Jakob Wennberg
678acfe7ef
claude.ai's two-step "Add custom connector" dialog probes the server URL without credentials and pre-fills the Authentication choice from the answer. Our lazy-auth endpoint (issue #1814) answers 200 on an anonymous initialize, which the dialog reads as an authless server: it suggests "None", and a connector added with that default never opens the sign-in when the challenge arrives later. Per Anthropic's connector docs a 401 is the only answer it reads as OAuth ("Claude does not honor a WWW-Authenticate header on a 200 response"). - `auth=required` on the endpoint URL (extensions/general/mcp-server/ auth-mode.ts) turns lazy auth off for that URL: every tokenless request, initialize included, answers the 401 + WWW-Authenticate challenge. Callers with a token are unaffected; the bare URL keeps lazy auth for Claude Code, the plugin, Cursor and ChatGPT, and existing connector records are untouched. - The links we control carry the flag: Settings -> API & MCP (install link and copy block), the onboarding checklist, both docs pages and claude-plugin/CONNECTORS.md (plugin 1.2.3). The docs' Path A now describes the eager flow (sign-in opens on Add) instead of telling users to override the dialog's "None". - Tests: eager-auth.test.ts (401 on initialize/tools/list/public tools, namespaced metadata pointer, token no-op, exact-flag only); checklist link shape updated. Companion: gnubok-website PR (Kom igång connector link + regenerated connect-claude / anslut-claude pages). Claude-Session: https://claude.ai/code/session_013yw62FMXGSzo6icFDiBwP3 Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
3.6 KiB
3.6 KiB
Connectors
This plugin bundles exactly one connector: the Accounted MCP server, the same server that backs the Accounted connector in Claude.ai and the accounted-mcp stdio bridge.
| Connector | Server | Auth | What it reaches |
|---|---|---|---|
| Accounted | https://app.accounted.se/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted |
OAuth 2.1 (PKCE). One-click consent: all scopes pre-selected (adjustable in a fold); every write still stages for explicit approval before it touches the ledger. | The user's own companies in Accounted: ledger, transactions, invoices, VAT, payroll, reconciliation, year-end. |
Share link and starter prompt
One-click add on claude.ai (opens the Add custom connector dialog prefilled; the params are connectorName/connectorUrl):
https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Accounted&connectorUrl=https%3A%2F%2Fapp.accounted.se%2Fapi%2Fextensions%2Fext%2Fmcp-server%2Fmcp%3Ftool_namespace%3Daccounted%26client%3Dclaude-connector%26auth%3Drequired
Pair the link with a starter prompt the user pastes as their first message. It stays copy-paste ready for everyone because it points the agent at what it already knows (Claude memory, earlier chats) instead of containing the user's own data; the server-side onboarding skill carries the rest of the flow:
Sätt upp mitt företag i Accounted och följ kopplingens onboarding-guide. Utgå från det du redan vet om mig och mitt bolag och fråga bara efter det som saknas. Håll det kort.
How the connection works
- Lazy authentication. The server answers
initialize,tools/listand the documentation tools (accounted_search_tools,accounted_list_skills,accounted_load_skill) without any credentials. The first company-scoped call returns an authentication challenge, which Claude Code surfaces as/mcp→ authenticate and Claude.ai as an inline Connect prompt.auth=requiredon the URL (the share link above carries it) turns lazy authentication off for that URL: every tokenless request,initializeincluded, answers the challenge. That is what claude.ai's Add-custom-connector dialog needs, because it probes the URL without credentials and only reads a 401 as OAuth. - Adding it by hand in Claude.ai (Settings → Connectors → Add custom connector): paste the URL with
auth=required; the dialog then detects Authentication "Always required" and OAuth client "register one automatically" (DCR); the server does not advertise CIMD yet. Without the flag the dialog auto-detects "None" (the lazy handshake looks authless to it) and the choice must be overridden to "Required when the server asks". No extra headers, Streamable HTTP. - Account creation inside the sign-in. A user who has no Accounted account creates one on the sign-in screen the challenge opens (BankID or e-mail + 2FA). No visit to the website first.
/accounted:setupwalks the whole flow, including creating the company from the conversation. - Every write is staged. Write tools create a pending operation with a preview; nothing is booked until the user approves, either in chat via
accounted_approve_pending_operationor in the web app. - Data stays in the user's tenant. The connector only ever sees companies the signed-in user is a member of, enforced server-side per call.
Self-hosted Accounted
Point the plugin at your own instance: remove the bundled server and add yours with claude mcp add --transport http accounted "https://your-host/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted". The same OAuth flow, skills and commands apply.