@adrata/adrata-mcp 1.0.40 → 1.0.42

package/api-bridge.js

@@ -216,6 +216,19 @@ const ALLOWED_PREFIXES = [
   // write like any other; the strategic commitment itself still moves through
   // spoq/ PRs (company/decisions/2026-08-06-spoq-roadmap-sync.md).
   '/api/v1/work-scopes',
+  // The products and capability catalog those containers deliver against —
+  // what the Products, Capabilities and Roadmap surfaces read. Named
+  // `work-capabilities` rather than `capabilities` because `Surface::Core`
+  // already mounts an unrelated `/capabilities` router with a differently-named
+  // path parameter, and two routers on one prefix is a hard axum panic at
+  // construction (see mounts/crm.rs).
+  //
+  // It was missing while every sibling board family was present, so an agent
+  // could read every card in the workspace and not the catalog behind them. The
+  // refusal reads as deliberate policy — `path is outside the agent bridge
+  // allowlist` — which is why nobody questioned it: an omission and a decision
+  // are indistinguishable from the error message.
+  '/api/v1/work-capabilities',
   '/api/v1/workflow-runtime',
   '/api/v1/workflows',
   '/api/v1/workspace',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrata/adrata-mcp",
-  "version": "1.0.40",
+  "version": "1.0.42",
   "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. About 275 tools registered at startup for companies, people, deals, actions, buyer groups, warm intros, webhooks and intelligence, plus 65 more behind eight named toolsets you load with enable_toolset.",
   "type": "module",
   "main": "server.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "com.adrata/adrata-mcp",
   "description": "Adrata revenue-intelligence MCP server: companies, people, opportunities, actions, buyer groups, enrichment, email, and workspace operations for AI agents.",
   "status": "active",
-  "version": "1.0.40",
+  "version": "1.0.42",
   "websiteUrl": "https://adrata.com/developers",
   "repository": {
     "url": "https://github.com/adrata/adrata",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@adrata/adrata-mcp",
-      "version": "1.0.40",
+      "version": "1.0.42",
       "transport": {
         "type": "stdio"
       },

package/skills/qa-the-card/SKILL.md

@@ -186,6 +186,19 @@ does not establish that the screen is visually correct.
   by this bridge` line in the playback evidence, then close the bridge. If that
   line is the WARNING instead, the bridge sent no policy and the playback it
   showed says nothing about the deployed one.
+- The pool the bridge asks for is usually the one you are already running on.
+  Call `workspace_status` first: when it reports `authSource: "stored_pool"`, an
+  `identityPool`, and `apiBase: https://api.adrata.com`, that named pool is a
+  canonical QA identity — run the bridge under that `ADRATA_MCP_IDENTITY_POOL`
+  and the `ADRATA_MCP_CONFIG_DIR` your server was started with. Holding only a
+  staging lane session (`qa:lanes`) does not mean the fleet holds no canonical
+  credential; two lanes declared a canonical playback journey owner-only on
+  2026-09-11 while running on pool `qa1` against the canonical API.
+- The bridge binds to ONE card and serves only that card's receipts. When a
+  criterion names "the original QA video", bridge the card that CARRIES that
+  receipt — `list_work_item_qa_evidence` on the card where the journey was
+  recorded — not the card whose criterion you are executing. Bridging a card
+  with zero receipts shows no video, and that is not a playback failure.
 
 ## Manage cards as outcomes, not bug counters