@withpica/mcp-server 2.97.3 → 2.97.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -11,6 +11,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
11
11
 
12
12
  ## [Unreleased]
13
13
 
14
+ ## [2.97.4] - 2026-09-17
15
+
16
+ ### Fixed
17
+
18
+ - **Both CAR tools now declare the scope the platform actually requires.**
19
+ `pica_export_catalog_asset_report` asked for `write:catalog` and
20
+ `pica_car_preview` for `read:catalog`, but every write under
21
+ `/api/admin/exports/*` is floored at `write:files` in proxy.ts, so a
22
+ credential holding exactly what the tools advertised was refused 403
23
+ before the route ran (measured against the develop preview, 2026-09-17).
24
+ `pica_car_preview` is also `tier: "write"` now: it creates an S3 object and
25
+ a `pica_exports` row, and was advertised read-only.
26
+ Credentials that need a catalog asset report must carry `write:files`.
27
+
14
28
  ## [2.97.3] - 2026-09-17
15
29
 
16
30
  ### Fixed
package/README.md CHANGED
@@ -289,4 +289,4 @@ Read tools are annotated read-only and are safe to call freely. Write tools repo
289
289
 
290
290
  ---
291
291
 
292
- Generated for `@withpica/mcp-server@2.97.2`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.
292
+ Generated for `@withpica/mcp-server@2.97.4`. © 2024-2026 Withpica Ltd. All rights reserved. MIT licensed.