```
+
+**`feature_id` is a closed allowlist enum:**
+`rag`, `semantic_search`, `web_search_google`, `web_search_tavily`, `agent`, `mcp`, `streaming`, `project_context_full`, `project_context_selected`, `devoxxgenie_md`, `custom_prompt`.
+
+**Counts are bucketed** (e.g., `0`, `1`, `2-5`, `6-10`, `11+`) — never raw counts that could fingerprint an install.
+
+## Privacy — hard rules
+
+The new events MUST NEVER include:
+- MCP server names, commands, URLs, env vars, or tool names (src/main/java/com/devoxx/genie/ui/settings/mcp/MCPSettingsComponent.java:834 contains all of these locally — none of it leaves the IDE).
+- User-defined custom prompt names or bodies (src/main/java/com/devoxx/genie/service/prompt/command/CustomPromptCommand.java:78). Only `custom_prompt_used=true` / bucketed count.
+- File paths, project names, file contents, prompt text, response text, API keys, host names, user identity.
+
+Enforcement:
+- A **closed param allowlist** per event in `AnalyticsService`. Unknown keys are dropped with a debug log and a unit-tested rejection path.
+- All new string params must be enum-typed (e.g., `feature_id`, `provider_type`). No free-form strings.
+- Unit test asserts that passing a path-shaped or URL-shaped value for any param causes the event to be dropped.
+
+## Emission points
+
+- **`feature_enabled` + `feature_counts`**: emitted from a new `AnalyticsSessionSnapshotService` (APP-level `@Service`) guarded by an `AtomicBoolean snapshotSent` keyed on `sessionId`. `PostStartupActivity` (src/main/java/com/devoxx/genie/service/PostStartupActivity.java:62) calls `snapshotIfNeeded()` — which is a no-op on the 2nd+ project open in the same IDE session. Re-armed on settings change via `GeneralSettingsConfigurable#apply`.
+- **`feature_used`**:
+  - Agent: `AgentLoopTracker` end-of-run hook, with bucketed `tool_call_count`.
+  - MCP: a new instrumenting **tool-provider wrapper** sitting above `FilteredMcpToolProvider` (src/main/java/com/devoxx/genie/service/mcp/FilteredMcpToolProvider.java:51) and composing with `ApprovalRequiredToolProvider` (src/main/java/com/devoxx/genie/service/mcp/ApprovalRequiredToolProvider.java:49). This covers both standalone MCP and MCP-inside-agent. Do **not** instrument `MCPExecutionService` — it is not the execution boundary.
+  - Web Search: `WebSearchPromptExecutionService`.
+  - Semantic Search: `SemanticSearchService`.
+  - RAG activation / project context / DEVOXXGENIE.md / custom prompts: `PromptExecutionService` / `MessageCreationService` at message assembly time, reading `ChatMessageContext`.
+
+## Consent & disclosure surfaces
+
+Every user-visible analytics disclosure must stay in sync before rollout:
+- `src/main/java/com/devoxx/genie/service/analytics/AnalyticsConsentNotifier.java:27` (first-run notice)
+- `src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsComponent.java:28` (settings disclosure block)
+- `src/main/resources/META-INF/plugin.xml:47` (marketplace description)
+
+## GenieBuilder admin UI (follow-up, out of scope here)
+
+File a sibling-repo task in `../GenieBuilder` to add a "Feature Usage" panel:
+- % of installs with each `feature_id` seen in `feature_enabled`
+- Daily/weekly `feature_used` trend per `feature_id`
+- `mcp_server_count` / `custom_prompt_count` bucket histograms
+- Filter by `app_version` / `ide_version` / `provider_type`
+
+## References
+
+- src/main/java/com/devoxx/genie/service/analytics/AnalyticsService.java — existing pipeline
+- src/main/java/com/devoxx/genie/ui/settings/DevoxxGenieStateService.java:71 — `ragEnabled` source of truth
+- src/main/java/com/devoxx/genie/util/ChatMessageContextUtil.java:44 — `ragActivated` per-prompt signal
+- src/main/java/com/devoxx/genie/model/enumarations/ModelProvider.java:10 — local/cloud/optional classification
+- src/main/java/com/devoxx/genie/service/mcp/FilteredMcpToolProvider.java:51 — MCP tool-provider boundary
+- src/main/java/com/devoxx/genie/service/mcp/ApprovalRequiredToolProvider.java:49 — MCP approval wrapper
+- src/main/java/com/devoxx/genie/service/PostStartupActivity.java:62 — per-project startup (not per-session)
+- task-206 — analytics disclosure list
+- task-208 — offline hardening precedent
+<!-- SECTION:DESCRIPTION:END -->
+
+## Acceptance Criteria
+<!-- AC:BEGIN -->
+- [x] #1 `feature_enabled` is emitted at most once per IDE session (not per opened project), guarded by an app-level `AtomicBoolean` keyed on the existing `sessionId`; unit test opens two projects and asserts a single emission
+- [x] #2 `feature_enabled` / `feature_used` / `feature_counts` schemas match the closed allowlist in the description; unknown params are dropped and the drop is unit-tested
+- [x] #3 `feature_id` is a closed enum (`rag`, `semantic_search`, `web_search_google`, `web_search_tavily`, `agent`, `mcp`, `streaming`, `project_context_full`, `project_context_selected`, `devoxxgenie_md`, `custom_prompt`); no free-form strings accepted
+- [x] #4 Enablement and usage are captured as separate events — snapshot reflects `ragEnabled`-style settings flags, `feature_used` reflects per-prompt activation (`ragActivated`, `webSearchActivated`, actual MCP tool invocation, etc.)
+- [x] #5 MCP tool invocations are counted via an instrumenting tool-provider wrapper composed with `FilteredMcpToolProvider` and `ApprovalRequiredToolProvider`, working for both standalone MCP and MCP-inside-agent; `MCPExecutionService` is NOT used as the counting point
+- [x] #6 `provider_type` = `local|cloud` is derived in-plugin from `ModelProvider` enum, not delegated to GenieBuilder
+- [x] #7 All counts (`mcp_server_count`, `custom_prompt_count`, `tool_call_count`, `chat_memory_bucket`) are emitted as coarse buckets, never raw integers
+- [x] #8 No new event ever carries MCP server names/URLs/commands/tool names, custom prompt names/bodies, file paths, project names, file contents, prompt text, API keys, host names, or user identity — enforced by allowlist + a unit test that passes path/URL-shaped values and asserts they are rejected
+- [x] #9 Git Diff context criterion is explicitly out of scope (no such feature exists in the repo); Event Automation and Spec-Driven Dev are deferred
+- [x] #10 Existing consent gates (`analyticsNoticeAcknowledged`, `analyticsEnabled`) suppress all new events when off — unit tested
+- [x] #11 All three disclosure surfaces are updated in lockstep: `AnalyticsConsentNotifier`, `GeneralSettingsComponent`, and `plugin.xml` marketplace description
+- [x] #12 Unit tests cover: snapshot one-shot guard, per-event allowlist rejection, consent-off suppression, offline fire-and-forget (task-208 regression), bucketing boundaries
+- [x] #13 GA4 schema is documented in a shared location (e.g., `docs/analytics-schema.md`) that both DevoxxGenie and GenieBuilder reference
+- [x] #14 Follow-up task filed in `../GenieBuilder` for the Feature Usage admin panel
+- [x] #15 `AnalyticsService.buildPayload` is refactored into a generic `AnalyticsEventBuilder` that takes `(eventName, Map<String,String>)` and enforces a closed per-event param allowlist; existing `prompt_executed` / `model_selected` events route through it and `AnalyticsServiceTest` still passes
+- [x] #16 ModelProvider.Type mapping is implemented as LOCAL→local, CLOUD→cloud, OPTIONAL→cloud; `provider_type` allowed values are strictly `local|cloud|none`; unit test covers each enum value
+- [x] #17 `Buckets` utility maps raw counts to the exact bucket strings in the task plan (`0`,`1`,`2-5`,`6-10`,`11+` for most; `0`,`1-5`,`6-10`,`11-20`,`21+` for chat_memory); boundary test covers each transition
+- [x] #18 `tool_call_count` is emitted as `"0"` for all `feature_used` events except `agent` and `mcp`; unit-tested
+- [x] #19 `streaming` emits `feature_enabled` when `streamMode=true` in the snapshot AND `feature_used` on every prompt when `streamMode=true`
+- [x] #20 Semantic Search enablement is derived from `ragEnabled` only; no ChromaDB network call is made during startup; `semantic_search` is emitted only as `feature_used` from inside `SemanticSearchService.search()`
+- [x] #21 `project_context_full`, `project_context_selected`, `semantic_search`, and `devoxxgenie_md` are usage-only feature_ids (rejected if passed to `trackFeatureEnabled`)
+- [x] #22 Snapshot re-arming is implemented via a central MessageBus topic `DevoxxGenieSettingsChangedTopic` subscribed by `AnalyticsSessionSnapshotService`, not per-panel `apply()` hooks; `AnalyticsConsentNotifier`'s Keep-Enabled action also triggers `snapshotIfNeeded()`
+- [x] #23 Agent `feature_used` is emitted from `StreamingPromptStrategy`, `NonStreamingPromptExecutionService`, AND `SubAgentRunner` after the chat finishes (success, error, or cancellation), each reading its own `AgentLoopTracker.getCallCount()`; sub-agent events are separate and do not double-count parent runs
+- [x] #24 `InstrumentedMcpToolProvider` sits in the wrapper stack as `ApprovalRequiredToolProvider → InstrumentedMcpToolProvider → FilteredMcpToolProvider → raw`; counts are incremented inside wrapped `ToolExecutor.execute()`, not inside `provideTools()`; works for both standalone-MCP and MCP-inside-agent paths
+- [x] #25 `ChatMessageContext` gains three new booleans (`projectContextFullUsed`, `projectContextSelectedUsed`, `devoxxGenieMdUsed`) set at the assembly sites named in the plan; `PromptExecutionService` reads them at prompt completion to emit the corresponding `feature_used` events
+- [x] #26 One `feature_used` event is emitted per activated `feature_id` per prompt (a prompt activating RAG + Web Search + Agent emits three events)
+- [x] #27 Disclosure copy in `AnalyticsConsentNotifier`, `GeneralSettingsComponent`, and `plugin.xml` is updated with the exact draft text in the task plan (feature enablement + feature usage bullets)
+- [x] #28 One-shot session guard is unit-tested without IntelliJ platform fixtures: instantiate `AnalyticsSessionSnapshotService`, call `snapshotIfNeeded()` twice, assert single HTTP request via recording HttpClient; then trigger re-arm and assert a second emission
+<!-- AC:END -->
+
+## Implementation Plan
+
+<!-- SECTION:PLAN:BEGIN -->
+## Pre-implementation decisions (resolved from review)
+
+### Provider type mapping (ModelProvider.Type → provider_type)
+- `Type.LOCAL` → `"local"` (Ollama, LMStudio, GPT4All, Jan, LLaMA.cpp, Exo, CustomOpenAI, CLIRunners, ACPRunners)
+- `Type.CLOUD` → `"cloud"` (OpenAI, Anthropic, Mistral, Groq, DeepInfra, Google, OpenRouter, DeepSeek, Grok, Kimi, GLM)
+- `Type.OPTIONAL` → `"cloud"` (Azure OpenAI, Bedrock — cloud-hosted enterprise endpoints)
+- Absent / unknown → `"none"`
+
+Allowed values in schema: `local | cloud | none`. No `optional` bucket — folded into `cloud`.
+
+### Bucket definitions (all counts, coarse, never raw)
+
+| Metric | Buckets |
+|--------|---------|
+| `mcp_server_count` | `0`, `1`, `2-5`, `6-10`, `11+` |
+| `custom_prompt_count` | `0`, `1`, `2-5`, `6-10`, `11+` |
+| `tool_call_count` | `0`, `1`, `2-5`, `6-10`, `11+` |
+| `chat_memory_bucket` | `0`, `1-5`, `6-10`, `11-20`, `21+` |
+
+A single `Buckets` utility class owns these mappings; unit test covers each boundary.
+
+### `tool_call_count` semantics
+- Only meaningful for `feature_id = agent` and `feature_id = mcp`.
+- For all other `feature_used` events, emit `"0"` (keeps GA4 schema flat; dashboard logic stays predictable).
+
+### Streaming usage rule
+- `feature_enabled` for `streaming` emitted from the session snapshot when `streamMode = true`.
+- `feature_used` for `streaming` emitted on **every prompt** when `streamMode = true`, alongside `prompt_executed`. Lets the admin panel compute "% of prompts streamed."
+
+### Semantic Search enablement — simplified
+- Enablement signal = `ragEnabled` only. No ChromaDB network probe on startup.
+- `semantic_search` appears **only as `feature_used`**, fired from inside `SemanticSearchService.search()` when it actually runs.
+
+### Usage-only `feature_id`s (never in `feature_enabled`)
+`project_context_full`, `project_context_selected`, `semantic_search`, `devoxxgenie_md` are **usage-only**. `devoxxgenie_md` enablement is derivable from `feature_used` frequency; we don't emit a separate enablement event for it to avoid per-project noise in a per-session snapshot.
+
+### Snapshot re-arming strategy
+- **Central listener, not per-panel hooks.** `AnalyticsSessionSnapshotService` subscribes to a MessageBus topic `DevoxxGenieSettingsChangedTopic` (new, published from `GeneralSettingsConfigurable#apply` and any other settings panel that toggles tracked features). On any settings change the service clears its `AtomicBoolean sent` flag and re-sends.
+- Also re-armed when the user clicks "OK, Keep Enabled" in `AnalyticsConsentNotifier` after setting `analyticsNoticeAcknowledged=true`.
+
+### Agent orchestrator — where to sample `AgentLoopTracker.getCallCount()`
+`AgentLoopTracker` is a `ToolProvider` wrapper with no end-of-run callback. The orchestrators that hold the tracker and invoke the LLM are:
+
+- `src/main/java/com/devoxx/genie/service/prompt/strategy/StreamingPromptStrategy.java` — streaming path
+- `src/main/java/com/devoxx/genie/service/prompt/response/nonstreaming/NonStreamingPromptExecutionService.java` — non-streaming path
+- `src/main/java/com/devoxx/genie/service/agent/SubAgentRunner.java` — parallel sub-agents spawned by `parallel_explore`
+
+Each orchestrator must, after the chat finishes (success, error, or cancellation), read `tracker.getCallCount()` and call `FeatureUsageTracker.agentCompleted(tracker.getCallCount(), providerType)`. Sub-agent completions emit their own `feature_used` events so the parent run's count isn't double-counted.
+
+### MCP wrapper stack order (outer → inner)
+`ApprovalRequiredToolProvider` → **`InstrumentedMcpToolProvider` (new)** → `FilteredMcpToolProvider` → raw `McpToolProvider`
+
+Rationale:
+- Sitting **below** `FilteredMcpToolProvider` means disabled-in-settings tools are never even exposed to the instrumenter, so we don't count filtered tools.
+- Sitting **below** `ApprovalRequiredToolProvider` means denied-by-user tools are never executed through us, so we count actual approved executions only.
+- The instrumenter counts inside the wrapped `ToolExecutor.execute()` call, **not** inside `provideTools()` (the LLM framework may call `provideTools` speculatively). One event per actual execution.
+
+Works identically for standalone MCP mode and MCP-inside-agent mode (agent wraps the same MCP provider chain).
+
+### New ChatMessageContext fields
+Add three booleans set at message assembly time:
+
+- `projectContextFullUsed` — set in `ChatMessageContextUtil.setWindowContext()` when full-project context is attached.
+- `projectContextSelectedUsed` — set when `pendingAttachedFiles` / selected files are processed.
+- `devoxxGenieMdUsed` — set in `ChatMemoryManager.buildSystemPrompt()` (or wherever `DEVOXXGENIE.md` is read into the system prompt).
+
+`PromptExecutionService` reads these at prompt completion and emits the corresponding `feature_used` events.
+
+### AnalyticsService payload refactor
+Before adding any new event, refactor `AnalyticsService.buildPayload()` (src/main/java/com/devoxx/genie/service/analytics/AnalyticsService.java:173-193) which today hardcodes `provider_id` / `model_name`:
+
+1. Extract payload assembly into a new `AnalyticsEventBuilder` that takes `(String eventName, Map<String,String> params)` and enforces the **closed per-event allowlist** (unknown keys dropped with debug log + counter).
+2. Route existing `trackPromptExecuted` / `trackModelSelected` through the new builder (behavior-preserving, covered by existing `AnalyticsServiceTest`).
+3. Add `trackFeatureEnabled(featureId)`, `trackFeatureUsed(featureId, providerType, toolCallCountBucket)`, `trackFeatureCounts(...)` as thin wrappers over the generic path.
+4. All allowlist enforcement lives in one place; call sites can't accidentally leak.
+
+### Draft disclosure copy (lockstep update across the three surfaces)
+
+Add to the "What is sent" bullet list in `AnalyticsConsentNotifier`, `GeneralSettingsComponent`, and the `plugin.xml` marketplace description:
+
+> - Which optional features are enabled (e.g., RAG, Agent mode, MCP, Web Search) and coarse counts such as the number of configured MCP servers or custom prompts — never server names, URLs, commands, or user-defined prompt names.
+> - Which features are actually used during a prompt (e.g., RAG, Agent, MCP, Web Search, project context, custom prompts) — feature identifiers only, never prompt text or file content.
+
+### `feature_used` event multiplicity
+**One `feature_used` event per activated `feature_id` per prompt.** A prompt that activates RAG + Web Search + Agent emits three events. This is consistent with the GA4 25-param workaround (one feature per event) and keeps the dashboard aggregation trivial.
+
+### New classes to introduce
+
+1. `AnalyticsEventBuilder` — generic `Map → JSON` payload builder + per-event allowlist.
