SUMIT MCP — Claude Code & OpenClaw Skill

An MCP server that turns SUMIT (formerly OfficeGuy) into agent-operable Israeli billing — read invoices and debt, issue חשבונית/קבלה/חשבון עסקה, and charge with a confirm-first safety model. The operational playbook for billing your clients from Claude Code or OpenClaw.

Features

• ✅ 15 tools across read (invoices, debt, standing orders, catalog), write (issue/send/cancel documents, customers), and charge.
• ✅ Layered charge safety — env opt-in, prepare→execute confirmation token, amount cap, redacted audit. Money never moves silently.
• ✅ Multi-account via env; pick the account per call.
• ✅ Built on the in-house sumit-api library (battle-tested payload builders + redaction).
• ✅ Local stdio server — no secrets leave your machine.

Quick start

See .claude/skills/sumit-mcp/references/installation.md: clone, pnpm install && pnpm build, set SUMIT_* env, connect via claude mcp add or .mcp.json.

The server is declared twice, on purpose, and both declarations hold env-var placeholders only and run the committed dist/bundle.mjs:

• .claude-plugin/plugin.json is what an installed plugin uses. It launches ${CLAUDE_PLUGIN_ROOT}/dist/bundle.mjs with no fallback, because Claude Code resolves the ${CLAUDE_PLUGIN_ROOT:-.} form to . for a plugin and then looks for the bundle in the session's working directory.
• .mcp.json is for running straight from a clone opened at the repo root — including claude.ai cloud sessions, where the SUMIT_* values come from the cloud environment's env vars.

test/plugin-config.test.ts keeps the two in step. SUMIT_MAIN_COMPANY_ID/SUMIT_MAIN_API_KEY are deliberately bare ${VAR} placeholders with no default. When one is unset, Claude Code still launches the server and passes the placeholder through as literal text, so the server enforces this itself: it never accepts an unexpanded ${VAR} as a credential, and it exits at startup when no usable account is left, which shows up as a failed connection instead of a server whose every call fails. Charging additionally stays behind its own env opt-ins (below).

Safety

Charging requires SUMIT_ALLOW_CHARGE=1, always goes prepare → user approval → execute, and needs a browser-minted one-time card token. See the skill's safety ladder. Set SUMIT_CONFIRM_SECRET to a fixed random value (e.g. openssl rand -hex 32); charging refuses to run without it.

The full threat model — what a misbehaving agent could try and which control stops it — is in SECURITY.md.

Links

• SUMIT API: https://app.sumit.co.il/developers/api/
• Companion runtime libs: sumit-api, sumit-react

---

Built with ❤️ for OpenClaw by Digitizer

Windows note

The plugin ships its skill through a git symlink (skills/ → the in-repo source). On Windows, enable Developer Mode and set git config --global core.symlinks true before cloning or installing — the plugin cache clone inherits it. Changing the config does not repair an existing checkout (the repo may have recorded core.symlinks=false locally). To repair one, run these two commands inside it (the second re-materializes only the plugin's symlink entry, so nothing else in your working tree is touched):

git config core.symlinks true
git checkout -- skills/sumit-mcp

Or simply re-clone. WSL also works. macOS/Linux need nothing.