@withpica/mcp-server 2.104.0 → 2.106.0

package/CHANGELOG.md

@@ -11,6 +11,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.106.0] - 2026-10-15
+
+### Changed
+
+- `pica_share_send`: `RECIPIENT_VOLUME_EXCEEDED` now means the person has been sent 20 shares through
+  withPICA in the last 30 days, counted on shares only. Shares no longer count toward, or are
+  blocked by, PICA's marketing email limit (a share isn't marketing). The per-sender limit of 20
+  external shares a day is unchanged.
+- No write tool is wrapped in the billing gate any more. A hibernated
+  organisation's assistant writes run (founder ruling 2026-10-14, ADR-335;
+  the gate never enforced in production). Needs the matching
+  `@withpica/mcp-utils` major.
+- `pica_subscription_status` with `catalogue` answers whether that client's catalogue is paid
+  for and by which side (`covered_by`: `client`, `relationship` or `null`), in its own summary,
+  instead of the own-catalogue card's wording ("You're a resident").
+
+## [2.105.0] - 2026-10-15
+
+### Added
+
+- `pica_physical_assets_market_check` — an AI market price estimate for a physical
+  asset, from the organisation's own AI provider. A write (`write:catalog`), so a
+  client confirms before it runs.
+- A tool definition can declare `alsoRequires`: scopes a credential must hold as
+  well as `scope`. `pica_tool_details` reports them as `also_requires`.
+
+### Fixed
+
+- `pica_export_snapshot`, `pica_export_song_dossiers` and
+  `pica_export_catalog_asset_report` declare both scopes their routes need
+  (`write:catalog` and `write:files`). Each declared one, so a credential
+  holding only what the tool advertised was refused 403 underneath.
+- `pica_run_person_cascade` and `pica_split_sheet_send` also require
+  `write:people`, which their routes already needed.
+- `pica_share_links_create`, `_update`, `_delete` and `pica_upload` require
+  `write:files` (a share or an upload is a file operation), as their routes now do.
+- `pica_audio_assign`, `_bulk_assign_suggested`, `_dismiss_match`, `_update` and
+  `_bulk_update` require `write:catalog`: they attach or edit audio against the
+  catalogue, and their routes are floored there. Upload, analyse and identify
+  stay `write:files`, and their routes' floor is now `write:files` too.
+- `pica_notification_acknowledge` requires `write:catalog`: it acknowledges
+  catalogue discoveries, which is what its route requires.
+- `pica_physical_assets_query`, `pica_physical_assets_inspect`,
+  `pica_audio_pipeline_status`, `pica_count_explain`, `pica_notifications_list`
+  and `pica_send_query` require `read:catalog`, which their routes require.
+- `pica_notifications_recent` requires `read:catalog`; its route, and
+  `pica_discoveries_query`'s, no longer require `write:catalog` for a read.
+- `pica_physical_assets_inspect` no longer has a `market` section: a read never
+  calls an AI provider. Use `pica_physical_assets_market_check`.
+- `pica_import_analyze` is a write tool (`write:catalog`): it spends PICA's
+  paid AI model on the file, so a client asks before running it.
+
+- The seven physical-asset write tools (`pica_physical_assets_create`,
+  `_update`, `_delete`, `_link_work`, `_link_recording`, `_unlink_work`,
+  `_unlink_recording`) declare `write:catalog`, the scope their routes and the
+  REST write floor require. They declared `write:files`, so a credential holding
+  exactly that passed MCP dispatch and was refused 403 underneath.
+
 ## [2.104.0] - 2026-10-14
 
 ### Added
@@ -52,6 +110,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- `pica_export_snapshot` says it is for an owner or admin of the catalogue only;
+  its route now refuses anyone else.
+
 - `pica_find_duplicates`: recording and release groups no longer include a pair the owner marked
   different, and their "keep them separate" option now says how to stop them coming back
   (it used to say they would keep appearing). A group never holds a marked pair, even through a

package/README.md

@@ -65,7 +65,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ## Tools
 
-367 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
+368 tools, grouped below by the taxonomy `pica_discover` uses. The server's own `tools/list` is authoritative — not every registered tool is filed under a category yet, so the names below are a map, not a census.
 
 **works** — manage your musical works
 
@@ -225,7 +225,7 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 **physical assets** — manage physical assets (master tapes, hardware, artefacts)
 
-`pica_physical_assets_query`, `pica_physical_assets_inspect`, `pica_physical_assets_create`, `pica_physical_assets_update`, `pica_physical_assets_delete`, `pica_physical_assets_export`, `pica_physical_assets_stats`, `pica_physical_assets_link_work`, `pica_physical_assets_link_recording`, `pica_physical_assets_unlink_work`, `pica_physical_assets_unlink_recording`
+`pica_physical_assets_query`, `pica_physical_assets_inspect`, `pica_physical_assets_create`, `pica_physical_assets_update`, `pica_physical_assets_market_check`, `pica_physical_assets_delete`, `pica_physical_assets_export`, `pica_physical_assets_stats`, `pica_physical_assets_link_work`, `pica_physical_assets_link_recording`, `pica_physical_assets_unlink_work`, `pica_physical_assets_unlink_recording`
 
 **portfolio** — who looks after a catalogue — see and answer requests, invite an organisation or a client by email, end access, see what was done through a relationship, (for organisations) the client catalogues you look after with what needs doing, and preparing a catalogue for a client to take over
 
@@ -297,4 +297,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
 
 ---
 
-Generated for `@withpica/mcp-server@2.104.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
+Generated for `@withpica/mcp-server@2.106.0`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.