+2. `AnalyticsSessionSnapshotService` (APP-level `@Service`) — reads `DevoxxGenieStateService`, emits `feature_enabled` per enabled feature + `feature_counts`, guarded by `AtomicBoolean sent` on the existing `sessionId`. Package-private accessor for test inspection (no full platform fixture needed).
+3. `InstrumentedMcpToolProvider` — MCP tool-provider wrapper counting actual `ToolExecutor.execute()` invocations.
+4. `FeatureUsageTracker` — thin static helper called from `PromptExecutionService`, `WebSearchPromptExecutionService`, `SemanticSearchService`, the agent orchestrators, and `InstrumentedMcpToolProvider`.
+5. `Buckets` — count → bucket-string mapping utility with unit-tested boundaries.
+
+### Testability of the one-shot guard
+Unit test does **not** launch two IntelliJ projects. Instead it:
+1. Instantiates `AnalyticsSessionSnapshotService` directly.
+2. Calls `snapshotIfNeeded()` twice.
+3. Asserts exactly one HTTP request captured by the recording `HttpClient` (same pattern as existing `AnalyticsServiceTest`).
+4. Calls the MessageBus re-arm path and asserts a second emission fires.
+<!-- SECTION:PLAN:END -->
+
+## Final Summary
+
+<!-- SECTION:FINAL_SUMMARY:BEGIN -->
+Shipped the task-209 analytics pipeline across three commits on `feature/task-209-feature-usage-analytics`.
+
+## What landed
+
+**Foundation** — new `AnalyticsEventBuilder` with closed per-event allowlists + shape/length rejection (path, URL, newline, Windows drive letter, >128 chars); `FeatureId` / `ProviderType` / `Buckets` utilities; `AnalyticsService` refactored to route all events through the builder while preserving existing behavior.
+
+**Session snapshot** — `AnalyticsSessionSnapshotService` (APP-level `@Service`), `AtomicBoolean`-guarded one-shot per IDE session. Preflights consent gates before burning the guard so the first opted-in session still emits. Re-arms via `DevoxxGenieSettingsChangedTopic` MessageBus, with fail-silent `notifySettingsChanged()` helper wired into all five settings panels (General, RAG, MCP, WebSearch, Agent).
+
+**Per-prompt instrumentation** — `InstrumentedMcpToolProvider` counts real `ToolExecutor.execute()` invocations in stack order `Approval → Instrumented → Filtered → raw`. `AgentToolProviderFactory` threads the per-prompt counter through so MCP-inside-agent is also counted. `FeatureUsageTracker` static facade emits `feature_used` events from `PromptExecutionService.task.whenComplete`, reading `ChatMessageContext` flags set at assembly time (RAG / web search mirrored from `DevoxxGenieStateService`, project-context booleans set in `ChatMessageContextUtil`, `devoxxGenieMdUsed` in `ChatMemoryManager.buildSystemPrompt`). Agent events emitted from `StreamingPromptStrategy`, `NonStreamingPromptExecutionService`, and `SubAgentRunner` (each with its own tracker, no double-counting). Semantic search emits from `MessageCreationService` where the `LanguageModel` is in scope so `provider_type` is correct.
+
+**Disclosure lockstep** — `AnalyticsConsentNotifier`, `GeneralSettingsComponent`, and `plugin.xml` marketplace description all updated in lockstep with the new bullets for feature enablement and per-prompt usage.
+
+**Docs** — `docs/analytics-schema.md` as the shared source of truth for GenieBuilder and any future consumer.
+
+**Follow-ups** — `task-210` in this repo and `task-197` in `../GenieBuilder` filed with concrete file:line edits for the three-file minimum path (TRACKED_EVENTS, EVENT_LABELS, EVENT_CATEGORIES) and the full Feature Usage panel build-out. The GenieBuilder task includes the six GA4 custom dimensions to register.
+
+## Tests
+
+~35 analytics-focused tests across `AnalyticsServiceTest` (existing, behavior-preserving), `AnalyticsEventBuilderTest`, `AnalyticsSessionSnapshotServiceTest`, `BucketsTest`, `ProviderTypeTest`, `InstrumentedMcpToolProviderTest`, `FeatureUsageTrackerTest`. Full project suite green. AC #12's task-208 offline fire-and-forget regression is covered by the existing `AnalyticsServiceTest.asyncNetworkFailureIsSilent` test, which now runs through the refactored `AnalyticsEventBuilder` path.
+
+All 28 acceptance criteria satisfied.
+
+---
+
+**PR:** https://github.com/devoxx/DevoxxGenieIDEAPlugin/pull/1008
+<!-- SECTION:FINAL_SUMMARY:END -->
diff --git a/backlog/tasks/task-210 - GenieBuilder-admin-UI-Feature-Usage-panel-for-DevoxxGenie-analytics.md b/backlog/tasks/task-210 - GenieBuilder-admin-UI-Feature-Usage-panel-for-DevoxxGenie-analytics.md
new file mode 100644
index 00000000..6ba83a5d
--- /dev/null
+++ b/backlog/tasks/task-210 - GenieBuilder-admin-UI-Feature-Usage-panel-for-DevoxxGenie-analytics.md	
@@ -0,0 +1,73 @@
+---
+id: TASK-210
+title: 'GenieBuilder admin UI: Feature Usage panel for DevoxxGenie analytics'
+status: To Do
+assignee: []
+created_date: '2026-04-13 14:14'
+labels:
+  - analytics
+  - geniebuilder
+  - admin-ui
+dependencies:
+  - TASK-209
+priority: medium
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+## Context
+
+Task-209 extended the DevoxxGenie IntelliJ plugin's GA4 analytics pipeline with three new event types:
+
+- `feature_enabled` — one event per enabled feature, per IDE session
+- `feature_used` — one event per activated feature, per prompt
+- `feature_counts` — one event per session with bucketed counts
+
+See the shared schema doc: `../DevoxxGenieIDEAPlugin/docs/analytics-schema.md` (source of truth for both repos).
+
+The plugin already emits these events (consent-gated, anonymous, PII-free). The GenieBuilder admin panel needs a matching "Feature Usage" dashboard so product decisions about RAG / Agent / MCP / Web Search investment can be data-driven instead of guessed.
+
+## Goal
+
+Surface DevoxxGenie feature analytics in a new "Feature Usage" admin panel filtered by `app_name=devoxxgenie-intellij`. The panel should answer:
+
+1. What % of installs have each optional feature enabled?
+2. Which features are actually used during prompts (per-feature trend)?
+3. How many MCP servers / custom prompts does the median install have configured?
+4. How does usage break down by `provider_type` (local vs cloud)?
+5. How does usage trend across plugin and IDE versions?
+
+## Proposed UI
+
+- **Top row**: donut + stacked-bar of `feature_enabled` events grouped by `feature_id` — % of installs with each feature on, filtered to the most recent N days.
+- **Middle row**: daily/weekly `feature_used` trend lines, one per `feature_id`. Toggle between count-of-events and unique-install count.
+- **Bottom row**: histogram of `mcp_server_count`, `custom_prompt_count`, and `chat_memory_bucket` from `feature_counts` events.
+- **Filters**: `app_version`, `ide_version`, `provider_type`, date range.
+- **Drill-down table**: top recent `feature_used` events with bucketed `tool_call_count`.
+
+Implementation is flexible — match the existing GenieBuilder admin conventions.
+
+## Acceptance Criteria
+<!-- AC:BEGIN -->
+- [ ] #1 Feature Usage admin panel exists with enablement donut/bar, per-feature usage trend, and counts histogram sections
+- [ ] #2 Panel respects `app_name=devoxxgenie-intellij` filter and supports `app_version`/`ide_version`/`provider_type`/date-range filters
+- [ ] #3 All rendered values come from the closed enum allowlists documented in `docs/analytics-schema.md` — no free-form strings surfaced
+- [ ] #4 Panel handles zero-data edge cases (brand-new install, unseen feature_id) gracefully
+- [ ] #5 Documentation updated to reference the shared analytics schema doc in the DevoxxGenie repo
+
+## References
+
+- `../DevoxxGenieIDEAPlugin/docs/analytics-schema.md` — event shapes, feature_id allowlist, bucket tables, provider_type mapping
+- `../DevoxxGenieIDEAPlugin/src/main/java/com/devoxx/genie/service/analytics/AnalyticsEventBuilder.java` — plugin-side allowlist enforcement
+- DevoxxGenie task-206 — original analytics opt-in pipeline
+- DevoxxGenie task-208 — offline hardening
+- DevoxxGenie task-209 — feature enablement + usage events (this task is the admin-UI follow-up)
+
+## Out of scope
+
+- Changing the GA4 schema — schema changes must go through DevoxxGenie first and update the shared doc.
+- Adding new per-install dimensions — the plugin only sends what's in the schema.
+- Displaying MCP server names, URLs, commands, tool names, or user-defined prompt names — these are deliberately never emitted by the plugin.
+<!-- SECTION:DESCRIPTION:END -->
+<!-- AC:END -->
diff --git a/docs/analytics-schema.md b/docs/analytics-schema.md
new file mode 100644
index 00000000..de7c4f33
--- /dev/null
+++ b/docs/analytics-schema.md
@@ -0,0 +1,188 @@
+# DevoxxGenie Analytics Schema
+
+This document is the shared GA4 event schema for DevoxxGenie (IntelliJ plugin) and the
+GenieBuilder admin UI. Both projects MUST agree on this schema before changes ship.
+
+## Guarantees
+
+- **Consent-gated.** Nothing is sent unless `analyticsNoticeAcknowledged` AND
+  `analyticsEnabled` are both true in `DevoxxGenieStateService`.
+- **Anonymous.** Client ID is a locally-generated UUID; session ID is a random 10-digit
+  integer re-rolled on every IDE launch.
+- **Fire-and-forget.** All POSTs are async and never block the EDT; failures are silent.
+- **Closed allowlists.** Every event has a closed per-event param allowlist enforced in
+  `AnalyticsEventBuilder`. Unknown params are dropped and the event is not sent.
+- **Enum-typed.** `feature_id`, `provider_type`, and every bucketed count are closed enums.
+  Free-form values (`provider_id`, `model_name`) are accepted but pass through a shape
+  filter that rejects absolute paths, URLs (`://`), newlines, and values over 128 chars.
+- **No PII.** The schema NEVER carries prompt text, response text, file content, file
+  paths, project names, MCP server names/URLs/commands, tool names, user-defined custom
+  prompt names, API keys, user identity, git remotes, token counts, or cost data.
+
+## Transport
+
+All events are sent as a single GA4 Measurement Protocol POST per event:
+
+```
+POST {analyticsEndpoint}
+Content-Type: application/json
+
+{
+  "client_id": "<uuid>",
+  "events": [{
+    "name": "<event_name>",
+    "params": { ... }
+  }]
+}
+```
+
+The endpoint is configured via `DevoxxGenieStateService.analyticsEndpoint` and routes through
+the shared GenieBuilder Cloudflare worker. DevoxxGenie traffic is segmented from GenieBuilder
+Electron traffic by `params.app_name = "devoxxgenie-intellij"`.
+
+## Common params (attached to every event)
+
+| Param | Type | Description |
+|-------|------|-------------|
+| `app_name` | string constant | Always `devoxxgenie-intellij` |
+| `app_version` | string | Plugin version from `plugin.xml` |
+| `ide_version` | string | IntelliJ full version from `ApplicationInfo` |
+| `session_id` | 10-digit int as string | Re-rolled per IDE launch |
+| `engagement_time_msec` | int literal `1` | GA4 requires non-zero engagement |
+
+## Events
+
+### `prompt_executed` (task-206)
+
+Fired once per LLM prompt dispatch (after local slash-command handling, before network).
+
+| Param | Allowed values | Example |
+|-------|----------------|---------|
+| `provider_id` | free-form, shape-filtered | `anthropic` |
+| `model_name` | free-form, shape-filtered | `claude-3-5-sonnet` |
+
+### `model_selected` (task-206)
+
+Fired when the user changes the selected model in the LLM picker.
+
+| Param | Allowed values | Example |
+|-------|----------------|---------|
+| `provider_id` | free-form, shape-filtered | `ollama` |
+| `model_name` | free-form, shape-filtered | `llama3` |
+
+### `feature_enabled` (task-209)
+
+One event per enabled feature, emitted in the session-enablement snapshot. Emitted at most
+once per IDE session (`AtomicBoolean`-guarded) and re-armed on settings change via
+`DevoxxGenieSettingsChangedTopic`.
+
+| Param | Allowed values |
+|-------|----------------|
+| `feature_id` | `rag`, `web_search_google`, `web_search_tavily`, `agent`, `mcp`, `streaming`, `custom_prompt` |
+
+**Usage-only feature IDs** (`semantic_search`, `project_context_full`,
+`project_context_selected`, `devoxxgenie_md`) are explicitly **rejected** if passed to
+`trackFeatureEnabled` — they only appear as `feature_used`.
+
+### `feature_used` (task-209)
+
+One event per activated feature, per prompt. A prompt that activates RAG + Web Search +
+Agent emits three events.
+
+| Param | Allowed values |
+|-------|----------------|
+| `feature_id` | `rag`, `semantic_search`, `web_search_google`, `web_search_tavily`, `agent`, `mcp`, `streaming`, `project_context_full`, `project_context_selected`, `devoxxgenie_md`, `custom_prompt` |
+| `provider_type` | `local`, `cloud`, `none` |
+| `tool_call_count` | `0`, `1`, `2-5`, `6-10`, `11+` |
+
+`tool_call_count` is only semantically meaningful for `feature_id = agent` and
+`feature_id = mcp`. All other usage events emit `"0"` — a deliberate constant to keep the
+schema flat and dashboard logic predictable.
+
+### `feature_counts` (task-209)
+
+One event per IDE session, emitted alongside the `feature_enabled` snapshot.
+
+| Param | Allowed values |
+|-------|----------------|
+| `mcp_server_count` | `0`, `1`, `2-5`, `6-10`, `11+` |
+| `custom_prompt_count` | `0`, `1`, `2-5`, `6-10`, `11+` |
+| `chat_memory_bucket` | `0`, `1-5`, `6-10`, `11-20`, `21+` |
+
+## Enum reference
+
+### `feature_id` (closed set)
+
+| Wire value | Source of truth (plugin) | Usage-only |
+|------------|--------------------------|:---:|
+| `rag` | `DevoxxGenieStateService.ragEnabled` / `ChatMessageContext.ragActivated` | |
+| `semantic_search` | `SemanticSearchService.search()` invocation | ✓ |
+| `web_search_google` | `isGoogleSearchEnabled` / `webSearchActivated` | |
+| `web_search_tavily` | `isTavilySearchEnabled` / `webSearchActivated` | |
+| `agent` | `agentModeEnabled` / `AgentLoopTracker.getCallCount()` | |
+| `mcp` | `mcpEnabled` + configured server / `InstrumentedMcpToolProvider` counter | |
+| `streaming` | `streamMode` | |
+| `project_context_full` | `ChatMessageContext.projectContextFullUsed` | ✓ |
+| `project_context_selected` | `ChatMessageContext.projectContextSelectedUsed` | ✓ |
+| `devoxxgenie_md` | `ChatMessageContext.devoxxGenieMdUsed` | ✓ |
+| `custom_prompt` | `ChatMessageContext.commandName != null` / `DevoxxGenieStateService.customPrompts` | |
+
+### `provider_type` mapping from `ModelProvider.Type`
+
+| `ModelProvider.Type` | Wire value | Providers |
+|----------------------|------------|-----------|
+| `LOCAL` | `local` | Ollama, LMStudio, GPT4All, Jan, LLaMA.cpp, Exo, CustomOpenAI, CLIRunners, ACPRunners |
+| `CLOUD` | `cloud` | OpenAI, Anthropic, Mistral, Groq, DeepInfra, Google, OpenRouter, DeepSeek, Grok, Kimi, GLM |
+| `OPTIONAL` | `cloud` | Azure OpenAI, Bedrock (enterprise cloud endpoints) |
+| _no model_ | `none` | (fallback) |
+
+`OPTIONAL` is folded into `cloud` deliberately — both are cloud-hosted, they just require
+extra setup. The wire schema has no `optional` value.
+
+### Bucket ladders
+
+**Standard** — for `mcp_server_count`, `custom_prompt_count`, `tool_call_count`:
+
+| Raw | Bucket |
+|-----|--------|
+| ≤0  | `0`    |
+| 1   | `1`    |
+| 2–5 | `2-5`  |
+| 6–10| `6-10` |
+| ≥11 | `11+`  |
+
+**Chat memory** — for `chat_memory_bucket`:
+
+| Raw | Bucket |
+|-----|--------|
+| ≤0   | `0`     |
+| 1–5  | `1-5`   |
+| 6–10 | `6-10`  |
+| 11–20| `11-20` |
+| ≥21  | `21+`   |
+
+## Validation layers
+
+Every event goes through `AnalyticsEventBuilder.build()` which enforces, in order:
+
+1. Event name must be in `EVENT_ALLOWLIST`.
+2. Every event-specific param key must be in the allowlist for that event.
+3. Every enum-typed param value must be in `ENUM_VALUE_ALLOWLIST[param]`.
+4. Every string value must pass `rejectShape()`: no leading `/` or `\`, no `://`, no
+   newlines, ≤ 128 characters.
+5. Every common param must be in `COMMON_PARAM_KEYS`.
+
+A failure at any layer drops the event and logs at debug level. The caller sees `null`
+and silently does not send.
+
+## Changing the schema
+
+Any change to the schema (new event, new param, new enum value) MUST:
+
+1. Update this document.
+2. Update the disclosure copy in all three lockstep surfaces:
+   `AnalyticsConsentNotifier`, `GeneralSettingsComponent`, `plugin.xml` marketplace description.
+3. Update `AnalyticsEventBuilder.EVENT_ALLOWLIST` / `ENUM_VALUE_ALLOWLIST`.
+4. Add unit tests to `AnalyticsEventBuilderTest` asserting both positive acceptance and
+   rejection of the boundary.
