@withpica/mcp-server 2.102.0 → 2.104.0

package/CHANGELOG.md

@@ -11,6 +11,120 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.104.0] - 2026-10-14
+
+### Added
+
+- Three tools for preparing a catalogue for a client who will own it:
+  `pica_handover_create` (an organisation creates the catalogue; nothing is sent),
+  `pica_handover_send` (emails the client, who has 60 days to accept; from a connected app the
+  person approves it first) and `pica_handover_answer` (gives the client the link to accept on
+  screen; it never accepts or declines, because taking ownership is the person's own act).
+- Tools that read or change a catalogue's records take an optional `catalogue` argument: the id of
+  a client catalogue your organisation looks after. The call then acts for that client, within what
+  the relationship allows, and the app refuses anything outside it with the reason. A tool that
+  can't act for a client (account, keys, billing, feedback, and the relationship tools themselves)
+  refuses the argument rather than ignoring it, and a confirmation token issued for one client
+  can't be used for another.
+- Nine tools for who looks after whose catalogue:
+  - for a catalogue's owner: `pica_relationships_list` (who looks after it, what each may do, and
+    invitations waiting), `pica_relationships_answer` (accept, decline or change a request, or
+    accept an invitation), `pica_relationships_grant` (invite an organisation by email),
+    `pica_relationships_revoke` and `pica_relationships_activity` (what was done through a
+    relationship);
+  - for an organisation: `pica_portfolio_list` (the client catalogues it looks after, with each
+    one's id for `catalogue`), `pica_portfolio_briefing` (what needs doing across them),
+    `pica_portfolio_invite` (ask a client by email) and `pica_relationships_step_down`.
+    Accepting, changing, revoking and an owner's invitation are the person's own decision: from a
+    connected app they ask the person to approve first, and from PICA's own assistant they give the
+    link to do it on screen. Every step sends the version of the terms that was read; if the terms
+    changed since, nothing happens and the current terms come back. A check PICA couldn't make says
+    so, never 0. New resource: `pica://schemas/relationship-required`.
+- Two skills: `look-after-clients` (an organisation sees every client, finds what needs doing and
+  fixes it in the right client's catalogue, within what each allowed) and
+  `who-can-see-my-catalogue` (an owner sees who looks after their catalogue, what each can do and
+  has done, and answers, changes or ends it). `first-session` routes to them, and the server
+  instructions say how to act for a client catalogue.
+- `pica_duplicates_mark_different` — when the user says recordings or releases that
+  `pica_find_duplicates` grouped are not the same, `action: "mark"` records it for every pair
+  among 2–25 ids and they are not offered as duplicates again; `action: "unmark"` takes it back.
+  Nothing is merged, deleted or edited. Works are still dismissed in the catalog duplicates view.
+
+### Changed
+
+- `pica_find_duplicates`: recording and release groups no longer include a pair the owner marked
+  different, and their "keep them separate" option now says how to stop them coming back
+  (it used to say they would keep appearing). A group never holds a marked pair, even through a
+  third copy matching both.
+
+## [2.103.0] - 2026-10-09
+
+### Security
+
+- `@modelcontextprotocol/sdk` moves to 1.31.0 (GHSA-6qxp-vccf-f47h, high: the SDK's
+  OAuth client could send credentials to an authorization server the MCP server chose).
+
+### Fixed
+
+- Tool titles: a title a tool declares is now advertised (it was discarded), so `pica_discover`, `pica_tool_details` and `pica_execute` show words instead of their names in connector tool lists. `pica_sign_in` and `pica_sign_out` gain titles. Eight catalog tools declared a title that differed from their display name; the declarations are removed so their advertised titles are unchanged. A test fails any tool without a title, or with a declared title that disagrees with its display name.
+
+### Changed
+
+- **Measured audio facts are labelled.** `pica_audio_inspect` (analysis
+  section) and `pica_recordings_inspect` (audio section) carry a `measured`
+  block — `tempo_bpm`, `key`, `mode`, `energy`, `energy_method`,
+  `loudness_lufs`, `duration_seconds`, `analysis_version` — with a
+  `measured_basis` line. Energy is now measured from integrated loudness;
+  files analysed before that say `energy_method: "legacy_rms_capped"`.
+- `pica_audio_analyze` no longer promises valence or mood: the analyser
+  measures neither, and both come back null.
+- `pica_audio_inspect` no longer returns `detected_valence`, which read a
+  field the API never sent and was always absent.
+
+### Added
+
+- **`pica_sync_fit_query`: which songs fit film and TV productions in
+  progress.** The same list as the sync page's "fit" section, per song
+  (`work_id`), per production (`screen_project_id`), or the whole catalogue
+  spread so each song's best three pairs come before any song's fourth.
+  Pages with `limit` (≤ 100) and `offset` and says how many pairs there are
+  in all. Each production carries its genres, themes, countries, language,
+  release date, stage, companies and networks; with `song_facts: true` each
+  row also carries the song's genres, lyric language and a `measured` entry
+  per analysed master (tempo_bpm, key, mode, duration_seconds: the same names
+  as the other tools' measured blocks), so the user's AI can judge the fit
+  itself. Read-only:
+  the description tells the AI its judgement belongs in its answer and is
+  never written back to PICA.
+- **Directory topics from the owner** (`pica_topics_untagged`, `pica_topics_inspect`,
+  `pica_topics_propose`, `pica_topics_review`) and the `tag-my-songs` skill. The owner's
+  assistant reads the owner's lyrics and audio facts and proposes up to five topics from a
+  fixed list (and moods per recording); the owner approves before anything is public. PICA
+  runs no AI on lyrics.
+
+### Fixed — honest totals (row-cap T3)
+
+- List tools report the REAL total and an honest `has_more` instead of the
+  page length: people, agreements, recordings (whose unfiltered list also
+  re-served page one), bookings, licence enquiries, party claims, releases,
+  sessions, collaborator invites, custody. Publishers and labels report
+  `total: null` (platform-wide rows are not counted) with an honest
+  `has_more`, and take `offset`.
+- `pica_people_query`: a single `role` is filtered server-side when it can
+  be (real total); with `query` or `roles` it filters the page and `total`
+  is `null`.
+- `pica_notifications_list` counted every notification as unread (it read
+  a `read_at` field the service never sends) and called a per-source-capped
+  list length a total.
+- `pica_works_inspect`'s agreements section showed the org's first page of
+  agreements, not the work's.
+- `pica_release_show` looked the label up by searching one page; it now
+  asks for the id.
+- `pica_enrichment_proposals_bulk_reject`'s dry run previewed a different
+  set (the list route) from the one the real run rejects; both now use one
+  resolver, and the preview says when the real call would exceed its cap.
+- Every tool `limit` declares its `maximum` (52 schemas), guarded by a test.
+
 ## [2.102.0] - 2026-10-07
 
