e92365b86e
* feat(mcp): distribution polish for agent-first onboarding: CIMD, plugin start skill, bridge hint Fourth PR of agent-first onboarding (#1814). - The OAuth AS metadata advertises client_id_metadata_document_supported next to the existing `none` token auth, the pair Claude.ai, Claude Code and Codex look for to use CIMD instead of registering a DCR client per connection. authorize/token never keyed on client_id (the redirect-URI allowlist is the trust boundary), so nothing else changes; DCR stays for ChatGPT. - The plugin's start skill no longer sends a user without an account to the website: the /mcp OAuth screen creates the account, and a NO_COMPANY_YET briefing failure routes to the onboarding skill and accounted_create_company. README updated to match. - `npx accounted-mcp` without ACCOUNTED_API_KEY prints the OAuth alternative (Claude Code, Codex, Claude.ai connector) and that the account can be created on the sign-in screen; package README too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(oauth): do not advertise CIMD until redirect URIs are matched against the client document CodeRabbit on #1866: advertising client_id_metadata_document_supported makes Claude and Codex send URL client_ids and expects an exact redirect_uri match against that document; the authorize endpoint only checks the global allowlist and never fetches client metadata. The flag is withheld until an SSRF-safe, cached CIMD fetch with exact redirect matching exists. DCR stays the registration path (stateless, so free). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
31 lines
2.7 KiB
Markdown
31 lines
2.7 KiB
Markdown
---
|
|
name: start
|
|
description: Connect and orient in the user's Accounted bookkeeping. Use on first contact with Accounted in a session, when the user says "kom igang", "get started", "connect my bookkeeping", "vad behover jag gora", or asks what this plugin can do.
|
|
---
|
|
|
|
# Start
|
|
|
|
Verify the connection, learn who this company is, and surface what needs attention. Run this before any other Accounted flow in a session.
|
|
|
|
## Flow
|
|
|
|
1. Call `accounted_get_agent_briefing`. This is the single source for company facts: entity type (aktiebolag or enskild firma), accounting method (faktureringsmetoden or kontantmetoden), VAT period, employees, and ledger context. Never assume these; the flows below behave differently depending on them.
|
|
- If the call fails with an auth error, the MCP server is not connected yet: tell the user to run `/mcp` and authenticate with Accounted (OAuth consent screen; read-only scopes by default, write scopes are ticked explicitly). A user who has no Accounted account creates it on that same screen (BankID or e-mail, about a minute); nobody needs to visit the website first. Self-hosted users: see the plugin README.
|
|
- If the call fails with `NO_COMPANY_YET`, the account exists but has no company: this is a brand-new user. Load `accounted_load_skill("onboarding")` and follow it. It gathers the facts (company form, organisationsnummer, VAT and moms period, accounting method, fiscal year), previews and creates the company with `accounted_create_company`, then hands out the bank and Skatteverket connect links. Do not attempt any other flow until the company exists.
|
|
2. Read `Accounted://attention` and `Accounted://period/active`.
|
|
3. Present a short orientation in the user's language: company name and form, active fiscal period and its lock status, and the top 3 items needing attention.
|
|
4. Point at the flows, matched to what attention showed:
|
|
- `/accounted:bookkeep` - clear unbooked transactions and receipts (daily)
|
|
- `/accounted:check` - read-only health check of the books
|
|
- `/accounted:month-close` - close the month
|
|
- `/accounted:vat` - prepare the momsdeklaration
|
|
- `/accounted:payroll` - monthly salary run and AGI
|
|
- `/accounted:year-end` - bokslut
|
|
5. Mention that deeper, company-tailored guides exist on the server: `accounted_list_skills` lists them (workflow guides plus Swedish regulatory skills, filtered to this company), and `accounted_load_skill(slug)` loads any of them.
|
|
|
|
## Rules
|
|
|
|
- Ground every statement in the briefing and resources; never guess company facts.
|
|
- Swedish accounting or tax questions are answered from loaded skills, never from memory.
|
|
- Every write in Accounted stages a pending operation for the user to approve. Nothing is ever booked without explicit approval.
|