+5. File a matching task in the GenieBuilder repo so the admin UI stays in sync.
diff --git a/src/main/java/com/devoxx/genie/model/request/ChatMessageContext.java b/src/main/java/com/devoxx/genie/model/request/ChatMessageContext.java
index dba13a3d..c0479c1e 100644
--- a/src/main/java/com/devoxx/genie/model/request/ChatMessageContext.java
+++ b/src/main/java/com/devoxx/genie/model/request/ChatMessageContext.java
@@ -11,6 +11,7 @@
 
 import java.time.LocalDateTime;
 import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
 import com.intellij.openapi.vfs.VirtualFile;
 
 /**
@@ -41,6 +42,18 @@ public class ChatMessageContext {
     private boolean webSearchActivated;
     private String tabId;
 
+    // Feature-usage signals for task-209 analytics. Set at message-assembly time, read at
+    // prompt completion to emit `feature_used` events. Never contain user content.
+    private boolean projectContextFullUsed;
+    private boolean projectContextSelectedUsed;
+    private boolean devoxxGenieMdUsed;
+
+    // Thread-safe counter for MCP tool invocations performed during this prompt. Incremented
+    // by {@code InstrumentedMcpToolProvider} inside the wrapped ToolExecutor.execute() path,
+    // so only actually-executed approved calls are counted.
+    @Builder.Default
+    private final AtomicInteger mcpCallCount = new AtomicInteger(0);
+
     @Builder.Default
     private boolean webSearchRequested = false;
 
diff --git a/src/main/java/com/devoxx/genie/service/MessageCreationService.java b/src/main/java/com/devoxx/genie/service/MessageCreationService.java
index 7ed5ce82..fe6b1a49 100644
--- a/src/main/java/com/devoxx/genie/service/MessageCreationService.java
+++ b/src/main/java/com/devoxx/genie/service/MessageCreationService.java
@@ -206,6 +206,10 @@ private void constructUserMessageWithCombinedContext(@NotNull ChatMessageContext
             Map<String, SearchResult> searchResults =
                     semanticSearchService.search(chatMessageContext.getProject(), chatMessageContext.getUserPrompt());
 
+            // Task-209: emit feature_used with the real provider_type from the active model.
+            com.devoxx.genie.service.analytics.FeatureUsageTracker.semanticSearchUsed(
+                    chatMessageContext.getLanguageModel());
+
             if (!searchResults.isEmpty()) {
                 List<SemanticFile> fileReferences = extractFileReferences(searchResults);
 
diff --git a/src/main/java/com/devoxx/genie/service/PostStartupActivity.java b/src/main/java/com/devoxx/genie/service/PostStartupActivity.java
index 1118588e..6db6c2e3 100644
--- a/src/main/java/com/devoxx/genie/service/PostStartupActivity.java
+++ b/src/main/java/com/devoxx/genie/service/PostStartupActivity.java
@@ -1,6 +1,7 @@
 package com.devoxx.genie.service;
 
 import com.devoxx.genie.service.analytics.AnalyticsConsentNotifier;
+import com.devoxx.genie.service.analytics.AnalyticsSessionSnapshotService;
 import com.devoxx.genie.service.automation.listeners.BuildCompilationListener;
 import com.devoxx.genie.service.automation.listeners.FileEventListener;
 import com.devoxx.genie.service.automation.listeners.FileSaveListener;
@@ -62,6 +63,9 @@ public Object execute(@NotNull Project project, @NotNull Continuation<? super Un
         // First-launch analytics consent notification (task-206). Self-disables after firing once.
         AnalyticsConsentNotifier.maybeShow(project);
 
+        // Feature enablement snapshot — app-level, emitted at most once per IDE session (task-209).
+        AnalyticsSessionSnapshotService.getInstance().snapshotIfNeeded();
+
         return Unit.INSTANCE;
     }
 
diff --git a/src/main/java/com/devoxx/genie/service/agent/AgentToolProviderFactory.java b/src/main/java/com/devoxx/genie/service/agent/AgentToolProviderFactory.java
index 0e785ba2..9484b80a 100644
--- a/src/main/java/com/devoxx/genie/service/agent/AgentToolProviderFactory.java
+++ b/src/main/java/com/devoxx/genie/service/agent/AgentToolProviderFactory.java
@@ -13,6 +13,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
 
 /**
  * Factory that assembles the agent tool provider chain:
@@ -33,6 +34,17 @@ private AgentToolProviderFactory() {
      */
     @Nullable
     public static ToolProvider createToolProvider(@NotNull Project project) {
+        return createToolProvider(project, null);
+    }
+
+    /**
+     * Same as {@link #createToolProvider(Project)} but threads an optional per-prompt MCP
+     * call counter through to {@link MCPExecutionService#createRawMCPToolProvider(AtomicInteger)}
+     * so MCP-inside-agent invocations are counted for task-209 analytics (AC #24).
+     */
+    @Nullable
+    public static ToolProvider createToolProvider(@NotNull Project project,
+                                                  @Nullable AtomicInteger mcpCallCounter) {
         DevoxxGenieStateService settings = DevoxxGenieStateService.getInstance();
 
         if (!Boolean.TRUE.equals(settings.getAgentModeEnabled())) {
@@ -47,7 +59,7 @@ public static ToolProvider createToolProvider(@NotNull Project project) {
 
         // Add MCP tools if MCP is also enabled
         if (MCPService.isMCPEnabled()) {
-            ToolProvider mcpProvider = getMcpToolProviderWithoutApproval(project);
+            ToolProvider mcpProvider = getMcpToolProviderWithoutApproval(project, mcpCallCounter);
             if (mcpProvider != null) {
                 providers.add(mcpProvider);
             }
@@ -86,9 +98,11 @@ public static ToolProvider createToolProvider(@NotNull Project project) {
      * determines available tools at runtime.
      */
     @Nullable
-    private static ToolProvider getMcpToolProviderWithoutApproval(@NotNull Project project) {
+    private static ToolProvider getMcpToolProviderWithoutApproval(@NotNull Project project,
+                                                                  @Nullable AtomicInteger mcpCallCounter) {
         try {
-            ToolProvider provider = MCPExecutionService.getInstance().createRawMCPToolProvider();
+            ToolProvider provider = MCPExecutionService.getInstance()
+                    .createRawMCPToolProvider(mcpCallCounter);
             if (provider != null) {
                 log.info("MCP tool provider included in agent tool chain");
             } else {
diff --git a/src/main/java/com/devoxx/genie/service/agent/SubAgentRunner.java b/src/main/java/com/devoxx/genie/service/agent/SubAgentRunner.java
index 6048bfd5..57783c3b 100644
--- a/src/main/java/com/devoxx/genie/service/agent/SubAgentRunner.java
+++ b/src/main/java/com/devoxx/genie/service/agent/SubAgentRunner.java
@@ -4,7 +4,12 @@
 import com.devoxx.genie.chatmodel.ChatModelFactoryProvider;
 import com.devoxx.genie.model.CustomChatModel;
 import com.devoxx.genie.model.agent.SubAgentConfig;
+import com.devoxx.genie.model.enumarations.ModelProvider;
 import com.devoxx.genie.service.agent.tool.ReadOnlyToolProvider;
+import com.devoxx.genie.service.analytics.AnalyticsService;
+import com.devoxx.genie.service.analytics.Buckets;
+import com.devoxx.genie.service.analytics.FeatureId;
+import com.devoxx.genie.service.analytics.ProviderType;
 import com.devoxx.genie.ui.settings.DevoxxGenieStateService;
 import com.intellij.openapi.project.Project;
 import dev.langchain4j.memory.chat.MessageWindowChatMemory;
@@ -111,6 +116,32 @@ public SubAgentRunner(@NotNull Project project, int agentIndex, @NotNull AtomicB
         } catch (Exception e) {
             log.error("Sub-agent #{} failed", agentIndex + 1, e);
             return SUB_AGENT + (agentIndex + 1) + " error: " + e.getMessage();
+        } finally {
+            emitAgentFeatureUsed();
+        }
+    }
+
+    /**
+     * Emits a separate `agent` feature_used event for this sub-agent (task-209 AC #23).
+     * Fires on success, error, and cancellation — mirrors the parent orchestrator pattern.
+     * Sub-agent events are independent of the parent's event so the parent run isn't
+     * double-counted.
+     */
+    private void emitAgentFeatureUsed() {
+        if (tracker == null) return;
+        try {
+            ProviderType providerType = ProviderType.NONE;
+            if (resolvedProviderName != null && !resolvedProviderName.isEmpty()) {
+                try {
+                    providerType = ProviderType.fromModelProvider(ModelProvider.fromString(resolvedProviderName));
+                } catch (IllegalArgumentException ignored) {
+                    // Unknown provider name — fall through to NONE.
+                }
+            }
+            AnalyticsService.getInstance().trackFeatureUsed(
+                    FeatureId.AGENT, providerType, Buckets.standard(tracker.getCallCount()));
+        } catch (Exception e) {
+            log.debug("Sub-agent analytics tracking skipped: {}", e.getMessage());
         }
     }
 
diff --git a/src/main/java/com/devoxx/genie/service/analytics/AnalyticsConsentNotifier.java b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsConsentNotifier.java
index 3186d285..2b57206c 100644
--- a/src/main/java/com/devoxx/genie/service/analytics/AnalyticsConsentNotifier.java
+++ b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsConsentNotifier.java
@@ -25,15 +25,18 @@ public final class AnalyticsConsentNotifier {
     private static final String TITLE = "DevoxxGenie usage analytics";
 
     private static final String CONTENT =
-            "<html>To guide which LLM providers and models we invest engineering effort in, " +
+            "<html>To guide which features and LLM providers we invest engineering effort in, " +
                     "DevoxxGenie collects <b>anonymous</b> usage data when you run a prompt or change models:" +
                     "<ul>" +
                     "<li>Anonymous install ID, per-launch session ID, plugin version, IDE version</li>" +
                     "<li>LLM provider name and model name</li>" +
+                    "<li>Which optional features are enabled (RAG, Agent, MCP, Web Search) and coarse counts</li>" +
+                    "<li>Which features are actually used during a prompt (feature identifiers only)</li>" +
                     "</ul>" +
                     "<b>We never send</b> prompt text, response text, file content, file paths, project names, " +
-                    "API keys, or anything that could identify you. " +
-                    "You can change this any time in <i>Settings → DevoxxGenie → General</i>." +
+                    "API keys, MCP server names/URLs/commands, user-defined prompt names, or anything " +
+                    "that could identify you. " +
+                    "You can change this any time in <i>Settings → DevoxxGenie → Analytics</i>." +
                     "</html>";
 
     private AnalyticsConsentNotifier() {
@@ -60,6 +63,8 @@ public static void maybeShow(@NotNull Project project) {
                 @Override
                 public void actionPerformed(@NotNull AnActionEvent e) {
                     DevoxxGenieStateService.getInstance().setAnalyticsNoticeAcknowledged(true);
+                    // Analytics just became eligible — emit the feature-enablement snapshot (task-209).
+                    AnalyticsSessionSnapshotService.getInstance().snapshotIfNeeded();
                     notification.expire();
                 }
             });
diff --git a/src/main/java/com/devoxx/genie/service/analytics/AnalyticsEventBuilder.java b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsEventBuilder.java
new file mode 100644
index 00000000..53742112
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsEventBuilder.java
@@ -0,0 +1,217 @@
+package com.devoxx.genie.service.analytics;
+
+import lombok.extern.slf4j.Slf4j;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * Generic GA4 payload builder with strict per-event parameter allowlists (task-209, AC #2, #8, #15).
+ *
+ * <p>All analytics events flow through this single class. It enforces:
+ * <ul>
+ *   <li><strong>Closed per-event allowlist</strong> — unknown event-specific params are rejected
+ *       and the whole payload is dropped. No "pass through unknown keys" path exists.</li>
+ *   <li><strong>Closed enum value allowlist</strong> — params like {@code feature_id} /
+ *       {@code provider_type} / bucketed counts may only take values this class knows about.</li>
+ *   <li><strong>Shape rejection</strong> — values that look like absolute paths, URLs, or
+ *       multi-line strings are rejected defensively, even for free-form params like
+ *       {@code provider_id} and {@code model_name}.</li>
+ *   <li><strong>Length cap</strong> — any param value over 128 chars is rejected.</li>
+ * </ul>
+ *
+ * <p>On rejection, {@link #build} returns {@code null} and logs at debug level. Callers treat
+ * {@code null} as "do not send" — consistent with the fire-and-forget privacy default.
+ */
+@Slf4j
+public final class AnalyticsEventBuilder {
+
+    /** Common params attached to every event. */
+    static final Set<String> COMMON_PARAM_KEYS = Set.of(
+            "app_name", "app_version", "ide_version", "session_id");
+
+    /** Closed per-event allowlists of event-specific param keys. Common params are always allowed. */
+    static final Map<String, Set<String>> EVENT_ALLOWLIST = Map.of(
+            AnalyticsService.EVENT_PROMPT_EXECUTED, Set.of("provider_id", "model_name"),
+            AnalyticsService.EVENT_MODEL_SELECTED,  Set.of("provider_id", "model_name"),
+            AnalyticsService.EVENT_FEATURE_ENABLED, Set.of("feature_id"),
+            AnalyticsService.EVENT_FEATURE_USED,    Set.of("feature_id", "provider_type", "tool_call_count"),
+            AnalyticsService.EVENT_FEATURE_COUNTS,  Set.of("mcp_server_count", "custom_prompt_count", "chat_memory_bucket")
+    );
+
+    /** Closed enum-value allowlists keyed by param name. Params absent here are free-form (subject to shape/length checks). */
+    static final Map<String, Set<String>> ENUM_VALUE_ALLOWLIST = Map.of(
+            "feature_id", Set.of(
+                    "rag", "semantic_search", "web_search_google", "web_search_tavily",
+                    "agent", "mcp", "streaming", "project_context_full",
+                    "project_context_selected", "devoxxgenie_md", "custom_prompt"),
+            "provider_type", Set.of("local", "cloud", "none"),
+            "tool_call_count", Set.of("0", "1", "2-5", "6-10", "11+"),
+            "mcp_server_count", Set.of("0", "1", "2-5", "6-10", "11+"),
+            "custom_prompt_count", Set.of("0", "1", "2-5", "6-10", "11+"),
+            "chat_memory_bucket", Set.of("0", "1-5", "6-10", "11-20", "21+")
+    );
+
+    private static final int MAX_VALUE_LENGTH = 128;
+
+    private AnalyticsEventBuilder() {
+        // utility
+    }
+
+    /**
+     * Builds a GA4 payload JSON string, or returns {@code null} if validation fails.
+     *
+     * @param clientId    stable anonymous client id
+     * @param eventName   must be a known event (see {@link #EVENT_ALLOWLIST})
+     * @param eventParams event-specific params; keys must be in the event's allowlist; values
+     *                    subject to enum/shape/length checks
+     * @param commonParams common params (app_name, app_version, ide_version, session_id)
+     * @return payload JSON, or {@code null} if the caller must not send
+     */
+    @Nullable
+    public static String build(@NotNull String clientId,
+                               @NotNull String eventName,
+                               @NotNull Map<String, String> eventParams,
+                               @NotNull Map<String, String> commonParams) {
+
+        Set<String> allowedEventKeys = EVENT_ALLOWLIST.get(eventName);
+        if (allowedEventKeys == null) {
+            log.debug("Analytics event rejected: unknown event name '{}'", eventName);
+            return null;
+        }
+
+        if (!rejectShape(clientId)) {
+            log.debug("Analytics event rejected: clientId failed shape check");
+            return null;
+        }
+
+        // Validate event-specific params.
+        for (Map.Entry<String, String> entry : eventParams.entrySet()) {
+            String key = entry.getKey();
+            String value = entry.getValue();
+
+            if (!allowedEventKeys.contains(key)) {
+                log.debug("Analytics event '{}' rejected: unknown param '{}'", eventName, key);
+                return null;
+            }
+            if (value == null || value.isEmpty()) {
+                log.debug("Analytics event '{}' rejected: empty value for '{}'", eventName, key);
+                return null;
+            }
+            if (!rejectShape(value)) {
+                log.debug("Analytics event '{}' rejected: param '{}' failed shape/length check", eventName, key);
+                return null;
+            }
+            Set<String> allowedValues = ENUM_VALUE_ALLOWLIST.get(key);
+            if (allowedValues != null && !allowedValues.contains(value)) {
+                log.debug("Analytics event '{}' rejected: param '{}' has disallowed value", eventName, key);
+                return null;
+            }
+        }
+
+        // Validate common params (keys must match the closed set; values pass shape check).
+        for (Map.Entry<String, String> entry : commonParams.entrySet()) {
+            if (!COMMON_PARAM_KEYS.contains(entry.getKey())) {
+                log.debug("Analytics event '{}' rejected: unknown common param '{}'", eventName, entry.getKey());
+                return null;
+            }
+            if (entry.getValue() == null || !rejectShape(entry.getValue())) {
+                log.debug("Analytics event '{}' rejected: common param '{}' failed shape check", eventName, entry.getKey());
+                return null;
+            }
+        }
+
+        return encodeJson(clientId, eventName, eventParams, commonParams);
+    }
+
+    /**
+     * Defensive shape filter: rejects values that look like absolute paths, URLs, or
+     * multi-line text, or that exceed the max length. Applied to every string value.
+     *
+     * @return {@code true} if the value is acceptable, {@code false} otherwise
+     */
+    static boolean rejectShape(@NotNull String value) {
+        if (value.length() > MAX_VALUE_LENGTH) return false;
+        if (value.startsWith("/") || value.startsWith("\\")) return false;
+        if (value.contains("://")) return false;
+        if (value.indexOf('\n') >= 0 || value.indexOf('\r') >= 0) return false;
+        // Windows drive-letter absolute paths: C:\... or C:/...
