That initial set of capabilities comes from the NGINX proxy and is hard-coded as the set of things which seem to be needed to make clients interoperate well. The second response (yeah, I know it's long!) is from the Cyrus IMAPd server on your backend. I see you captured that right now though, because X-CREATEDMODSEQ has only been there about a week. It's probably going to be renamed as GLOBALMODSEQ or something eventually... check out https://mailarchive.ietf.org/arch/browse/extra/ for all the gory details.