fix: bump the oilpriceapi-mcp pin from 3.0.0 to 3.3.0

GEMINI.md

@@ -1,7 +1,7 @@
 # OilPriceAPI Grounding Instructions
 
 This extension connects the current Gemini CLI session to the read-only
-`oilpriceapi-mcp@3.0.0` tool inventory. In Gemini CLI, the tools appear with the
+`oilpriceapi-mcp@3.3.0` tool inventory. In Gemini CLI, the tools appear with the
 `mcp_oilpriceapi_` prefix.
 
 ## Ground Product Answers

README.md

@@ -46,14 +46,14 @@ Show an energy market snapshot and identify unavailable fields.
 What does OilPriceAPI say about refresh cadence and data rights?
 ```
 
-The extension pins `oilpriceapi-mcp@3.0.0`, starts it with `--scope read`, and
+The extension pins `oilpriceapi-mcp@3.3.0`, starts it with `--scope read`, and
 sets a 15-second Gemini MCP request timeout. The default inventory exposes 25
 read tools and no create/delete tools. Inspect the exact executable inventory:
 
 ```bash
-npx -y oilpriceapi-mcp@3.0.0 --list-tools --json
-npx -y oilpriceapi-mcp@3.0.0 --capabilities --json
-npx -y oilpriceapi-mcp@3.0.0 doctor --demo
+npx -y oilpriceapi-mcp@3.3.0 --list-tools --json
+npx -y oilpriceapi-mcp@3.3.0 --capabilities --json
+npx -y oilpriceapi-mcp@3.3.0 doctor --demo
 ```
 
 Common tools include:

gemini-extension.json

@@ -16,7 +16,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "oilpriceapi-mcp@3.0.0",
+        "oilpriceapi-mcp@3.3.0",
         "--scope",
         "read",
         "--profile",

package.json

@@ -15,6 +15,6 @@
   "devDependencies": {
     "@google/gemini-cli": "0.49.0",
     "@modelcontextprotocol/sdk": "1.29.0",
-    "oilpriceapi-mcp": "3.0.0"
+    "oilpriceapi-mcp": "3.3.0"
   }
 }

tests/manifest.test.mjs

@@ -23,7 +23,7 @@ test("manifest pins a bounded read-only MCP runtime", () => {
   assert.equal(server.command, "npx");
   assert.deepEqual(server.args, [
     "-y",
-    "oilpriceapi-mcp@3.0.0",
+    "oilpriceapi-mcp@3.3.0",
     "--scope",
     "read",
     "--profile",

tests/protocol.test.mjs

@@ -171,7 +171,18 @@ async function withClient(apiKey, callback) {
 test("Gemini manifest launches the exact read-only tool inventory", async () => {
   await withClient("", async (client) => {
     const listed = await client.listTools();
-    assert.equal(listed.tools.length, 25);
+    // 25 -> 32 on the oilpriceapi-mcp 3.0.0 -> 3.3.0 pin bump.
+    //
+    // The count is a change-detector, not the safety property: it exists so a
+    // new tool cannot appear in the Gemini surface without someone looking at
+    // it. All 32 were reviewed on 2026-09-13 and every one is a read verb
+    // (get / list / compare / search / lookup / market_overview). The two
+    // assertions below are the actual guards and both still hold: every tool
+    // carries readOnlyHint, and no write tool is exposed.
+    //
+    // If this number changes again, list the tools and check them before
+    // editing it.
+    assert.equal(listed.tools.length, 32);
     assert.ok(listed.tools.some((tool) => tool.name === "opa_get_product_facts"));
     assert.ok(listed.tools.some((tool) => tool.name === "opa_get_price"));
     assert.ok(