+        if (value.length() >= 3
+                && isAsciiLetter(value.charAt(0))
+                && value.charAt(1) == ':'
+                && (value.charAt(2) == '\\' || value.charAt(2) == '/')) {
+            return false;
+        }
+        return true;
+    }
+
+    private static boolean isAsciiLetter(char c) {
+        return (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z');
+    }
+
+    @NotNull
+    private static String encodeJson(@NotNull String clientId,
+                                     @NotNull String eventName,
+                                     @NotNull Map<String, String> eventParams,
+                                     @NotNull Map<String, String> commonParams) {
+        StringBuilder sb = new StringBuilder(384);
+        sb.append('{')
+          .append("\"client_id\":\"").append(escape(clientId)).append("\",")
+          .append("\"events\":[{")
+          .append("\"name\":\"").append(escape(eventName)).append("\",")
+          .append("\"params\":{");
+
+        boolean first = true;
+        // Event-specific params first (preserves existing test expectations for prompt_executed).
+        for (Map.Entry<String, String> entry : eventParams.entrySet()) {
+            if (!first) sb.append(',');
+            sb.append('"').append(entry.getKey()).append("\":\"")
+              .append(escape(entry.getValue())).append('"');
+            first = false;
+        }
+        // Common params.
+        for (Map.Entry<String, String> entry : commonParams.entrySet()) {
+            if (!first) sb.append(',');
+            sb.append('"').append(entry.getKey()).append("\":\"")
+              .append(escape(entry.getValue())).append('"');
+            first = false;
+        }
+        // engagement_time_msec is always an int literal (GA4 expectation).
+        if (!first) sb.append(',');
+        sb.append("\"engagement_time_msec\":1");
+
+        sb.append("}}]}");
+        return sb.toString();
+    }
+
+    @NotNull
+    static String escape(@NotNull String value) {
+        StringBuilder sb = new StringBuilder(value.length() + 8);
+        for (int i = 0; i < value.length(); i++) {
+            char c = value.charAt(i);
+            switch (c) {
+                case '\\': sb.append("\\\\"); break;
+                case '"':  sb.append("\\\""); break;
+                case '\n': sb.append("\\n");  break;
+                case '\r': sb.append("\\r");  break;
+                case '\t': sb.append("\\t");  break;
+                default:
+                    if (c < 0x20) {
+                        sb.append(String.format("\\u%04x", (int) c));
+                    } else {
+                        sb.append(c);
+                    }
+            }
+        }
+        return sb.toString();
+    }
+
+    /** Convenience ordered-map factory for callers assembling event params. */
+    @NotNull
+    public static Map<String, String> params() {
+        return new LinkedHashMap<>();
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/analytics/AnalyticsService.java b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsService.java
index 5c76e5ed..dc017ec4 100644
--- a/src/main/java/com/devoxx/genie/service/analytics/AnalyticsService.java
+++ b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsService.java
@@ -16,6 +16,8 @@
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.time.Duration;
+import java.util.LinkedHashMap;
+import java.util.Map;
 import java.util.concurrent.CompletionException;
 import java.util.concurrent.ThreadLocalRandom;
 
@@ -39,6 +41,9 @@ public final class AnalyticsService {
     public static final String APP_NAME = "devoxxgenie-intellij";
     public static final String EVENT_PROMPT_EXECUTED = "prompt_executed";
     public static final String EVENT_MODEL_SELECTED = "model_selected";
+    public static final String EVENT_FEATURE_ENABLED = "feature_enabled";
+    public static final String EVENT_FEATURE_USED = "feature_used";
+    public static final String EVENT_FEATURE_COUNTS = "feature_counts";
 
     private static final String PLUGIN_ID = "com.devoxx.genie";
 
@@ -71,23 +76,72 @@ public static void trackModelSelectedSafely(@Nullable String providerId, @Nullab
     }
 
     public void trackPromptExecuted(@Nullable String providerId, @Nullable String modelName) {
-        sendSafely(EVENT_PROMPT_EXECUTED, providerId, modelName);
+        sendPromptOrModelEventSafely(EVENT_PROMPT_EXECUTED, providerId, modelName);
     }
 
     public void trackModelSelected(@Nullable String providerId, @Nullable String modelName) {
-        sendSafely(EVENT_MODEL_SELECTED, providerId, modelName);
+        sendPromptOrModelEventSafely(EVENT_MODEL_SELECTED, providerId, modelName);
     }
 
-    private void sendSafely(@NotNull String eventName, @Nullable String providerId, @Nullable String modelName) {
+    public void trackFeatureEnabled(@NotNull FeatureId featureId) {
+        if (featureId.isUsageOnly()) {
+            log.debug("Rejected trackFeatureEnabled for usage-only feature '{}'", featureId.wireValue());
+            return;
+        }
+        Map<String, String> params = AnalyticsEventBuilder.params();
+        params.put("feature_id", featureId.wireValue());
+        sendGenericSafely(EVENT_FEATURE_ENABLED, params);
+    }
+
+    public void trackFeatureUsed(@NotNull FeatureId featureId,
+                                 @NotNull ProviderType providerType,
+                                 @NotNull String toolCallCountBucket) {
+        Map<String, String> params = AnalyticsEventBuilder.params();
+        params.put("feature_id", featureId.wireValue());
+        params.put("provider_type", providerType.wireValue());
+        params.put("tool_call_count", toolCallCountBucket);
+        sendGenericSafely(EVENT_FEATURE_USED, params);
+    }
+
+    public void trackFeatureCounts(@NotNull String mcpServerCountBucket,
+                                   @NotNull String customPromptCountBucket,
+                                   @NotNull String chatMemoryBucket) {
+        Map<String, String> params = AnalyticsEventBuilder.params();
+        params.put("mcp_server_count", mcpServerCountBucket);
+        params.put("custom_prompt_count", customPromptCountBucket);
+        params.put("chat_memory_bucket", chatMemoryBucket);
+        sendGenericSafely(EVENT_FEATURE_COUNTS, params);
+    }
+
+    private void sendPromptOrModelEventSafely(@NotNull String eventName,
+                                              @Nullable String providerId,
+                                              @Nullable String modelName) {
+        // Provider/model are required for both events to be useful.
+        if (providerId == null || providerId.isEmpty() || modelName == null || modelName.isEmpty()) {
+            return;
+        }
+        Map<String, String> params = AnalyticsEventBuilder.params();
+        params.put("provider_id", providerId);
+        params.put("model_name", modelName);
+        sendGenericSafely(eventName, params);
+    }
+
+    private void sendGenericSafely(@NotNull String eventName, @NotNull Map<String, String> eventParams) {
         try {
-            send(eventName, providerId, modelName);
+            sendGeneric(eventName, eventParams);
         } catch (Exception e) {
             logAnalyticsFailure("Analytics tracking skipped", e);
         }
     }
 
-    private void send(@NotNull String eventName, @Nullable String providerId, @Nullable String modelName) {
-        DevoxxGenieStateService state = DevoxxGenieStateService.getInstance();
+    private void sendGeneric(@NotNull String eventName, @NotNull Map<String, String> eventParams) {
+        DevoxxGenieStateService state;
+        try {
+            state = DevoxxGenieStateService.getInstance();
+        } catch (Exception e) {
+            logAnalyticsFailure("Analytics tracking skipped", e);
+            return;
+        }
 
         // Hard precondition gates — never emit before consent or when disabled.
         if (!Boolean.TRUE.equals(state.getAnalyticsNoticeAcknowledged())) {
@@ -97,18 +151,19 @@ private void send(@NotNull String eventName, @Nullable String providerId, @Nulla
             return;
         }
 
-        // Provider/model are required for both events to be useful.
-        if (providerId == null || providerId.isEmpty() || modelName == null || modelName.isEmpty()) {
-            return;
-        }
-
         String endpoint = state.getAnalyticsEndpoint();
         if (endpoint == null || endpoint.isEmpty()) {
             return;
         }
 
         String clientId = state.getAnalyticsClientId();
-        String payload = buildPayload(clientId, eventName, providerId, modelName);
+        Map<String, String> commonParams = buildCommonParams();
+
+        String payload = AnalyticsEventBuilder.build(clientId, eventName, eventParams, commonParams);
+        if (payload == null) {
+            // Allowlist rejection — logged inside the builder.
+            return;
+        }
 
         if (synchronousForTest) {
             postBlockingSilently(endpoint, payload);
@@ -117,6 +172,16 @@ private void send(@NotNull String eventName, @Nullable String providerId, @Nulla
         }
     }
 
+    @NotNull
+    private Map<String, String> buildCommonParams() {
+        Map<String, String> common = new LinkedHashMap<>();
+        common.put("app_name", APP_NAME);
+        common.put("app_version", pluginVersion());
+        common.put("ide_version", ideVersion());
+        common.put("session_id", sessionId);
+        return common;
+    }
+
     private void postAsyncSilently(@NotNull String endpoint, @NotNull String payload) {
         try {
             HttpRequest request = buildRequest(endpoint, payload);
@@ -170,50 +235,6 @@ private static Throwable unwrapCompletionException(@NotNull Throwable throwable)
         return throwable;
     }
 
-    String buildPayload(@NotNull String clientId,
-                        @NotNull String eventName,
-                        @NotNull String providerId,
-                        @NotNull String modelName) {
-        StringBuilder sb = new StringBuilder(384);
-        sb.append('{')
-          .append("\"client_id\":\"").append(escape(clientId)).append("\",")
-          .append("\"events\":[{")
-          .append("\"name\":\"").append(escape(eventName)).append("\",")
-          .append("\"params\":{")
-          .append("\"provider_id\":\"").append(escape(providerId)).append("\",")
-          .append("\"model_name\":\"").append(escape(modelName)).append("\",")
-          .append("\"app_name\":\"").append(APP_NAME).append("\",")
-          .append("\"app_version\":\"").append(escape(pluginVersion())).append("\",")
-          .append("\"ide_version\":\"").append(escape(ideVersion())).append("\",")
-          .append("\"session_id\":\"").append(sessionId).append("\",")
-          .append("\"engagement_time_msec\":1")
-          .append("}}]}")
-          ;
-        return sb.toString();
-    }
-
-    @NotNull
-    private static String escape(@NotNull String value) {
-        StringBuilder sb = new StringBuilder(value.length() + 8);
-        for (int i = 0; i < value.length(); i++) {
-            char c = value.charAt(i);
-            switch (c) {
-                case '\\': sb.append("\\\\"); break;
-                case '"':  sb.append("\\\""); break;
-                case '\n': sb.append("\\n");  break;
-                case '\r': sb.append("\\r");  break;
-                case '\t': sb.append("\\t");  break;
-                default:
-                    if (c < 0x20) {
-                        sb.append(String.format("\\u%04x", (int) c));
-                    } else {
-                        sb.append(c);
-                    }
-            }
-        }
-        return sb.toString();
-    }
-
     @NotNull
     private static String pluginVersion() {
         try {
diff --git a/src/main/java/com/devoxx/genie/service/analytics/AnalyticsSessionSnapshotService.java b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsSessionSnapshotService.java
new file mode 100644
index 00000000..5966782f
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/analytics/AnalyticsSessionSnapshotService.java
@@ -0,0 +1,194 @@
+package com.devoxx.genie.service.analytics;
+
+import com.devoxx.genie.model.CustomPrompt;
+import com.devoxx.genie.model.mcp.MCPServer;
+import com.devoxx.genie.ui.settings.DevoxxGenieStateService;
+import com.intellij.openapi.application.ApplicationManager;
+import com.intellij.openapi.components.Service;
+import lombok.extern.slf4j.Slf4j;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.TestOnly;
+
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/**
+ * Emits the per-IDE-session feature-enablement snapshot exactly once per session (task-209,
+ * ACs #1, #19, #22, #28).
+ *
+ * <p>For each tracked feature toggled ON in {@link DevoxxGenieStateService}, publishes a
+ * {@code feature_enabled} event via {@link AnalyticsService#trackFeatureEnabled(FeatureId)}.
+ * It also publishes a single {@code feature_counts} event with bucketed MCP server / custom
+ * prompt / chat memory counts.
+ *
+ * <p>Guarded by an {@link AtomicBoolean} so repeated {@link #snapshotIfNeeded()} calls (e.g.
+ * from {@code PostStartupActivity} on every project open) only fire once. On settings change
+ * — delivered via the {@link DevoxxGenieSettingsChangedTopic} MessageBus topic — the guard
+ * clears and the next {@code snapshotIfNeeded()} re-emits.
+ */
+@Slf4j
+@Service(Service.Level.APP)
+public final class AnalyticsSessionSnapshotService implements DevoxxGenieSettingsChangedTopic {
+
+    /**
+     * Narrow sink interface — lets tests inject a recording fake without subclassing the
+     * (intentionally {@code final}) {@link AnalyticsService}.
+     */
+    interface FeatureEventSink {
+        void trackFeatureEnabled(@NotNull FeatureId featureId);
+        void trackFeatureCounts(@NotNull String mcpServerCountBucket,
+                                @NotNull String customPromptCountBucket,
+                                @NotNull String chatMemoryBucket);
+    }
+
+    private final AtomicBoolean sent = new AtomicBoolean(false);
+    private final FeatureEventSink sink;
+
+    @SuppressWarnings("unused") // APP-level @Service instantiation
+    public AnalyticsSessionSnapshotService() {
+        this(defaultSink());
+        subscribeToSettingsChanges();
+    }
+
+    @TestOnly
+    AnalyticsSessionSnapshotService(@NotNull FeatureEventSink sink) {
+        this.sink = sink;
+    }
+
+    @NotNull
+    private static FeatureEventSink defaultSink() {
+        AnalyticsService svc = AnalyticsService.getInstance();
+        return new FeatureEventSink() {
+            @Override
+            public void trackFeatureEnabled(@NotNull FeatureId featureId) {
+                svc.trackFeatureEnabled(featureId);
+            }
+
+            @Override
+            public void trackFeatureCounts(@NotNull String mcp,
+                                           @NotNull String custom,
+                                           @NotNull String memory) {
+                svc.trackFeatureCounts(mcp, custom, memory);
+            }
+        };
+    }
+
+    @NotNull
+    public static AnalyticsSessionSnapshotService getInstance() {
+        return ApplicationManager.getApplication().getService(AnalyticsSessionSnapshotService.class);
+    }
+
+    /**
+     * Emits the feature-enablement snapshot if it hasn't been sent yet in this IDE session
+     * (or has been re-armed by a settings change). Safe to call repeatedly; fire-and-forget.
+     */
+    public void snapshotIfNeeded() {
+        // Preflight consent gates BEFORE burning the one-shot flag. Otherwise the first
+        // call from PostStartupActivity (before the user has clicked "OK, Keep Enabled")
+        // would consume the guard, dropping every event, and the Keep-Enabled action's
+        // follow-up call would find sent=true and exit early — losing the snapshot for
+        // the entire first opted-in IDE session. Task-209 AC #1 / #28.
+        if (!isAnalyticsEligible()) {
+            return;
+        }
+        if (!sent.compareAndSet(false, true)) {
+            return;
+        }
+        try {
+            emitSnapshot();
+        } catch (Exception e) {
+            log.debug("Analytics session snapshot skipped: {}", e.getMessage());
+        }
+    }
+
+    private boolean isAnalyticsEligible() {
+        try {
+            DevoxxGenieStateService state = DevoxxGenieStateService.getInstance();
+            return Boolean.TRUE.equals(state.getAnalyticsNoticeAcknowledged())
+                    && Boolean.TRUE.equals(state.getAnalyticsEnabled());
+        } catch (Exception e) {
+            return false;
+        }
+    }
+
+    /** Re-arms the snapshot on the next {@link #snapshotIfNeeded()} call. */
+    @Override
+    public void settingsChanged() {
+        sent.set(false);
+    }
+
+    private void emitSnapshot() {
+        DevoxxGenieStateService state;
+        try {
+            state = DevoxxGenieStateService.getInstance();
+        } catch (Exception e) {
+            log.debug("Analytics session snapshot skipped: state service unavailable ({})", e.getMessage());
+            return;
+        }
+
+        emitIfEnabled(state.getRagEnabled(), FeatureId.RAG);
+        emitIfEnabled(state.getMcpEnabled(), FeatureId.MCP);
+        emitIfEnabled(state.getAgentModeEnabled(), FeatureId.AGENT);
+        emitIfEnabled(state.getStreamMode(), FeatureId.STREAMING);
+        emitIfEnabled(state.isGoogleSearchEnabled(), FeatureId.WEB_SEARCH_GOOGLE);
+        emitIfEnabled(state.isTavilySearchEnabled(), FeatureId.WEB_SEARCH_TAVILY);
+        emitIfEnabled(hasAnyCustomPrompt(state), FeatureId.CUSTOM_PROMPT);
+
+        sink.trackFeatureCounts(
+                Buckets.standard(mcpServerCount(state)),
+                Buckets.standard(customPromptCount(state)),
+                Buckets.chatMemory(chatMemorySize(state))
+        );
+    }
+
+    private void emitIfEnabled(boolean enabled, @NotNull FeatureId featureId) {
+        if (enabled) {
+            sink.trackFeatureEnabled(featureId);
+        }
+    }
+
+    private void emitIfEnabled(Boolean enabled, @NotNull FeatureId featureId) {
+        emitIfEnabled(Boolean.TRUE.equals(enabled), featureId);
+    }
+
+    private boolean hasAnyCustomPrompt(@NotNull DevoxxGenieStateService state) {
+        return customPromptCount(state) > 0;
+    }
+
+    private int customPromptCount(@NotNull DevoxxGenieStateService state) {
+        List<CustomPrompt> prompts = state.getCustomPrompts();
+        return prompts == null ? 0 : prompts.size();
+    }
+
+    private int mcpServerCount(@NotNull DevoxxGenieStateService state) {
+        if (state.getMcpSettings() == null) return 0;
+        Map<String, MCPServer> servers = state.getMcpSettings().getMcpServers();
+        return servers == null ? 0 : servers.size();
+    }
+
+    private int chatMemorySize(@NotNull DevoxxGenieStateService state) {
+        Integer size = state.getChatMemorySize();
+        return size == null ? 0 : size;
+    }
+
+    private void subscribeToSettingsChanges() {
+        try {
+            ApplicationManager.getApplication().getMessageBus()
+                    .connect()
+                    .subscribe(DevoxxGenieSettingsChangedTopic.TOPIC, this);
+        } catch (Exception e) {
+            log.debug("Analytics session snapshot subscriber not attached: {}", e.getMessage());
+        }
+    }
+
+    @TestOnly
+    boolean isSentForTest() {
+        return sent.get();
+    }
+
+    @TestOnly
+    void resetForTest() {
+        sent.set(false);
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/analytics/Buckets.java b/src/main/java/com/devoxx/genie/service/analytics/Buckets.java
new file mode 100644
index 00000000..523aad74
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/analytics/Buckets.java
@@ -0,0 +1,51 @@
+package com.devoxx.genie.service.analytics;
+
+import org.jetbrains.annotations.NotNull;
+
+/**
+ * Coarse-count bucketing for analytics (task-209, AC #7, #17).
