* feat(mcp): distribution polish for agent-first onboarding: CIMD, plugin start skill, bridge hint
Fourth PR of agent-first onboarding (#1814).
- The OAuth AS metadata advertises client_id_metadata_document_supported
next to the existing `none` token auth, the pair Claude.ai, Claude Code
and Codex look for to use CIMD instead of registering a DCR client per
connection. authorize/token never keyed on client_id (the redirect-URI
allowlist is the trust boundary), so nothing else changes; DCR stays
for ChatGPT.
- The plugin's start skill no longer sends a user without an account to
the website: the /mcp OAuth screen creates the account, and a
NO_COMPANY_YET briefing failure routes to the onboarding skill and
accounted_create_company. README updated to match.
- `npx accounted-mcp` without ACCOUNTED_API_KEY prints the OAuth
alternative (Claude Code, Codex, Claude.ai connector) and that the
account can be created on the sign-in screen; package README too.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6
* fix(oauth): do not advertise CIMD until redirect URIs are matched against the client document
CodeRabbit on #1866: advertising client_id_metadata_document_supported
makes Claude and Codex send URL client_ids and expects an exact
redirect_uri match against that document; the authorize endpoint only
checks the global allowlist and never fetches client metadata. The flag
is withheld until an SSRF-safe, cached CIMD fetch with exact redirect
matching exists. DCR stays the registration path (stateless, so free).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
