* ci: publish accounted-mcp and gnubok-mcp to npm when their version changes accounted-mcp has never been published (npm view is E404) although every "connect Claude" doc says `npx -y accounted-mcp`, and gnubok-mcp is at 1.0.1 on the registry while the repo has carried 1.1.0 since #706. No workflow published to npm; this adds one. .github/workflows/npm-publish.yml runs on a push to main that touches a packages/*/package.json, and on workflow_dispatch (package: all or one, plus a dry_run that packs and validates without touching the registry). One matrix job per package: it fails first with a message naming the NPM_TOKEN secret if it is absent, then compares the package.json version with `npm view <name> versions` (E404 counts as "never published", any other failure is an error), skips when the version is already on the registry, and otherwise runs `npm publish --provenance --access public`. Permissions are contents: read plus id-token: write for the provenance attestation. Actions are pinned to the same SHAs as the sibling workflows. npm rejects a provenance attestation whose package.json repository.url does not match the source repository, and gnubok-mcp still pointed at erp-mafia/gnubok, so both repository fields now name erp-mafia/accounted in npm's canonical form with the monorepo directory. `npm pkg fix` normalised the bin paths, and accounted-mcp's index.mjs gets the executable bit gnubok-mcp's already had. Versions are not bumped. Both READMEs get a Releasing section: bump version, merge to main, the workflow publishes; the NPM_TOKEN repository secret must exist. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> * fix(packages): keep the ./index.mjs bin form the package tests pin Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(npm-publish): scope NPM_TOKEN to the publish step and keep the matrix static The token was job-level env, visible to checkout, setup-node and the version gate; it now reaches only npm publish. The matrix no longer interpolates the workflow_dispatch input into an expression: both packages always get a job and a Select step skips the one not requested. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
accounted-mcp
Connect Claude Desktop, Claude Code, or another stdio MCP client to your Accounted bookkeeping account.
This zero-dependency bridge forwards JSON-RPC over stdio to the hosted Accounted
MCP server. New connections receive the accounted_* tool namespace. Existing
gnubok-mcp configurations remain supported separately.
Setup
- Create an API key in Accounted under Settings > API.
- Add the bridge to your MCP client:
{
"mcpServers": {
"accounted": {
"command": "npx",
"args": ["-y", "accounted-mcp"],
"env": {
"ACCOUNTED_API_KEY": "gnubok_sk_test_...",
"ACCOUNTED_CLIENT": "claude-desktop"
}
}
}
}
The credential value retains the legacy gnubok_sk_* wire prefix for backward
compatibility. Only the MCP integration is being renamed in this release.
Environment variables
| Variable | Required | Default | Description |
|---|---|---|---|
ACCOUNTED_API_KEY |
yes | none | Your existing Accounted API key. |
ACCOUNTED_URL |
no | Accounted hosted MCP endpoint | Override for self-hosted Accounted. The bridge adds tool_namespace=accounted when omitted. |
ACCOUNTED_CLIENT |
no | none | Telemetry-only distribution marker such as claude-desktop. |
The API key scopes determine which tools are visible and callable. Write tools stage pending operations for explicit approval before anything is booked.
OAuth connector (no API key, no account needed up front)
Clients with OAuth support connect directly without this bridge and without an
existing API key. The sign-in screen lets a new user create the Accounted
account (BankID or e-mail), and company setup then continues in the
conversation through the onboarding skill and accounted_create_company:
https://app.accounted.se/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted
# Claude Code
claude mcp add --transport http accounted \
"https://app.accounted.se/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted"
# OpenAI Codex
codex mcp add accounted --url \
"https://app.accounted.se/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted"
Claude.ai and Claude Desktop: Settings > Connectors > Add custom connector, paste the URL, then in step 2 choose:
- Authentication: "Required when the server asks." Claude auto-detects "None" because the server answers the handshake without credentials; with "None" the first company-scoped call shows an error instead of the sign-in.
- OAuth client: "No client ID, register one automatically" (DCR). The server does not advertise Anthropic's hosted client metadata (CIMD) yet.
- No additional headers; transport stays Streamable HTTP.
The connector works before you connect (documentation tools); the first company-scoped call opens the sign-in prompt, where a new user creates the account.
Compatibility
The legacy gnubok-mcp package, environment variables, endpoint behavior, and
gnubok_* tool aliases remain supported. Existing installations do not need to
change.
Releasing
The package is published to npm by the Publish MCP bridges to npm workflow
(.github/workflows/npm-publish.yml), never by hand:
- Bump
versioninpackages/accounted-mcp/package.json. - Merge the change to
main. - The workflow compares the new version with the registry and, if it is not
there yet, runs
npm publish --provenance --access public. A version that already exists on npm is skipped, so otherpackage.jsonedits are harmless.
The workflow needs the repository secret NPM_TOKEN: an npm granular access
token with read and write access to accounted-mcp and gnubok-mcp, with
two-factor bypass enabled so CI can publish. npm caps the lifetime of such
tokens (90 days at the time of writing), so rotate the secret before it lapses.
Without the secret the run fails at its first step. The workflow can also be
started from the Actions tab, for one package or both, with a dry-run option
that packs and validates without publishing.