+ *
+ * <p>Raw counts are never emitted — they could fingerprint an install. All counts go through
+ * this utility so the wire schema stays consistent with the shared GA4 schema both DevoxxGenie
+ * and the GenieBuilder admin panel agree on.
+ *
+ * <p>Two bucket ladders exist:
+ * <ul>
+ *   <li>"standard" — {@code 0}, {@code 1}, {@code 2-5}, {@code 6-10}, {@code 11+} — used for
+ *       {@code mcp_server_count}, {@code custom_prompt_count}, {@code tool_call_count}.</li>
+ *   <li>"chatMemory" — {@code 0}, {@code 1-5}, {@code 6-10}, {@code 11-20}, {@code 21+} — used
+ *       for {@code chat_memory_bucket}.</li>
+ * </ul>
+ */
+public final class Buckets {
+
+    private Buckets() {
+        // utility
+    }
+
+    /**
+     * Standard count bucket: {@code 0}, {@code 1}, {@code 2-5}, {@code 6-10}, {@code 11+}.
+     * Used for MCP server count, custom prompt count, and tool call count.
+     */
+    @NotNull
+    public static String standard(int count) {
+        if (count <= 0) return "0";
+        if (count == 1) return "1";
+        if (count <= 5) return "2-5";
+        if (count <= 10) return "6-10";
+        return "11+";
+    }
+
+    /**
+     * Chat-memory bucket: {@code 0}, {@code 1-5}, {@code 6-10}, {@code 11-20}, {@code 21+}.
+     * Chat memory sizes cluster differently from tool counts, so they get their own ladder.
+     */
+    @NotNull
+    public static String chatMemory(int size) {
+        if (size <= 0) return "0";
+        if (size <= 5) return "1-5";
+        if (size <= 10) return "6-10";
+        if (size <= 20) return "11-20";
+        return "21+";
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/analytics/DevoxxGenieSettingsChangedTopic.java b/src/main/java/com/devoxx/genie/service/analytics/DevoxxGenieSettingsChangedTopic.java
new file mode 100644
index 00000000..9e12bc30
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/analytics/DevoxxGenieSettingsChangedTopic.java
@@ -0,0 +1,39 @@
+package com.devoxx.genie.service.analytics;
+
+import com.intellij.openapi.application.ApplicationManager;
+import com.intellij.util.messages.Topic;
+
+/**
+ * MessageBus topic broadcast whenever a tracked DevoxxGenie setting changes (task-209, AC #22).
+ *
+ * <p>The analytics session-snapshot service subscribes to this topic so the feature-enablement
+ * snapshot re-arms on any settings mutation — no need to wire per-panel {@code apply()} hooks
+ * into every settings component.
+ *
+ * <p>Publishers call {@code
+ * ApplicationManager.getApplication().getMessageBus().syncPublisher(DevoxxGenieSettingsChangedTopic.TOPIC)
+ * .settingsChanged()} after committing their state changes.
+ */
+public interface DevoxxGenieSettingsChangedTopic {
+
+    Topic<DevoxxGenieSettingsChangedTopic> TOPIC =
+            Topic.create("DevoxxGenie settings changed", DevoxxGenieSettingsChangedTopic.class);
+
+    /** Fired after any tracked setting has been written back to {@code DevoxxGenieStateService}. */
+    void settingsChanged();
+
+    /**
+     * Fail-silent broadcast helper. Any exception — including null message bus in test
+     * environments — is swallowed so settings {@code apply()} paths never crash because of
+     * analytics plumbing.
+     */
+    static void notifySettingsChanged() {
+        try {
+            ApplicationManager.getApplication().getMessageBus()
+                    .syncPublisher(TOPIC)
+                    .settingsChanged();
+        } catch (Exception | Error ignored) {
+            // Best-effort — settings changes must never fail because analytics is unreachable.
+        }
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/analytics/FeatureId.java b/src/main/java/com/devoxx/genie/service/analytics/FeatureId.java
new file mode 100644
index 00000000..acf3dbff
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/analytics/FeatureId.java
@@ -0,0 +1,57 @@
+package com.devoxx.genie.service.analytics;
+
+import org.jetbrains.annotations.NotNull;
+
+import java.util.Arrays;
+import java.util.Optional;
+
+/**
+ * Closed allowlist of feature identifiers emitted by the analytics pipeline (task-209).
+ *
+ * <p>The string value is the GA4 event parameter — never the enum name — and is the ONLY
+ * acceptable value for the {@code feature_id} param. All instrumentation must go through
+ * this enum; no free-form strings.
+ *
+ * <p>Some features are <strong>usage-only</strong>: they are per-prompt or per-project
+ * signals (e.g., full project context attached, DEVOXXGENIE.md injected) that do not have
+ * a meaningful session-scoped enablement story. Passing a usage-only feature to
+ * {@code trackFeatureEnabled} is a programming error and is rejected.
+ */
+public enum FeatureId {
+
+    RAG("rag", false),
+    SEMANTIC_SEARCH("semantic_search", true),
+    WEB_SEARCH_GOOGLE("web_search_google", false),
+    WEB_SEARCH_TAVILY("web_search_tavily", false),
+    AGENT("agent", false),
+    MCP("mcp", false),
+    STREAMING("streaming", false),
+    PROJECT_CONTEXT_FULL("project_context_full", true),
+    PROJECT_CONTEXT_SELECTED("project_context_selected", true),
+    DEVOXXGENIE_MD("devoxxgenie_md", true),
+    CUSTOM_PROMPT("custom_prompt", false);
+
+    private final String wireValue;
+    private final boolean usageOnly;
+
+    FeatureId(@NotNull String wireValue, boolean usageOnly) {
+        this.wireValue = wireValue;
+        this.usageOnly = usageOnly;
+    }
+
+    @NotNull
+    public String wireValue() {
+        return wireValue;
+    }
+
+    public boolean isUsageOnly() {
+        return usageOnly;
+    }
+
+    @NotNull
+    public static Optional<FeatureId> fromWireValue(@NotNull String value) {
+        return Arrays.stream(values())
+                .filter(f -> f.wireValue.equals(value))
+                .findFirst();
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/analytics/FeatureUsageTracker.java b/src/main/java/com/devoxx/genie/service/analytics/FeatureUsageTracker.java
new file mode 100644
index 00000000..120f6286
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/analytics/FeatureUsageTracker.java
@@ -0,0 +1,129 @@
+package com.devoxx.genie.service.analytics;
+
+import com.devoxx.genie.model.LanguageModel;
+import com.devoxx.genie.model.request.ChatMessageContext;
+import com.devoxx.genie.ui.settings.DevoxxGenieStateService;
+import lombok.extern.slf4j.Slf4j;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
+/**
+ * Thin static facade over {@link AnalyticsService#trackFeatureUsed} (task-209, ACs #18, #19,
+ * #23, #26).
+ *
+ * <p>Centralizes the "one event per activated feature per prompt" rule and the
+ * {@code tool_call_count} convention — only {@link FeatureId#AGENT} and {@link FeatureId#MCP}
+ * carry a meaningful count; all other usage events send {@code "0"}.
+ *
+ * <p>All methods are fail-silent: any exception is logged at debug level and swallowed so
+ * analytics never bubble into the user's prompt execution path.
+ */
+@Slf4j
+public final class FeatureUsageTracker {
+
+    private static final String ZERO_BUCKET = "0";
+
+    private FeatureUsageTracker() {
+        // utility
+    }
+
+    /**
+     * Emits {@code feature_used} events for every feature activated during the given prompt.
+     * Called from {@code PromptExecutionService} at prompt completion. Reads only the
+     * activation flags and per-prompt counters on {@link ChatMessageContext} — never any
+     * user content.
+     *
+     * <p>Does NOT emit the {@code agent} event — the agent orchestrator emits that
+     * separately via {@link #agentCompleted}, since the {@code AgentLoopTracker} instance
+     * that holds the call count lives in the strategy, not the context.
+     */
+    public static void emitForPrompt(@NotNull ChatMessageContext context) {
+        try {
+            ProviderType providerType = resolveProviderType(context);
+            DevoxxGenieStateService state = safeState();
+
+            if (state != null && Boolean.TRUE.equals(state.getStreamMode())) {
+                emit(FeatureId.STREAMING, providerType, ZERO_BUCKET);
+            }
+            if (context.isRagActivated()) {
+                emit(FeatureId.RAG, providerType, ZERO_BUCKET);
+            }
+            if (context.isWebSearchActivated() && state != null) {
+                if (state.isGoogleSearchEnabled()) {
+                    emit(FeatureId.WEB_SEARCH_GOOGLE, providerType, ZERO_BUCKET);
+                }
+                if (state.isTavilySearchEnabled()) {
+                    emit(FeatureId.WEB_SEARCH_TAVILY, providerType, ZERO_BUCKET);
+                }
+            }
+            if (context.getCommandName() != null && !context.getCommandName().isEmpty()) {
+                emit(FeatureId.CUSTOM_PROMPT, providerType, ZERO_BUCKET);
+            }
+            if (context.isProjectContextFullUsed()) {
+                emit(FeatureId.PROJECT_CONTEXT_FULL, providerType, ZERO_BUCKET);
+            }
+            if (context.isProjectContextSelectedUsed()) {
+                emit(FeatureId.PROJECT_CONTEXT_SELECTED, providerType, ZERO_BUCKET);
+            }
+            if (context.isDevoxxGenieMdUsed()) {
+                emit(FeatureId.DEVOXXGENIE_MD, providerType, ZERO_BUCKET);
+            }
+
+            int mcpCalls = context.getMcpCallCount() != null ? context.getMcpCallCount().get() : 0;
+            if (mcpCalls > 0) {
+                emit(FeatureId.MCP, providerType, Buckets.standard(mcpCalls));
+            }
+        } catch (Exception e) {
+            log.debug("FeatureUsageTracker.emitForPrompt skipped: {}", e.getMessage());
+        }
+    }
+
+    /**
+     * Emits a single {@code feature_used} event for {@link FeatureId#AGENT} with the
+     * bucketed tool-call count. Called from the agent orchestrators
+     * ({@code StreamingPromptStrategy}, {@code NonStreamingPromptExecutionService},
+     * {@code SubAgentRunner}) after the chat finishes.
+     */
+    public static void agentCompleted(@NotNull ChatMessageContext context, int toolCallCount) {
+        try {
+            emit(FeatureId.AGENT, resolveProviderType(context), Buckets.standard(toolCallCount));
+        } catch (Exception e) {
+            log.debug("FeatureUsageTracker.agentCompleted skipped: {}", e.getMessage());
+        }
+    }
+
+    /** Fires the feature_used event for {@link FeatureId#SEMANTIC_SEARCH}. */
+    public static void semanticSearchUsed(@Nullable LanguageModel model) {
+        try {
+            emit(FeatureId.SEMANTIC_SEARCH, resolveProviderType(model), ZERO_BUCKET);
+        } catch (Exception e) {
+            log.debug("FeatureUsageTracker.semanticSearchUsed skipped: {}", e.getMessage());
+        }
+    }
+
+    private static void emit(@NotNull FeatureId feature, @NotNull ProviderType type, @NotNull String bucket) {
+        AnalyticsService.getInstance().trackFeatureUsed(feature, type, bucket);
+    }
+
+    @NotNull
+    private static ProviderType resolveProviderType(@NotNull ChatMessageContext context) {
+        return resolveProviderType(context.getLanguageModel());
+    }
+
+    @NotNull
+    private static ProviderType resolveProviderType(@Nullable LanguageModel model) {
+        if (model == null || model.getProvider() == null) {
+            return ProviderType.NONE;
+        }
+        return ProviderType.fromModelProvider(model.getProvider());
+    }
+
+    @Nullable
+    private static DevoxxGenieStateService safeState() {
+        try {
+            return DevoxxGenieStateService.getInstance();
+        } catch (Exception e) {
+            return null;
+        }
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/analytics/ProviderType.java b/src/main/java/com/devoxx/genie/service/analytics/ProviderType.java
new file mode 100644
index 00000000..8d779b07
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/analytics/ProviderType.java
@@ -0,0 +1,41 @@
+package com.devoxx.genie.service.analytics;
+
+import com.devoxx.genie.model.enumarations.ModelProvider;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+
+/**
+ * Provider-type bucket emitted on {@code feature_used} events (task-209, AC #16).
+ *
+ * <p>{@link ModelProvider.Type#OPTIONAL} (Azure OpenAI, Bedrock) folds into {@link #CLOUD}:
+ * both are cloud-hosted enterprise endpoints, they just require extra setup locally.
+ * The wire schema is strictly {@code local | cloud | none} — no {@code optional} bucket.
+ */
+public enum ProviderType {
+
+    LOCAL("local"),
+    CLOUD("cloud"),
+    NONE("none");
+
+    private final String wireValue;
+
+    ProviderType(@NotNull String wireValue) {
+        this.wireValue = wireValue;
+    }
+
+    @NotNull
+    public String wireValue() {
+        return wireValue;
+    }
+
+    @NotNull
+    public static ProviderType fromModelProvider(@Nullable ModelProvider provider) {
+        if (provider == null) {
+            return NONE;
+        }
+        return switch (provider.getType()) {
+            case LOCAL -> LOCAL;
+            case CLOUD, OPTIONAL -> CLOUD;
+        };
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/mcp/InstrumentedMcpToolProvider.java b/src/main/java/com/devoxx/genie/service/mcp/InstrumentedMcpToolProvider.java
new file mode 100644
index 00000000..1be6c64f
--- /dev/null
+++ b/src/main/java/com/devoxx/genie/service/mcp/InstrumentedMcpToolProvider.java
@@ -0,0 +1,61 @@
+package com.devoxx.genie.service.mcp;
+
+import dev.langchain4j.agent.tool.ToolSpecification;
+import dev.langchain4j.service.tool.ToolExecutor;
+import dev.langchain4j.service.tool.ToolProvider;
+import dev.langchain4j.service.tool.ToolProviderRequest;
+import dev.langchain4j.service.tool.ToolProviderResult;
+import lombok.extern.slf4j.Slf4j;
+import org.jetbrains.annotations.NotNull;
+
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
+
+/**
+ * Counts actual MCP tool invocations per prompt (task-209, AC #24).
+ *
+ * <p>Sits in the MCP provider stack <strong>outside</strong> {@link FilteredMcpToolProvider}
+ * (so disabled tools are never counted) and <strong>inside</strong>
+ * {@link ApprovalRequiredToolProvider} (so denied-by-user calls don't count). The counter is
+ * incremented inside the wrapped {@link ToolExecutor#execute} lambda — NOT inside
+ * {@link #provideTools} — because the LLM framework may call {@code provideTools}
+ * speculatively without actually executing anything.
+ *
+ * <p>The counter is owned by the caller (usually stashed on {@code ChatMessageContext}) so
+ * the per-prompt count can be read after the chat finishes and bucketed into a
+ * {@code feature_used} event. The provider itself never emits analytics events — it only
+ * counts.
+ */
+@Slf4j
+public class InstrumentedMcpToolProvider implements ToolProvider {
+
+    private final ToolProvider delegate;
+    private final AtomicInteger counter;
+
+    public InstrumentedMcpToolProvider(@NotNull ToolProvider delegate, @NotNull AtomicInteger counter) {
+        this.delegate = delegate;
+        this.counter = counter;
+    }
+
+    @Override
+    public ToolProviderResult provideTools(@NotNull ToolProviderRequest request) {
+        ToolProviderResult delegateResult = delegate.provideTools(request);
+        ToolProviderResult.Builder builder = ToolProviderResult.builder();
+
+        for (Map.Entry<ToolSpecification, ToolExecutor> entry : delegateResult.tools().entrySet()) {
+            ToolSpecification spec = entry.getKey();
+            ToolExecutor originalExecutor = entry.getValue();
+
+            ToolExecutor countingExecutor = (toolRequest, memoryId) -> {
+                String result = originalExecutor.execute(toolRequest, memoryId);
+                // Increment AFTER successful execution so failures don't inflate usage counts.
+                counter.incrementAndGet();
+                return result;
+            };
+
+            builder.add(spec, countingExecutor);
+        }
+
+        return builder.build();
+    }
+}
diff --git a/src/main/java/com/devoxx/genie/service/mcp/MCPExecutionService.java b/src/main/java/com/devoxx/genie/service/mcp/MCPExecutionService.java
index 2f288376..ae98fab4 100644
--- a/src/main/java/com/devoxx/genie/service/mcp/MCPExecutionService.java
+++ b/src/main/java/com/devoxx/genie/service/mcp/MCPExecutionService.java
@@ -121,11 +121,27 @@ public void dispose() {
      * @return A ToolProvider that includes all enabled MCP tools, or null if MCP is disabled or no servers are configured
      */
     public ToolProvider createMCPToolProvider(Project project) {
-        ToolProvider rawProvider = createRawMCPToolProvider();
+        return createMCPToolProvider(project, null);
+    }
+
+    /**
+     * Creates tool providers for all configured MCP servers, wrapped with approval UI and
+     * (optionally) a per-prompt usage counter (task-209).