 ### Added

package/README.md

@@ -65,11 +65,11 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ## Tools
 
-349 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
+367 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
 
 **works** — manage your musical works
 
-`pica_works_query`, `pica_works_inspect`, `pica_works_create`, `pica_register_set`, `pica_works_update`, `pica_works_delete`, `pica_works_bulk_delete`, `pica_works_bulk_update`, `pica_works_bulk_link_artist`, `pica_works_bulk_add_collaborator`, `pica_work_writers_add`, `pica_works_bulk_copy_credits`, `pica_works_bulk_move_to_performances`, `pica_works_verify`, `pica_works_verify_registrations`, `pica_works_attest`, `pica_catalog_diligence`
+`pica_works_query`, `pica_works_inspect`, `pica_works_create`, `pica_register_set`, `pica_works_update`, `pica_works_delete`, `pica_works_bulk_delete`, `pica_works_bulk_update`, `pica_works_bulk_link_artist`, `pica_works_bulk_add_collaborator`, `pica_work_writers_add`, `pica_topics_untagged`, `pica_topics_inspect`, `pica_topics_propose`, `pica_topics_review`, `pica_works_bulk_copy_credits`, `pica_works_bulk_move_to_performances`, `pica_works_verify`, `pica_works_verify_registrations`, `pica_works_attest`, `pica_catalog_diligence`
 
 **people** — manage people in your catalog
 
@@ -119,9 +119,9 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 `pica_notes_query`, `pica_notes_inspect`, `pica_notes_create`, `pica_notes_delete`
 
-**duplicates** — detect duplicate records and merge them (audio_files can be found but not merged — a duplicate file is deleted)
+**duplicates** — detect duplicate records and merge them, or mark recordings and releases as different so they stop being offered (audio_files can be found but not merged — a duplicate file is deleted)
 
-`pica_find_duplicates`, `pica_merge_duplicates`
+`pica_find_duplicates`, `pica_merge_duplicates`, `pica_duplicates_mark_different`
 
 **import** — import catalog data from files and streaming services, and see what happened to emails forwarded to PICA
 
@@ -227,6 +227,10 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 `pica_physical_assets_query`, `pica_physical_assets_inspect`, `pica_physical_assets_create`, `pica_physical_assets_update`, `pica_physical_assets_delete`, `pica_physical_assets_export`, `pica_physical_assets_stats`, `pica_physical_assets_link_work`, `pica_physical_assets_link_recording`, `pica_physical_assets_unlink_work`, `pica_physical_assets_unlink_recording`
 
+**portfolio** — who looks after a catalogue — see and answer requests, invite an organisation or a client by email, end access, see what was done through a relationship, (for organisations) the client catalogues you look after with what needs doing, and preparing a catalogue for a client to take over
+
+`pica_relationships_list`, `pica_relationships_answer`, `pica_relationships_grant`, `pica_relationships_revoke`, `pica_relationships_activity`, `pica_relationships_step_down`, `pica_portfolio_list`, `pica_portfolio_briefing`, `pica_portfolio_invite`, `pica_handover_create`, `pica_handover_send`, `pica_handover_answer`
+
 **recording splits** — manage recording (master) splits between contributors
 
 `pica_recording_splits_list`, `pica_recording_splits_create`, `pica_recording_splits_update`, `pica_recording_splits_end`, `pica_recording_splits_verify`, `pica_split_sheet_generate`, `pica_recording_credits_update`
@@ -265,7 +269,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 **sync placements** — manage sync placements (films/TV/ads/games licensing your works) — placement records, evidence, verification state
 
-`pica_sync_placements_query`, `pica_sync_placements_inspect`, `pica_sync_placements_create`, `pica_sync_placements_update`, `pica_sync_placements_delete`, `pica_sync_placements_cite`
+`pica_sync_placements_query`, `pica_sync_placements_inspect`, `pica_sync_placements_create`, `pica_sync_placements_update`, `pica_sync_placements_delete`, `pica_sync_placements_cite`, `pica_sync_fit_query`
 
 **notifications** — list and schedule notifications to users and people
 
@@ -293,4 +297,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ---
 
-Generated for `@withpica/mcp-server@2.102.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
+Generated for `@withpica/mcp-server@2.104.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.