Files

T

Jakob WennbergandClaude Opus 4.8 db843a7a5b fix(entitlements): gate paid MCP tools (send_invoice/agi_submit/vat_declaration_submit) server-side (#846 )

The HTTP routes call requireCapability at every paid chokepoint, but the
MCP/agent path bypassed the paywall entirely: the three external-service
tools stage operations whose commit calls the email / Skatteverket services
directly, with no capability check. After the 2026-07-07 trial cutover a
trial-connected non-payer using the gnubok MCP connector could still send
invoice emails and file AGI/VAT.

Close the gap with two layers, mirroring the existing TOOL_SCOPE_MAP gate:

- Dispatch gate (mcp-server/server.ts): MCP_TOOL_CAPABILITY_MAP, checked
  right after the scope check, blocks a non-entitled company before any
  pending op is staged. Emits errorKind='capability_denied' telemetry.
- Commit-time gate (commitPendingOperation): PAID_OPERATION_CAPABILITY_MAP,
  checked before the atomic claim. The real external-service chokepoint —
  applies to the MCP approve tool AND the UI approval path, and closes the
  trial-connected-token window (the grant has expired by commit time). A
  blocked op stays 'pending', so it is re-approvable once the company subscribes.

Adds a transport-free capabilityBlockedError() helper (shared bilingual
copy) and locks both maps with tests (maps, dispatch gate, commit gate).
Only the three write/submit tools are gated; SKV read/local tools stay free
per the statutory carve-out. No DB/migration change; self-hosted stays all-on.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-30 16:38:14 +02:00

__tests__

fix(entitlements): gate paid MCP tools (send_invoice/agi_submit/vat_declaration_submit) server-side (#846 )

2026-06-30 16:38:14 +02:00

prompts

Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643 )

2026-06-03 10:52:01 +02:00

resources

Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643 )

2026-06-03 10:52:01 +02:00

skills

feat(mcp): self-describing agent surface — staging _meta, company identity, clean skill summaries (#775 )

2026-06-25 13:42:12 +02:00

widgets

Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643 )

2026-06-03 10:52:01 +02:00

index.ts

fix(mcp): return 405 (not 401) on GET /mcp to stop client re-auth storm (#747 )

2026-06-17 14:26:13 +02:00

manifest.json

feat: MCP server, API keys, OAuth, and KPI dashboard (#72 )

2026-03-21 12:57:14 +01:00

origin-guard.ts

feat(mcp): Origin-header validation + serverInfo title + connect-claude docs export (P0-4 follow-up) (#684 )

2026-06-08 09:14:46 +02:00

README.md

feat(mcp): tool titles + Connect-with-Claude docs for Connectors Directory readiness (P0-4) (#682 )

2026-06-06 11:47:21 +02:00

server.ts

fix(entitlements): gate paid MCP tools (send_invoice/agi_submit/vat_declaration_submit) server-side (#846 )

2026-06-30 16:38:14 +02:00

tool-result.ts

Add/ai native supp (#385 )

2026-05-04 11:12:29 +02:00

README.md

Accounted MCP server

JSON-RPC 2.0 server exposing the Accounted bookkeeping engine to MCP clients (Claude Desktop, Claude Code, etc.). Endpoint: /api/extensions/ext/mcp-server/mcp. OAuth and stdio bridge live alongside the API surface — see app/api/mcp-oauth/ and packages/gnubok-mcp/.

Tool authoring contract

Enforced by tests in __tests__/ — these are not style preferences, they're guard rails.

additionalProperties: false on every inputSchema. Guarded by strict-schemas.test.ts. Forces clear rejections on hallucinated fields instead of silent ignores.
Descriptions ≤ 280 chars. Guarded by output-schema.test.ts. No Args: / Returns: / Examples: prose — those belong in JSON Schema. Use agent-native hints ("Use to…", "Call X first", "HIGH risk").
Staged-operation envelope for write tools — outputSchema: STAGED_OPERATION_SCHEMA (server.ts). Fields: staged, risk_level, actor, message, preview, period_status?, next?. The staged: true boolean is the explicit completion signal; agents must not infer completion from prose. Do NOT introduce a parallel { success, shouldContinue, output } envelope.
period_status threading — any tool that ties to a fiscal-period-bound date (categorize, mark paid, create voucher, correct/reverse entry, approve supplier invoice) passes dateForPeriodCheck to stagePendingOperation. Response then includes period_status: { period_id, status: open|locked|closed, lock_date } so widgets and agents disable writes without round-trips.
Scope mapping — every new tool needs an entry in lib/auth/api-keys.ts TOOL_SCOPE_MAP. Missing entries default to deny.
Tests for new write tools — add staging-gate coverage to __tests__/voucher-tools.test.ts (or a sibling) plus executor coverage to lib/pending-operations/__tests__/voucher-executors.test.ts if the tool stages a new operation_type.

Determinism / cache stability

Tool definitions (name, description, inputSchema, outputSchema, annotations) are declared as static object literals at module load — no timestamps, no UUIDs, no Date/Math.random in the definition layer. This makes the tools/list JSON payload byte-stable across requests, which lets agent-side prompt caches stay warm. Do not introduce per-request non-determinism into the definitions block. Anything time-bound or random belongs inside execute().

For internal Anthropic API usage (today only extensions/general/invoice-inbox/lib/extract-invoice-fields.ts): annotate stable prefixes with cache_control: { type: 'ephemeral' } and log usage.cache_read_input_tokens for hit-ratio observability. The 1h TTL from the agent-native API plan (item 10) requires the direct Anthropic API; Accounted's Bedrock path defaults to a shorter TTL.

Payload-size watchdog

payload-size.bench.test.ts enforces a tools/list JSON payload ceiling (currently 36,000 tokens — bumped from 32,000 when top-level Tool.title landed on all tools for Claude Connectors Directory readiness). If the test fires, the right answer is rarely "raise the ceiling" — instead, trim descriptions or leverage gnubok_search_tools (already deployed; tool definitions can defer to it for discovery rather than enumerating in tools/list).

Where things live

server.ts — the tools array + JSON-RPC dispatcher
tool-result.ts — withNext(), toToolError() response helpers
resources/ — read-only Accounted:// URIs (active company, period, recent activity, capabilities, attention items, voucher gaps, chart of accounts, VAT treatments)
widgets/ — inline HTML widgets (receipt-matcher, vat-review)
prompts/ — slash-command-style prompts
skills/ — domain-knowledge skill bodies served via gnubok_load_skill
__tests__/ — strictness guards + per-tool coverage