+     *
+     * <p>Stack order outer → inner:
+     * {@code ApprovalRequiredToolProvider → InstrumentedMcpToolProvider → FilteredMcpToolProvider → raw}.
+     *
+     * @param project the project for approval UI
+     * @param mcpCallCounter optional counter incremented on every approved + non-filtered
+     *                       MCP tool execution; pass {@code null} to disable counting
+     * @return the fully-wrapped provider, or {@code null} if MCP is disabled / no servers
+     */
+    public ToolProvider createMCPToolProvider(Project project, @Nullable java.util.concurrent.atomic.AtomicInteger mcpCallCounter) {
+        ToolProvider rawProvider = createRawMCPToolProvider(mcpCallCounter);
         if (rawProvider == null) {
             return null;
         }
-        // Wrap it with the custom approval-requiring provider
+        // Wrap it with the custom approval-requiring provider (outermost).
         return new ApprovalRequiredToolProvider(rawProvider, project);
     }
 
@@ -137,6 +153,18 @@ public ToolProvider createMCPToolProvider(Project project) {
      */
     @Nullable
     public ToolProvider createRawMCPToolProvider() {
+        return createRawMCPToolProvider(null);
+    }
+
+    /**
+     * Same as {@link #createRawMCPToolProvider()} but inserts an
+     * {@link InstrumentedMcpToolProvider} above the filter layer when a counter is supplied
+     * (task-209 AC #24). The instrumenter increments the counter inside the wrapped
+     * {@code ToolExecutor.execute()} path — so only actually-executed approved calls are
+     * counted.
+     */
+    @Nullable
+    public ToolProvider createRawMCPToolProvider(@Nullable java.util.concurrent.atomic.AtomicInteger mcpCallCounter) {
         log.debug("Creating raw MCP Tool Provider");
 
         // Get all configured MCP servers
@@ -168,8 +196,14 @@ public ToolProvider createRawMCPToolProvider() {
                 .mcpClients(mcpClients)
                 .build();
 
-        // Wrap with filtering to exclude individually disabled tools
-        return new FilteredMcpToolProvider(rawProvider);
+        // Wrap with filtering to exclude individually disabled tools.
+        ToolProvider filtered = new FilteredMcpToolProvider(rawProvider);
+
+        // Wrap with per-prompt usage counter (task-209) when the caller supplies one.
+        if (mcpCallCounter != null) {
+            return new InstrumentedMcpToolProvider(filtered, mcpCallCounter);
+        }
+        return filtered;
     }
 
     /**
diff --git a/src/main/java/com/devoxx/genie/service/prompt/PromptExecutionService.java b/src/main/java/com/devoxx/genie/service/prompt/PromptExecutionService.java
index f9b0837f..58f034ec 100644
--- a/src/main/java/com/devoxx/genie/service/prompt/PromptExecutionService.java
+++ b/src/main/java/com/devoxx/genie/service/prompt/PromptExecutionService.java
@@ -4,6 +4,7 @@
 import com.devoxx.genie.model.request.ChatMessageContext;
 import com.devoxx.genie.service.FileListManager;
 import com.devoxx.genie.service.analytics.AnalyticsService;
+import com.devoxx.genie.service.analytics.FeatureUsageTracker;
 import com.devoxx.genie.service.prompt.cancellation.PromptCancellationService;
 import com.devoxx.genie.service.prompt.command.PromptCommandProcessor;
 import com.devoxx.genie.service.prompt.error.ExecutionException;
@@ -130,6 +131,10 @@ public void onCancel() {
                         log.debug("Prompt execution completed with result: {}", result);
                     }
 
+                    // Emit per-feature usage events based on what the prompt actually activated
+                    // (task-209). Never reads user content — only activation flags and counters.
+                    FeatureUsageTracker.emitForPrompt(context);
+
                     // Unregister from cancellation service upon completion
                     cancellationService.unregisterExecution(project, context.getId());
 
diff --git a/src/main/java/com/devoxx/genie/service/prompt/memory/ChatMemoryManager.java b/src/main/java/com/devoxx/genie/service/prompt/memory/ChatMemoryManager.java
index b6e394d4..d552f4d8 100644
--- a/src/main/java/com/devoxx/genie/service/prompt/memory/ChatMemoryManager.java
+++ b/src/main/java/com/devoxx/genie/service/prompt/memory/ChatMemoryManager.java
@@ -321,7 +321,15 @@ private boolean shouldIncludeSystemMessage(@NotNull ChatMessageContext context)
      * @return The complete system prompt
      */
     private String buildSystemPrompt(@NotNull ChatMessageContext context) {
-        return buildAugmentedSystemPrompt(context.getProject());
+        String prompt = buildAugmentedSystemPrompt(context.getProject());
+        // task-209 analytics signal — mirrors the gate used inside buildAugmentedSystemPrompt.
+        if (Boolean.TRUE.equals(DevoxxGenieStateService.getInstance().getUseDevoxxGenieMdInPrompt())) {
+            String md = readDevoxxGenieMdFile(context.getProject());
+            if (md != null && !md.isEmpty()) {
+                context.setDevoxxGenieMdUsed(true);
+            }
+        }
+        return prompt;
     }
 
     public static @NotNull String buildAugmentedSystemPrompt(@NotNull Project project) {
diff --git a/src/main/java/com/devoxx/genie/service/prompt/response/nonstreaming/NonStreamingPromptExecutionService.java b/src/main/java/com/devoxx/genie/service/prompt/response/nonstreaming/NonStreamingPromptExecutionService.java
index 8cadf9e1..e3634a8c 100644
--- a/src/main/java/com/devoxx/genie/service/prompt/response/nonstreaming/NonStreamingPromptExecutionService.java
+++ b/src/main/java/com/devoxx/genie/service/prompt/response/nonstreaming/NonStreamingPromptExecutionService.java
@@ -5,6 +5,7 @@
 import com.devoxx.genie.service.FileListManager;
 import com.devoxx.genie.service.agent.AgentLoopTracker;
 import com.devoxx.genie.service.agent.AgentToolProviderFactory;
+import com.devoxx.genie.service.analytics.FeatureUsageTracker;
 import com.devoxx.genie.service.mcp.MCPExecutionService;
 import com.devoxx.genie.service.mcp.MCPService;
 import com.devoxx.genie.service.prompt.error.ExecutionException;
@@ -115,9 +116,15 @@ public static NonStreamingPromptExecutionService getInstance() {
             .whenComplete((response, throwable) -> {
                 // Clear the per-tab future reference when done
                 queryFutures.remove(tabKey);
-                trackers.remove(tabKey);
+                AgentLoopTracker finishedTracker = trackers.remove(tabKey);
                 running = !queryFutures.isEmpty(); // Still running if other tabs have active queries
 
+                // Emit `agent` feature_used with the tracker's final call count — fires on
+                // success, error, and cancellation (task-209 AC #23).
+                if (finishedTracker != null) {
+                    FeatureUsageTracker.agentCompleted(chatMessageContext, finishedTracker.getCallCount());
+                }
+
                 // Add file references if any, similar to StreamingResponseHandler
                 String tabIdForFiles = chatMessageContext.getTabId();
                 if (response != null && !FileListManager.getInstance().isEmpty(project, tabIdForFiles)) {
@@ -183,14 +190,16 @@ public void cancelExecutingQuery() {
 
             Assistant assistant = buildAssistant(chatModel, chatMemory, project);
 
-            // Try agent mode first, then fall back to MCP-only
-            ToolProvider toolProvider = AgentToolProviderFactory.createToolProvider(project);
+            // Try agent mode first, then fall back to MCP-only. Thread the per-prompt MCP
+            // counter so MCP-inside-agent invocations are counted (task-209 AC #24).
+            ToolProvider toolProvider = AgentToolProviderFactory.createToolProvider(project, chatMessageContext.getMcpCallCount());
             if (toolProvider instanceof AgentLoopTracker tracker) {
                 String tKey = chatMessageContext.getTabId() != null ? chatMessageContext.getTabId() : "default";
                 trackers.put(tKey, tracker);
             }
             if (toolProvider == null && MCPService.isMCPEnabled()) {
-                toolProvider = MCPExecutionService.getInstance().createMCPToolProvider(project);
+                toolProvider = MCPExecutionService.getInstance()
+                        .createMCPToolProvider(project, chatMessageContext.getMcpCallCount());
             }
 
             if (toolProvider != null) {
diff --git a/src/main/java/com/devoxx/genie/service/prompt/strategy/StreamingPromptStrategy.java b/src/main/java/com/devoxx/genie/service/prompt/strategy/StreamingPromptStrategy.java
index d7c26e13..1cac8d66 100644
--- a/src/main/java/com/devoxx/genie/service/prompt/strategy/StreamingPromptStrategy.java
+++ b/src/main/java/com/devoxx/genie/service/prompt/strategy/StreamingPromptStrategy.java
@@ -5,6 +5,7 @@
 import com.devoxx.genie.service.MessageCreationService;
 import com.devoxx.genie.service.agent.AgentLoopTracker;
 import com.devoxx.genie.service.agent.AgentToolProviderFactory;
+import com.devoxx.genie.service.analytics.FeatureUsageTracker;
 import com.devoxx.genie.service.mcp.MCPExecutionService;
 import com.devoxx.genie.service.prompt.error.ModelException;
 import com.devoxx.genie.service.prompt.memory.ChatMemoryManager;
@@ -100,6 +101,12 @@ protected void executeStrategySpecific(
                     h.stop();
                 }
             }
+            // Emit `agent` feature_used with the tracker's final call count — fires on
+            // success, error, and cancellation (task-209 AC #23).
+            AgentLoopTracker tracker = currentTracker.getAndSet(null);
+            if (tracker != null) {
+                FeatureUsageTracker.agentCompleted(context, tracker.getCallCount());
+            }
         });
     }
 
@@ -175,12 +182,15 @@ private void executeStreamingInBackground(
      * Also sets file references on the context when a provider is available.
      */
     private ToolProvider resolveToolProvider(@NotNull ChatMessageContext context) {
-        ToolProvider toolProvider = AgentToolProviderFactory.createToolProvider(project);
+        // task-209: thread the per-prompt MCP counter through so MCP-inside-agent invocations
+        // are counted via InstrumentedMcpToolProvider.
+        ToolProvider toolProvider = AgentToolProviderFactory.createToolProvider(project, context.getMcpCallCount());
         if (toolProvider instanceof AgentLoopTracker tracker) {
             currentTracker.set(tracker);
         }
         if (toolProvider == null) {
-            toolProvider = MCPExecutionService.getInstance().createMCPToolProvider(project);
+            toolProvider = MCPExecutionService.getInstance()
+                    .createMCPToolProvider(project, context.getMcpCallCount());
         }
         if (toolProvider != null) {
             log.debug("Tool provider created for streaming prompt");
diff --git a/src/main/java/com/devoxx/genie/service/rag/SemanticSearchService.java b/src/main/java/com/devoxx/genie/service/rag/SemanticSearchService.java
index 4715e1f1..9c7ee3c2 100644
--- a/src/main/java/com/devoxx/genie/service/rag/SemanticSearchService.java
+++ b/src/main/java/com/devoxx/genie/service/rag/SemanticSearchService.java
@@ -38,6 +38,8 @@ public SemanticSearchService() {
      * @return Map of search results with file paths as keys
      */
     public @NotNull Map<String, SearchResult> search(Project project, String query) {
+        // Task-209: analytics emission happens at the caller (MessageCreationService) where
+        // the LanguageModel context is available, so provider_type reflects the actual model.
         embeddingService.init(project);
 
         Embedding queryEmbedding = embeddingService.getEmbeddingModel().embed(query).content();
diff --git a/src/main/java/com/devoxx/genie/ui/settings/agent/AgentSettingsComponent.java b/src/main/java/com/devoxx/genie/ui/settings/agent/AgentSettingsComponent.java
index 27df3f89..17ece44d 100644
--- a/src/main/java/com/devoxx/genie/ui/settings/agent/AgentSettingsComponent.java
+++ b/src/main/java/com/devoxx/genie/ui/settings/agent/AgentSettingsComponent.java
@@ -768,6 +768,9 @@ public void apply() {
             }
         }
         stateService.setDisabledAgentTools(disabledTools);
+
+        // Re-arm the feature-enablement analytics snapshot (task-209).
+        com.devoxx.genie.service.analytics.DevoxxGenieSettingsChangedTopic.notifySettingsChanged();
     }
 
     public void reset() {
diff --git a/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsComponent.java b/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsComponent.java
index 995a76c5..af9b9d5e 100644
--- a/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsComponent.java
+++ b/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsComponent.java
@@ -1,5 +1,7 @@
 package com.devoxx.genie.ui.settings.general;
 
+import com.devoxx.genie.service.PropertiesService;
+import com.devoxx.genie.service.analytics.DevoxxGenieSettingsChangedTopic;
 import com.devoxx.genie.ui.settings.DevoxxGenieStateService;
 import com.intellij.ui.components.JBLabel;
 import com.intellij.util.ui.JBUI;
@@ -9,7 +11,7 @@
 import java.awt.*;
 
 /**
- * Settings UI for general DevoxxGenie options. Currently exposes the anonymous usage
+ * Settings UI for Analytics DevoxxGenie options. Currently exposes the anonymous usage
  * analytics opt-out (task-206). Help text below the checkbox enumerates every field that
  * is sent and what is never sent.
  */
@@ -24,7 +26,7 @@ public GeneralSettingsComponent() {
         analyticsEnabledCheckBox = new JCheckBox("Send anonymous usage statistics");
         analyticsEnabledCheckBox.setSelected(Boolean.TRUE.equals(state.getAnalyticsEnabled()));
 
-        JBLabel sentHeader = new JBLabel("<html><b>What is sent</b> (per LLM prompt or model selection):</html>");
+        JBLabel sentHeader = new JBLabel("<html><b>What is sent</b> (per LLM prompt, model selection, or session):</html>");
         JBLabel sentList = new JBLabel(
                 "<html><ul style='margin-left:18px'>" +
                         "<li>An anonymous install ID (UUID), generated once and stored locally</li>" +
@@ -32,6 +34,10 @@ public GeneralSettingsComponent() {
                         "<li>Plugin version and IDE version</li>" +
                         "<li>LLM provider name (e.g. anthropic, ollama)</li>" +
                         "<li>LLM model name (e.g. claude-3-5-sonnet)</li>" +
+                        "<li>Which optional features are enabled (RAG, Agent, MCP, Web Search, streaming) " +
+                        "and coarse counts (e.g. bucketed number of configured MCP servers or custom prompts)</li>" +
+                        "<li>Which features are actually used during a prompt " +
+                        "(feature identifiers only, never prompt text or file content)</li>" +
                         "</ul></html>");
 
         JBLabel notSentHeader = new JBLabel("<html><b>What is never sent:</b></html>");
@@ -39,9 +45,12 @@ public GeneralSettingsComponent() {
                 "<html><ul style='margin-left:18px'>" +
                         "<li>Prompt text, response text, conversation history</li>" +
                         "<li>File content, file paths, project name, git remote</li>" +
+                        "<li>MCP server names, URLs, commands, tool names, or environment variables</li>" +
+                        "<li>User-defined custom prompt names or bodies</li>" +
                         "<li>API keys, credentials, user name, email</li>" +
                         "<li>Token counts or cost data</li>" +
-                        "</ul>This data is used solely to guide which LLM providers and models receive engineering investment.</html>");
+                        "</ul>This data is used only to guide which features and LLM providers receive " +
+                        "engineering investment.</html>");
 
         Color subtle = UIUtil.getContextHelpForeground();
         for (JBLabel l : new JBLabel[]{sentHeader, sentList, notSentHeader, notSentList}) {
@@ -58,8 +67,15 @@ public GeneralSettingsComponent() {
         notSentHeader.setAlignmentX(Component.LEFT_ALIGNMENT);
         notSentList.setAlignmentX(Component.LEFT_ALIGNMENT);
 
+        String version = PropertiesService.getInstance().getVersion();
+        JBLabel versionLabel = new JBLabel("Plugin version: " + (version != null ? version : "unknown"));
+        versionLabel.setAlignmentX(Component.LEFT_ALIGNMENT);
+        versionLabel.setForeground(UIUtil.getContextHelpForeground());
+
         panel.add(analyticsEnabledCheckBox);
         panel.add(Box.createVerticalStrut(8));
+        panel.add(versionLabel);
+        panel.add(Box.createVerticalStrut(16));
         panel.add(sentHeader);
         panel.add(sentList);
         panel.add(Box.createVerticalStrut(8));
@@ -83,6 +99,9 @@ public void apply() {
         // Touching the setting in the UI counts as informed acknowledgement — so we never
         // re-show the first-launch notice for users who configured the toggle explicitly.
         state.setAnalyticsNoticeAcknowledged(true);
+
+        // Re-arm the feature-enablement snapshot (task-209).
+        DevoxxGenieSettingsChangedTopic.notifySettingsChanged();
     }
 
     public void reset() {
diff --git a/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsConfigurable.java b/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsConfigurable.java
index f7173e76..81f7b0e2 100644
--- a/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsConfigurable.java
+++ b/src/main/java/com/devoxx/genie/ui/settings/general/GeneralSettingsConfigurable.java
@@ -7,7 +7,7 @@
 import javax.swing.*;
 
 /**
- * Top-level "General" configurable for DevoxxGenie. Currently hosts the anonymous
+ * Top-level "Analytics" configurable for DevoxxGenie. Currently hosts the anonymous
  * usage analytics opt-out toggle (task-206); future general toggles can live here too.
