@withpica/mcp-server 2.101.0 → 2.103.0

package/CHANGELOG.md

@@ -11,6 +11,107 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.103.0] - 2026-10-09
+
+### Security
+
+- `@modelcontextprotocol/sdk` moves to 1.31.0 (GHSA-6qxp-vccf-f47h, high: the SDK's
+  OAuth client could send credentials to an authorization server the MCP server chose).
+
+### Fixed
+
+- Tool titles: a title a tool declares is now advertised (it was discarded), so `pica_discover`, `pica_tool_details` and `pica_execute` show words instead of their names in connector tool lists. `pica_sign_in` and `pica_sign_out` gain titles. Eight catalog tools declared a title that differed from their display name; the declarations are removed so their advertised titles are unchanged. A test fails any tool without a title, or with a declared title that disagrees with its display name.
+
+### Changed
+
+- **Measured audio facts are labelled.** `pica_audio_inspect` (analysis
+  section) and `pica_recordings_inspect` (audio section) carry a `measured`
+  block — `tempo_bpm`, `key`, `mode`, `energy`, `energy_method`,
+  `loudness_lufs`, `duration_seconds`, `analysis_version` — with a
+  `measured_basis` line. Energy is now measured from integrated loudness;
+  files analysed before that say `energy_method: "legacy_rms_capped"`.
+- `pica_audio_analyze` no longer promises valence or mood: the analyser
+  measures neither, and both come back null.
+- `pica_audio_inspect` no longer returns `detected_valence`, which read a
+  field the API never sent and was always absent.
+
+### Added
+
+- **`pica_sync_fit_query`: which songs fit film and TV productions in
+  progress.** The same list as the sync page's "fit" section, per song
+  (`work_id`), per production (`screen_project_id`), or the whole catalogue
+  spread so each song's best three pairs come before any song's fourth.
+  Pages with `limit` (≤ 100) and `offset` and says how many pairs there are
+  in all. Each production carries its genres, themes, countries, language,
+  release date, stage, companies and networks; with `song_facts: true` each
+  row also carries the song's genres, lyric language and a `measured` entry
+  per analysed master (tempo_bpm, key, mode, duration_seconds: the same names
+  as the other tools' measured blocks), so the user's AI can judge the fit
+  itself. Read-only:
+  the description tells the AI its judgement belongs in its answer and is
+  never written back to PICA.
+- **Directory topics from the owner** (`pica_topics_untagged`, `pica_topics_inspect`,
+  `pica_topics_propose`, `pica_topics_review`) and the `tag-my-songs` skill. The owner's
+  assistant reads the owner's lyrics and audio facts and proposes up to five topics from a
+  fixed list (and moods per recording); the owner approves before anything is public. PICA
+  runs no AI on lyrics.
+
+### Fixed — honest totals (row-cap T3)
+
+- List tools report the REAL total and an honest `has_more` instead of the
+  page length: people, agreements, recordings (whose unfiltered list also
+  re-served page one), bookings, licence enquiries, party claims, releases,
+  sessions, collaborator invites, custody. Publishers and labels report
+  `total: null` (platform-wide rows are not counted) with an honest
+  `has_more`, and take `offset`.
+- `pica_people_query`: a single `role` is filtered server-side when it can
+  be (real total); with `query` or `roles` it filters the page and `total`
+  is `null`.
+- `pica_notifications_list` counted every notification as unread (it read
+  a `read_at` field the service never sends) and called a per-source-capped
+  list length a total.
+- `pica_works_inspect`'s agreements section showed the org's first page of
+  agreements, not the work's.
+- `pica_release_show` looked the label up by searching one page; it now
+  asks for the id.
+- `pica_enrichment_proposals_bulk_reject`'s dry run previewed a different
+  set (the list route) from the one the real run rejects; both now use one
+  resolver, and the preview says when the real call would exceed its cap.
+- Every tool `limit` declares its `maximum` (52 schemas), guarded by a test.
+
+## [2.102.0] - 2026-10-07
+
+### Added
+
+- **`pica_profile_claims_status` reports `linked`.** A person already linked
+  to a PICA account now reads `linked` (nothing to invite) instead of
+  `not_invited`, and `state: "linked"` filters to them.
+  `pica_profile_claims_invite` skips people already linked to an account and
+  the caller themself, and its preview says so.
+
+### Changed
+
+- **`works://list`, `people://list` and `recordings://list` say how big the
+  catalogue really is.** Each returns the first page (100 works, 500 people,
+  100 recordings) with the true `total` from SQL counts, plus `returned`,
+  `has_more` and, when there is more, a note pointing at the matching
+  `_query` tool. `total` used to be the length of the page, so a catalogue of
+  2,239 works was reported as 100. The resource names drop "All".
+- **`catalog://stats` counts the whole catalogue.** Every figure now comes
+  from the same counts as `pica_catalog_stats`, not from list pages that were
+  capped at 100 or 500 rows. `works.by_type` lists the work types the
+  catalogue actually holds; its old fixed keys (composition, arrangement,
+  adaptation, translation) read 0 for every catalogue.
+- **`pro_member_number` on `pica_people_create` / `pica_people_update` says
+  what it is:** the person's account number at their own society, not their
+  IPI.
+
+### Fixed
+
+- **The import template and catalogue counts work on a protected preview.**
+  Requires `@withpica/mcp-sdk` 3.23.1, which routes both calls through the
+  shared request path and refuses an HTML page returned in place of a file.
+
 ## [2.101.0] - 2026-10-06
 
 ### Added

package/README.md

@@ -65,11 +65,11 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ## Tools
 
-349 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
+354 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
 
 **works** — manage your musical works
 
-`pica_works_query`, `pica_works_inspect`, `pica_works_create`, `pica_register_set`, `pica_works_update`, `pica_works_delete`, `pica_works_bulk_delete`, `pica_works_bulk_update`, `pica_works_bulk_link_artist`, `pica_works_bulk_add_collaborator`, `pica_work_writers_add`, `pica_works_bulk_copy_credits`, `pica_works_bulk_move_to_performances`, `pica_works_verify`, `pica_works_verify_registrations`, `pica_works_attest`, `pica_catalog_diligence`
+`pica_works_query`, `pica_works_inspect`, `pica_works_create`, `pica_register_set`, `pica_works_update`, `pica_works_delete`, `pica_works_bulk_delete`, `pica_works_bulk_update`, `pica_works_bulk_link_artist`, `pica_works_bulk_add_collaborator`, `pica_work_writers_add`, `pica_topics_untagged`, `pica_topics_inspect`, `pica_topics_propose`, `pica_topics_review`, `pica_works_bulk_copy_credits`, `pica_works_bulk_move_to_performances`, `pica_works_verify`, `pica_works_verify_registrations`, `pica_works_attest`, `pica_catalog_diligence`
 
 **people** — manage people in your catalog
 
@@ -265,7 +265,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 **sync placements** — manage sync placements (films/TV/ads/games licensing your works) — placement records, evidence, verification state
 
-`pica_sync_placements_query`, `pica_sync_placements_inspect`, `pica_sync_placements_create`, `pica_sync_placements_update`, `pica_sync_placements_delete`, `pica_sync_placements_cite`
+`pica_sync_placements_query`, `pica_sync_placements_inspect`, `pica_sync_placements_create`, `pica_sync_placements_update`, `pica_sync_placements_delete`, `pica_sync_placements_cite`, `pica_sync_fit_query`
 
 **notifications** — list and schedule notifications to users and people
 
@@ -293,4 +293,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ---
 
-Generated for `@withpica/mcp-server@2.101.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
+Generated for `@withpica/mcp-server@2.103.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.