  */
 public class GeneralSettingsConfigurable implements Configurable {
@@ -17,7 +17,7 @@ public class GeneralSettingsConfigurable implements Configurable {
     @Nls(capitalization = Nls.Capitalization.Title)
     @Override
     public String getDisplayName() {
-        return "General";
+        return "Analytics";
     }
 
     @Override
diff --git a/src/main/java/com/devoxx/genie/ui/settings/mcp/MCPSettingsComponent.java b/src/main/java/com/devoxx/genie/ui/settings/mcp/MCPSettingsComponent.java
index 3bc43562..6b6f653e 100644
--- a/src/main/java/com/devoxx/genie/ui/settings/mcp/MCPSettingsComponent.java
+++ b/src/main/java/com/devoxx/genie/ui/settings/mcp/MCPSettingsComponent.java
@@ -410,6 +410,9 @@ public void apply() {
 
             // Save MCP settings
             stateService.setMcpApprovalTimeout(approvalTimeoutField.getNumber());
+
+            // Re-arm the feature-enablement analytics snapshot (task-209).
+            com.devoxx.genie.service.analytics.DevoxxGenieSettingsChangedTopic.notifySettingsChanged();
             
             // Refresh the tool window visibility if MCP enabled state changed
             if (oldMcpEnabled != enableMcpCheckbox.isSelected()) {
diff --git a/src/main/java/com/devoxx/genie/ui/settings/rag/RAGSettingsConfigurable.java b/src/main/java/com/devoxx/genie/ui/settings/rag/RAGSettingsConfigurable.java
index a91954be..d5852f31 100644
--- a/src/main/java/com/devoxx/genie/ui/settings/rag/RAGSettingsConfigurable.java
+++ b/src/main/java/com/devoxx/genie/ui/settings/rag/RAGSettingsConfigurable.java
@@ -73,6 +73,9 @@ public void apply() {
         stateService.setIndexerMinScore((Double) ragSettingsComponent.getMinScoreField().getValue());
         stateService.setIndexerMaxResults(ragSettingsComponent.getMaxResultsSpinner().getNumber());
 
+        // Re-arm the feature-enablement analytics snapshot (task-209).
+        com.devoxx.genie.service.analytics.DevoxxGenieSettingsChangedTopic.notifySettingsChanged();
+
         if (oldValue != newValue) {
             project.getMessageBus()
                     .syncPublisher(AppTopics.RAG_STATE_TOPIC)
diff --git a/src/main/java/com/devoxx/genie/ui/settings/websearch/WebSearchProvidersConfigurable.java b/src/main/java/com/devoxx/genie/ui/settings/websearch/WebSearchProvidersConfigurable.java
index 4c4a971d..57018e5a 100644
--- a/src/main/java/com/devoxx/genie/ui/settings/websearch/WebSearchProvidersConfigurable.java
+++ b/src/main/java/com/devoxx/genie/ui/settings/websearch/WebSearchProvidersConfigurable.java
@@ -85,6 +85,9 @@ public void apply() {
         settings.setGoogleSearchKey(new String(webSearchProvidersComponent.getGoogleSearchApiKeyField().getPassword()));
         settings.setGoogleCSIKey(new String(webSearchProvidersComponent.getGoogleCSIApiKeyField().getPassword()));
         settings.setMaxSearchResults(webSearchProvidersComponent.getMaxSearchResults().getNumber());
+
+        // Re-arm the feature-enablement analytics snapshot (task-209).
+        com.devoxx.genie.service.analytics.DevoxxGenieSettingsChangedTopic.notifySettingsChanged();
     }
 
     /**
diff --git a/src/main/java/com/devoxx/genie/util/ChatMessageContextUtil.java b/src/main/java/com/devoxx/genie/util/ChatMessageContextUtil.java
index 18200e60..4e86aa66 100644
--- a/src/main/java/com/devoxx/genie/util/ChatMessageContextUtil.java
+++ b/src/main/java/com/devoxx/genie/util/ChatMessageContextUtil.java
@@ -35,13 +35,19 @@ private ChatMessageContextUtil() {
 
         DevoxxGenieStateService stateService = DevoxxGenieStateService.getInstance();
 
+        boolean ragActivated = Boolean.TRUE.equals(stateService.getRagActivated());
+        boolean webSearchActivated = Boolean.TRUE.equals(stateService.getWebSearchActivated());
+
         ChatMessageContext chatMessageContext = ChatMessageContext.builder()
                 .project(chatContextParameters.project())
                 .id(String.valueOf(System.currentTimeMillis()))
                 .tabId(chatContextParameters.tabId())
                 .userPrompt(chatContextParameters.userPromptText())
                 .languageModel(chatContextParameters.languageModel())
-                .webSearchRequested(stateService.getWebSearchActivated() && (stateService.isGoogleSearchEnabled() || stateService.isTavilySearchEnabled()))
+                // task-209: mirror the chat-panel toggles onto the context so analytics reads them at completion.
+                .ragActivated(ragActivated)
+                .webSearchActivated(webSearchActivated)
+                .webSearchRequested(webSearchActivated && (stateService.isGoogleSearchEnabled() || stateService.isTavilySearchEnabled()))
                 .executionTimeMs(0)
                 .cost(0)
                 .build();
@@ -83,6 +89,8 @@ private static void setWindowContext(@NotNull ChatMessageContext chatMessageCont
         if (projectContext != null && isProjectContextAdded) {
             // If the full project is added as context, set it and ignore any attached files
             chatMessageContext.setFilesContext(projectContext);
+            // task-209 analytics signal — no content, only a boolean flag
+            chatMessageContext.setProjectContextFullUsed(true);
         } else {
             // We don't include separate added files to the context if the full project is already included
             processAttachedFiles(chatMessageContext);
@@ -118,6 +126,8 @@ private static void processAttachedFiles(@NotNull ChatMessageContext chatMessage
         if (!files.isEmpty()) {
             // Defer file content loading to background thread to avoid EDT freeze on large files
             chatMessageContext.setPendingAttachedFiles(new ArrayList<>(files));
+            // task-209 analytics signal — no content, only a boolean flag
+            chatMessageContext.setProjectContextSelectedUsed(true);
         }
     }
 
diff --git a/src/main/resources/META-INF/plugin.xml b/src/main/resources/META-INF/plugin.xml
index 14a31ded..7781855a 100644
--- a/src/main/resources/META-INF/plugin.xml
+++ b/src/main/resources/META-INF/plugin.xml
@@ -52,9 +52,11 @@
             <LI>Plugin version and IDE version</LI>
             <LI>LLM provider name (e.g. anthropic, ollama)</LI>
             <LI>LLM model name (e.g. claude-3-5-sonnet)</LI>
+            <LI>Which optional features are enabled (RAG, Agent mode, MCP, Web Search, streaming) and coarse counts such as the number of configured MCP servers or custom prompts — never server names, URLs, commands, or user-defined prompt names</LI>
+            <LI>Which features are actually used during a prompt (RAG, Agent, MCP, Web Search, project context, custom prompts) — feature identifiers only, never prompt text or file content</LI>
         </UL>
-        <p><strong>What is never sent:</strong> prompt text, response text, conversation history, file content, file paths, project names, git remotes, API keys, credentials, token counts, or cost data.</p>
-        <p>A first-launch notification asks for your consent before any data is sent. You can change this any time in <em>Settings → DevoxxGenie → General</em>.</p>
+        <p><strong>What is never sent:</strong> prompt text, response text, conversation history, file content, file paths, project names, git remotes, API keys, credentials, token counts, cost data, MCP server names/URLs/commands, or user-defined custom prompt names.</p>
+        <p>A first-launch notification asks for your consent before any data is sent. You can change this any time in <em>Settings → DevoxxGenie → Analytics</em>.</p>
     ]]></description>
 
     <change-notes><![CDATA[
@@ -470,7 +472,7 @@
         <projectConfigurable id="com.devoxx.genie.GeneralSettings"
                              parentId="com.devoxx.genie.DevoxxGenie"
                              instance="com.devoxx.genie.ui.settings.general.GeneralSettingsConfigurable"
-                             displayName="General"/>
+                             displayName="Analytics"/>
 
         <projectConfigurable id="com.devoxx.genie.LLMSettings"
                              parentId="com.devoxx.genie.DevoxxGenie"
diff --git a/src/test/java/com/devoxx/genie/service/analytics/AnalyticsEventBuilderTest.java b/src/test/java/com/devoxx/genie/service/analytics/AnalyticsEventBuilderTest.java
new file mode 100644
index 00000000..144eb5fb
--- /dev/null
+++ b/src/test/java/com/devoxx/genie/service/analytics/AnalyticsEventBuilderTest.java
@@ -0,0 +1,219 @@
+package com.devoxx.genie.service.analytics;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Unit tests for {@link AnalyticsEventBuilder} (task-209, ACs #2, #8, #15).
+ *
+ * <p>These assert the central allowlist + shape enforcement that protects all downstream
+ * analytics events from accidental PII leakage.
+ */
+class AnalyticsEventBuilderTest {
+
+    private static final String CLIENT_ID = "test-client-id";
+
+    private static Map<String, String> common() {
+        Map<String, String> c = new LinkedHashMap<>();
+        c.put("app_name", "devoxxgenie-intellij");
+        c.put("app_version", "1.2.3");
+        c.put("ide_version", "2024.1");
+        c.put("session_id", "1234567890");
+        return c;
+    }
+
+    @Test
+    void buildsValidPromptExecutedPayload() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "claude-3-5-sonnet");
+
+        String json = AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common());
+
+        assertThat(json).isNotNull();
+        assertThat(json).contains("\"name\":\"prompt_executed\"");
+        assertThat(json).contains("\"provider_id\":\"anthropic\"");
+        assertThat(json).contains("\"model_name\":\"claude-3-5-sonnet\"");
+        assertThat(json).contains("\"engagement_time_msec\":1");
+    }
+
+    @Test
+    void buildsValidFeatureEnabledPayload() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("feature_id", "rag");
+
+        String json = AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_FEATURE_ENABLED, ev, common());
+
+        assertThat(json).isNotNull();
+        assertThat(json).contains("\"name\":\"feature_enabled\"");
+        assertThat(json).contains("\"feature_id\":\"rag\"");
+    }
+
+    @Test
+    void buildsValidFeatureUsedPayload() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("feature_id", "mcp");
+        ev.put("provider_type", "local");
+        ev.put("tool_call_count", "2-5");
+
+        String json = AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_FEATURE_USED, ev, common());
+
+        assertThat(json).isNotNull();
+        assertThat(json).contains("\"feature_id\":\"mcp\"");
+        assertThat(json).contains("\"provider_type\":\"local\"");
+        assertThat(json).contains("\"tool_call_count\":\"2-5\"");
+    }
+
+    @Test
+    void unknownEventNameIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "claude");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, "made_up_event", ev, common())).isNull();
+    }
+
+    @Test
+    void unknownParamKeyIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "claude");
+        ev.put("prompt_text", "hello world"); // leakage attempt
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void disallowedEnumValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("feature_id", "not_a_real_feature");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_FEATURE_ENABLED, ev, common())).isNull();
+    }
+
+    @Test
+    void disallowedBucketValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("feature_id", "agent");
+        ev.put("provider_type", "cloud");
+        ev.put("tool_call_count", "42"); // raw int — not allowed
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_FEATURE_USED, ev, common())).isNull();
+    }
+
+    @Test
+    void disallowedProviderTypeIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("feature_id", "agent");
+        ev.put("provider_type", "optional"); // collapsed into "cloud" upstream; schema forbids this literal
+        ev.put("tool_call_count", "1");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_FEATURE_USED, ev, common())).isNull();
+    }
+
+    @Test
+    void absolutePathShapedValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "/Users/stephan/secret");
+        ev.put("model_name", "claude");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void windowsPathShapedValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "\\\\server\\share\\leak");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void windowsDriveLetterBackslashPathIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "C:\\Users\\me\\project");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void windowsDriveLetterForwardSlashPathIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "D:/Users/me/project");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void lowercaseWindowsDriveLetterIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "z:\\leak");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void urlShapedValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "https://evil.example.com/");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void newlineInValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "line1\nline2");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void overlyLongValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "x".repeat(200));
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void emptyValueIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "");
+        ev.put("model_name", "claude");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common())).isNull();
+    }
+
+    @Test
+    void unknownCommonParamKeyIsRejected() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "claude");
+        Map<String, String> badCommon = common();
+        badCommon.put("user_email", "leak@example.com");
+        assertThat(AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, badCommon)).isNull();
+    }
+
+    @Test
+    void payloadContainsNoForbiddenSubstringsForTypicalInputs() {
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "anthropic");
+        ev.put("model_name", "claude-3-5-sonnet");
+        String json = AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common());
+
+        assertThat(json).isNotNull();
+        assertThat(json).doesNotContain("/Users/");
+        assertThat(json).doesNotContain("file:");
+        assertThat(json).doesNotContain("password");
+        assertThat(json).doesNotContain("apiKey");
+    }
+
+    @Test
+    void huggingFaceStyleModelNameWithMidSlashIsAccepted() {
+        // Model names like "meta-llama/Llama-3.1-8B" must still go through — only leading slash / URL forms are blocked.
+        Map<String, String> ev = new LinkedHashMap<>();
+        ev.put("provider_id", "ollama");
+        ev.put("model_name", "meta-llama/Llama-3.1-8B");
+        String json = AnalyticsEventBuilder.build(CLIENT_ID, AnalyticsService.EVENT_PROMPT_EXECUTED, ev, common());
+        assertThat(json).isNotNull();
+        assertThat(json).contains("meta-llama/Llama-3.1-8B");
+    }
+}
diff --git a/src/test/java/com/devoxx/genie/service/analytics/AnalyticsSessionSnapshotServiceTest.java b/src/test/java/com/devoxx/genie/service/analytics/AnalyticsSessionSnapshotServiceTest.java
new file mode 100644
index 00000000..4d45b4c9
--- /dev/null
+++ b/src/test/java/com/devoxx/genie/service/analytics/AnalyticsSessionSnapshotServiceTest.java
@@ -0,0 +1,209 @@
+package com.devoxx.genie.service.analytics;
+
+import com.devoxx.genie.model.CustomPrompt;
+import com.devoxx.genie.model.mcp.MCPServer;
+import com.devoxx.genie.model.mcp.MCPSettings;
+import com.devoxx.genie.ui.settings.DevoxxGenieStateService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mockStatic;
+
+/**
+ * Unit tests for {@link AnalyticsSessionSnapshotService} (task-209 ACs #1, #19, #22, #28).
+ *
+ * <p>No IntelliJ platform fixtures — the test uses the package-private constructor that
+ * injects a recording {@link AnalyticsService}, then calls {@code snapshotIfNeeded()}
+ * directly.
+ */
+class AnalyticsSessionSnapshotServiceTest {
+
+    private DevoxxGenieStateService state;
+    private RecordingSink analytics;
+    private AnalyticsSessionSnapshotService snapshot;
+
+    @BeforeEach
+    void setUp() {
+        state = new DevoxxGenieStateService();
+        state.setAnalyticsEnabled(true);
+        state.setAnalyticsNoticeAcknowledged(true);
+        state.setAnalyticsClientId("");
+        state.setAnalyticsEndpoint("https://example.invalid/collect");
+
+        // Start from a known-empty feature state: each test opts in what it wants.
+        state.setRagEnabled(false);
+        state.setMcpEnabled(false);
+        state.setAgentModeEnabled(false);
+        state.setStreamMode(false);
+        state.setGoogleSearchEnabled(false);
+        state.setTavilySearchEnabled(false);
+        state.setCustomPrompts(new ArrayList<>());
+        state.setMcpSettings(new MCPSettings());
+        state.setChatMemorySize(0);
+
+        analytics = new RecordingSink();
+        snapshot = new AnalyticsSessionSnapshotService(analytics);
+    }
+
+    private void withState(Runnable action) {
+        try (MockedStatic<DevoxxGenieStateService> mocked = mockStatic(DevoxxGenieStateService.class)) {
+            mocked.when(DevoxxGenieStateService::getInstance).thenReturn(state);
+            action.run();
+        }
+    }
+
+    @Test
+    void snapshotFiresOnceForAllEnabledFeatures() {
+        state.setRagEnabled(true);
+        state.setMcpEnabled(true);
+        state.setAgentModeEnabled(true);
+        state.setStreamMode(true);
+        state.setGoogleSearchEnabled(true);
+        state.setTavilySearchEnabled(true);
+
+        withState(snapshot::snapshotIfNeeded);
+
+        assertThat(analytics.enabledEvents).containsExactlyInAnyOrder(
+                FeatureId.RAG, FeatureId.MCP, FeatureId.AGENT,
+                FeatureId.STREAMING, FeatureId.WEB_SEARCH_GOOGLE, FeatureId.WEB_SEARCH_TAVILY);
+        assertThat(analytics.countsEvents).hasSize(1);
+    }
+
+    @Test
+    void snapshotSkipsDisabledFeatures() {
+        state.setRagEnabled(true);
+        // everything else stays off
+
+        withState(snapshot::snapshotIfNeeded);
+
+        assertThat(analytics.enabledEvents).containsExactly(FeatureId.RAG);
+    }
+
+    @Test
+    void snapshotIsOneShotPerSession() {
+        state.setRagEnabled(true);
+
+        withState(() -> {
+            snapshot.snapshotIfNeeded();
+            snapshot.snapshotIfNeeded();
+            snapshot.snapshotIfNeeded();
+        });
+
+        // Task-209 AC #1 / #28: multiple project opens in one IDE session → single emission.
+        assertThat(analytics.enabledEvents).containsExactly(FeatureId.RAG);
+        assertThat(analytics.countsEvents).hasSize(1);
+    }
+
+    @Test
+    void settingsChangedReArmsSnapshot() {
+        state.setRagEnabled(true);
+        withState(snapshot::snapshotIfNeeded);
+
+        // Change a setting — simulate the MessageBus callback.
+        state.setMcpEnabled(true);
+        snapshot.settingsChanged();
+
+        withState(snapshot::snapshotIfNeeded);
+
+        // RAG emitted twice (once per snapshot), MCP once (only after it was enabled).
+        assertThat(analytics.enabledEvents).containsExactlyInAnyOrder(
+                FeatureId.RAG, FeatureId.RAG, FeatureId.MCP);
+        assertThat(analytics.countsEvents).hasSize(2);
+    }
+
+    @Test
+    void customPromptCountEmittedAsBucketedValue() {
+        List<CustomPrompt> prompts = new ArrayList<>();
+        prompts.add(new CustomPrompt("one", "body"));
+        prompts.add(new CustomPrompt("two", "body"));
+        prompts.add(new CustomPrompt("three", "body"));
+        state.setCustomPrompts(prompts);
+
+        withState(snapshot::snapshotIfNeeded);
+
+        // Enablement event fired because count > 0
+        assertThat(analytics.enabledEvents).contains(FeatureId.CUSTOM_PROMPT);
+        // Counts event fired with "2-5" bucket for a count of 3.
+        assertThat(analytics.lastCountsEvent).isNotNull();
+        assertThat(analytics.lastCountsEvent.customPromptCountBucket).isEqualTo("2-5");
+    }
+
+    @Test
+    void mcpServerCountIsBucketed() {
+        MCPSettings s = new MCPSettings();
+        Map<String, MCPServer> servers = new HashMap<>();
+        servers.put("a", new MCPServer());
+        servers.put("b", new MCPServer());
+        servers.put("c", new MCPServer());
+        servers.put("d", new MCPServer());
+        servers.put("e", new MCPServer());
+        servers.put("f", new MCPServer());
+        s.setMcpServers(servers);
+        state.setMcpSettings(s);
+
+        withState(snapshot::snapshotIfNeeded);
+
+        assertThat(analytics.lastCountsEvent.mcpServerCountBucket).isEqualTo("6-10");
+    }
+
+    @Test
+    void chatMemoryBucketsSeparately() {
+        state.setChatMemorySize(15);
+        withState(snapshot::snapshotIfNeeded);
+
+        assertThat(analytics.lastCountsEvent.chatMemoryBucket).isEqualTo("11-20");
+    }
+
+    @Test
+    void usageOnlyFeatureIdCannotBeEnabled() {
+        // Sanity: if someone calls trackFeatureEnabled with a usage-only feature_id, the
+        // AnalyticsService rejects it upstream. This belongs to the real AnalyticsService
+        // — exercised here by calling it directly.
+        AnalyticsService real = new AnalyticsService();
+        // Don't send anything over the network: no endpoint set in mocked state.
+        real.trackFeatureEnabled(FeatureId.DEVOXXGENIE_MD);
+        real.trackFeatureEnabled(FeatureId.PROJECT_CONTEXT_FULL);
+        real.trackFeatureEnabled(FeatureId.PROJECT_CONTEXT_SELECTED);
+        real.trackFeatureEnabled(FeatureId.SEMANTIC_SEARCH);
+        // No assertion needed — if usageOnly is wired correctly, no NPE / no call escapes
+        // the rejection path. Test passes by not throwing.
+    }
+
+    /** Minimal recording sink that captures which FeatureIds were emitted. */
+    private static class RecordingSink implements AnalyticsSessionSnapshotService.FeatureEventSink {
+        final List<FeatureId> enabledEvents = new ArrayList<>();
+        final List<CountsEvent> countsEvents = new ArrayList<>();
+        CountsEvent lastCountsEvent;
+
+        @Override
+        public void trackFeatureEnabled(FeatureId featureId) {
+            if (featureId.isUsageOnly()) return;
+            enabledEvents.add(featureId);
+        }
+
+        @Override
+        public void trackFeatureCounts(String mcp, String custom, String memory) {
+            CountsEvent e = new CountsEvent(mcp, custom, memory);
+            countsEvents.add(e);
+            lastCountsEvent = e;
+        }
+    }
+
+    private static class CountsEvent {
+        final String mcpServerCountBucket;
+        final String customPromptCountBucket;
+        final String chatMemoryBucket;
+        CountsEvent(String mcp, String custom, String memory) {
+            this.mcpServerCountBucket = mcp;
+            this.customPromptCountBucket = custom;
+            this.chatMemoryBucket = memory;
+        }
+    }
+}
diff --git a/src/test/java/com/devoxx/genie/service/analytics/BucketsTest.java b/src/test/java/com/devoxx/genie/service/analytics/BucketsTest.java
new file mode 100644
index 00000000..b08021bd
--- /dev/null
+++ b/src/test/java/com/devoxx/genie/service/analytics/BucketsTest.java
@@ -0,0 +1,35 @@
+package com.devoxx.genie.service.analytics;
+
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class BucketsTest {
+
+    @Test
+    void standardBucketsCoverEveryBoundary() {
+        assertThat(Buckets.standard(-1)).isEqualTo("0");
+        assertThat(Buckets.standard(0)).isEqualTo("0");
+        assertThat(Buckets.standard(1)).isEqualTo("1");
+        assertThat(Buckets.standard(2)).isEqualTo("2-5");
+        assertThat(Buckets.standard(5)).isEqualTo("2-5");
+        assertThat(Buckets.standard(6)).isEqualTo("6-10");
+        assertThat(Buckets.standard(10)).isEqualTo("6-10");
+        assertThat(Buckets.standard(11)).isEqualTo("11+");
+        assertThat(Buckets.standard(999)).isEqualTo("11+");
+    }
+
+    @Test
+    void chatMemoryBucketsCoverEveryBoundary() {
+        assertThat(Buckets.chatMemory(-1)).isEqualTo("0");
+        assertThat(Buckets.chatMemory(0)).isEqualTo("0");
+        assertThat(Buckets.chatMemory(1)).isEqualTo("1-5");
+        assertThat(Buckets.chatMemory(5)).isEqualTo("1-5");
+        assertThat(Buckets.chatMemory(6)).isEqualTo("6-10");
+        assertThat(Buckets.chatMemory(10)).isEqualTo("6-10");
+        assertThat(Buckets.chatMemory(11)).isEqualTo("11-20");
+        assertThat(Buckets.chatMemory(20)).isEqualTo("11-20");
+        assertThat(Buckets.chatMemory(21)).isEqualTo("21+");
+        assertThat(Buckets.chatMemory(500)).isEqualTo("21+");
+    }
+}
diff --git a/src/test/java/com/devoxx/genie/service/analytics/FeatureUsageTrackerTest.java b/src/test/java/com/devoxx/genie/service/analytics/FeatureUsageTrackerTest.java
new file mode 100644
index 00000000..0c3baabb
--- /dev/null
+++ b/src/test/java/com/devoxx/genie/service/analytics/FeatureUsageTrackerTest.java
@@ -0,0 +1,69 @@
+package com.devoxx.genie.service.analytics;
+
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Unit tests for {@link FeatureUsageTracker} (task-209, ACs #18, #26).
+ *
+ * <p>The tracker is a thin facade and its main behavior (emit at most one event per
+ * activated feature, with the right bucket) is covered indirectly by
+ * {@code AnalyticsSessionSnapshotServiceTest} + {@code AnalyticsEventBuilderTest}. This
+ * file adds focused rule checks that don't require mocking the full analytics pipeline.
+ */
+class FeatureUsageTrackerTest {
+
+    @Test
+    void allFeatureIdsHaveWireValuesMatchingSchemaDoc() {
+        // Guardrail: the closed enum must always match docs/analytics-schema.md.
+        assertThat(FeatureId.RAG.wireValue()).isEqualTo("rag");
+        assertThat(FeatureId.SEMANTIC_SEARCH.wireValue()).isEqualTo("semantic_search");
+        assertThat(FeatureId.WEB_SEARCH_GOOGLE.wireValue()).isEqualTo("web_search_google");
+        assertThat(FeatureId.WEB_SEARCH_TAVILY.wireValue()).isEqualTo("web_search_tavily");
+        assertThat(FeatureId.AGENT.wireValue()).isEqualTo("agent");
+        assertThat(FeatureId.MCP.wireValue()).isEqualTo("mcp");
+        assertThat(FeatureId.STREAMING.wireValue()).isEqualTo("streaming");
+        assertThat(FeatureId.PROJECT_CONTEXT_FULL.wireValue()).isEqualTo("project_context_full");
+        assertThat(FeatureId.PROJECT_CONTEXT_SELECTED.wireValue()).isEqualTo("project_context_selected");
+        assertThat(FeatureId.DEVOXXGENIE_MD.wireValue()).isEqualTo("devoxxgenie_md");
+        assertThat(FeatureId.CUSTOM_PROMPT.wireValue()).isEqualTo("custom_prompt");
+    }
+
+    @Test
+    void exactlyTheRightFeaturesAreFlaggedUsageOnly() {
+        // Task-209 AC #21: usage-only feature_ids must never appear in feature_enabled snapshots.
+        assertThat(FeatureId.SEMANTIC_SEARCH.isUsageOnly()).isTrue();
+        assertThat(FeatureId.PROJECT_CONTEXT_FULL.isUsageOnly()).isTrue();
+        assertThat(FeatureId.PROJECT_CONTEXT_SELECTED.isUsageOnly()).isTrue();
+        assertThat(FeatureId.DEVOXXGENIE_MD.isUsageOnly()).isTrue();
+
+        // Everything else is snapshot-eligible.
+        assertThat(FeatureId.RAG.isUsageOnly()).isFalse();
+        assertThat(FeatureId.WEB_SEARCH_GOOGLE.isUsageOnly()).isFalse();
+        assertThat(FeatureId.WEB_SEARCH_TAVILY.isUsageOnly()).isFalse();
+        assertThat(FeatureId.AGENT.isUsageOnly()).isFalse();
+        assertThat(FeatureId.MCP.isUsageOnly()).isFalse();
+        assertThat(FeatureId.STREAMING.isUsageOnly()).isFalse();
+        assertThat(FeatureId.CUSTOM_PROMPT.isUsageOnly()).isFalse();
+    }
+
+    @Test
+    void fromWireValueRoundTrips() {
+        for (FeatureId id : FeatureId.values()) {
+            assertThat(FeatureId.fromWireValue(id.wireValue())).contains(id);
+        }
+    }
+
+    @Test
+    void fromWireValueRejectsUnknown() {
+        assertThat(FeatureId.fromWireValue("not_a_feature")).isEmpty();
+    }
+
+    @Test
+    void semanticSearchUsedWithNullModelDoesNotThrow() {
+        // Fail-silent: null model → provider_type=none, event still goes through the allowlist.
+        // No observable assertion here — test passes if no exception bubbles.
+        FeatureUsageTracker.semanticSearchUsed(null);
+    }
+}
diff --git a/src/test/java/com/devoxx/genie/service/analytics/ProviderTypeTest.java b/src/test/java/com/devoxx/genie/service/analytics/ProviderTypeTest.java
new file mode 100644
index 00000000..eec24415
--- /dev/null
+++ b/src/test/java/com/devoxx/genie/service/analytics/ProviderTypeTest.java
@@ -0,0 +1,58 @@
+package com.devoxx.genie.service.analytics;
+
+import com.devoxx.genie.model.enumarations.ModelProvider;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class ProviderTypeTest {
+
+    @Test
+    void nullProviderMapsToNone() {
+        assertThat(ProviderType.fromModelProvider(null)).isEqualTo(ProviderType.NONE);
+    }
+
+    @Test
+    void everyLocalProviderMapsToLocal() {
+        for (ModelProvider p : ModelProvider.values()) {
+            if (p.getType() == ModelProvider.Type.LOCAL) {
+                assertThat(ProviderType.fromModelProvider(p))
+                        .as("local provider %s", p)
+                        .isEqualTo(ProviderType.LOCAL);
+            }
+        }
+    }
+
+    @Test
+    void everyCloudProviderMapsToCloud() {
+        for (ModelProvider p : ModelProvider.values()) {
+            if (p.getType() == ModelProvider.Type.CLOUD) {
+                assertThat(ProviderType.fromModelProvider(p))
+                        .as("cloud provider %s", p)
+                        .isEqualTo(ProviderType.CLOUD);
+            }
+        }
+    }
+
+    @Test
+    void optionalProvidersFoldIntoCloud() {
+        // Task-209 AC #16 — AzureOpenAI and Bedrock are enterprise cloud endpoints, not a separate bucket.
+        assertThat(ProviderType.fromModelProvider(ModelProvider.AzureOpenAI)).isEqualTo(ProviderType.CLOUD);
+        assertThat(ProviderType.fromModelProvider(ModelProvider.Bedrock)).isEqualTo(ProviderType.CLOUD);
+    }
+
+    @Test
+    void wireValuesAreExactStringsInSchema() {
+        assertThat(ProviderType.LOCAL.wireValue()).isEqualTo("local");
+        assertThat(ProviderType.CLOUD.wireValue()).isEqualTo("cloud");
+        assertThat(ProviderType.NONE.wireValue()).isEqualTo("none");
+    }
+
+    @Test
+    void allModelProviderValuesCoveredWithoutThrowing() {
+        // Guardrail: if a new Type enum constant is added, this test forces us to extend the switch.
+        for (ModelProvider p : ModelProvider.values()) {
+            assertThat(ProviderType.fromModelProvider(p)).isNotNull();
+        }
+    }
+}
diff --git a/src/test/java/com/devoxx/genie/service/mcp/InstrumentedMcpToolProviderTest.java b/src/test/java/com/devoxx/genie/service/mcp/InstrumentedMcpToolProviderTest.java
new file mode 100644
index 00000000..1ae9c535
--- /dev/null
+++ b/src/test/java/com/devoxx/genie/service/mcp/InstrumentedMcpToolProviderTest.java
@@ -0,0 +1,92 @@
+package com.devoxx.genie.service.mcp;
+
+import dev.langchain4j.agent.tool.ToolExecutionRequest;
+import dev.langchain4j.agent.tool.ToolSpecification;
+import dev.langchain4j.data.message.UserMessage;
+import dev.langchain4j.service.tool.ToolExecutor;
+import dev.langchain4j.service.tool.ToolProvider;
+import dev.langchain4j.service.tool.ToolProviderRequest;
+import dev.langchain4j.service.tool.ToolProviderResult;
+import org.junit.jupiter.api.Test;
+
+import java.util.concurrent.atomic.AtomicInteger;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/**
+ * Unit tests for {@link InstrumentedMcpToolProvider} (task-209, AC #24).
+ *
+ * <p>Verifies the counter is incremented inside the wrapped {@code execute()} path and
+ * <strong>not</strong> inside {@code provideTools} — so speculative {@code provideTools}
+ * calls by the LLM framework never inflate the count. Also verifies failed executions do
+ * not increment the counter.
+ */
+class InstrumentedMcpToolProviderTest {
+
+    @Test
+    void provideToolsDoesNotIncrementCounter() {
+        AtomicInteger counter = new AtomicInteger(0);
+        ToolProvider delegate = fakeProvider((req, mem) -> "ok");
+
+        InstrumentedMcpToolProvider instrumented = new InstrumentedMcpToolProvider(delegate, counter);
+        // Speculative provideTools call: the LLM may ask for the tool list without executing anything.
+        instrumented.provideTools(new ToolProviderRequest("test", UserMessage.from("hi")));
+
+        assertThat(counter.get()).isZero();
+    }
+
+    @Test
+    void eachExecuteIncrementsCounter() throws Exception {
+        AtomicInteger counter = new AtomicInteger(0);
+        ToolProvider delegate = fakeProvider((req, mem) -> "tool-result");
+
+        InstrumentedMcpToolProvider instrumented = new InstrumentedMcpToolProvider(delegate, counter);
+        ToolProviderResult result = instrumented.provideTools(new ToolProviderRequest("test", UserMessage.from("hi")));
+        ToolExecutor executor = result.tools().values().iterator().next();
+
+        executor.execute(dummyRequest(), null);
+        executor.execute(dummyRequest(), null);
+        executor.execute(dummyRequest(), null);
+
+        assertThat(counter.get()).isEqualTo(3);
+    }
+
+    @Test
+    void failedExecutionDoesNotIncrementCounter() {
+        AtomicInteger counter = new AtomicInteger(0);
+        ToolProvider delegate = fakeProvider((req, mem) -> {
+            throw new RuntimeException("MCP server unreachable");
+        });
+
+        InstrumentedMcpToolProvider instrumented = new InstrumentedMcpToolProvider(delegate, counter);
+        ToolProviderResult result = instrumented.provideTools(new ToolProviderRequest("test", UserMessage.from("hi")));
+        ToolExecutor executor = result.tools().values().iterator().next();
+
+        assertThatThrownBy(() -> executor.execute(dummyRequest(), null))
+                .isInstanceOf(RuntimeException.class);
+
+        assertThat(counter.get()).isZero();
+    }
+
+    @Test
+    void delegateWithZeroToolsLeavesCounterUnchanged() {
+        AtomicInteger counter = new AtomicInteger(0);
+        ToolProvider empty = request -> ToolProviderResult.builder().build();
+
+        InstrumentedMcpToolProvider instrumented = new InstrumentedMcpToolProvider(empty, counter);
+        ToolProviderResult result = instrumented.provideTools(new ToolProviderRequest("test", UserMessage.from("hi")));
+
+        assertThat(result.tools()).isEmpty();
+        assertThat(counter.get()).isZero();
+    }
+
+    private static ToolProvider fakeProvider(ToolExecutor executor) {
+        ToolSpecification spec = ToolSpecification.builder().name("fake_tool").description("fake").build();
+        return request -> ToolProviderResult.builder().add(spec, executor).build();
+    }
+
+    private static ToolExecutionRequest dummyRequest() {
+        return ToolExecutionRequest.builder().id("1").name("fake_tool").arguments("{}").build();
+    }
+}