# SUMIT MCP — Claude Code & OpenClaw Skill
[](https://github.com/Digitizers/sumit-mcp/actions/workflows/ci.yml)
[](https://docs.claude.com/en/docs/claude-code)
[](https://github.com/Digitizers)
[](https://sumit.co.il)
[](LICENSE)
> An MCP server that turns [SUMIT](https://digitizer.li/sumit) (formerly OfficeGuy) into agent-operable Israeli billing — read invoices and debt, issue חשבונית/קבלה/חשבון עסקה, and charge with a confirm-first safety model. The operational playbook for billing your clients from Claude Code or OpenClaw.
## Features
- ✅ **15 tools** across read (invoices, debt, standing orders, catalog), write (issue/send/cancel documents, customers), and charge.
- ✅ **Layered charge safety** — env opt-in, prepare→execute confirmation token, amount cap, redacted audit. Money never moves silently.
- ✅ **Multi-account** via env; pick the account per call.
- ✅ Built on the in-house `sumit-api` library (battle-tested payload builders + redaction).
- ✅ Local stdio server — no secrets leave your machine.
## Quick start
See [`.claude/skills/sumit-mcp/references/installation.md`](.claude/skills/sumit-mcp/references/installation.md): clone, `pnpm install && pnpm build`, set `SUMIT_*` env, connect via `claude mcp add` or `.mcp.json`.
The server is declared twice, on purpose, and both declarations hold env-var placeholders only and run the committed `dist/bundle.mjs`:
- [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) is what an installed plugin uses. It launches `${CLAUDE_PLUGIN_ROOT}/dist/bundle.mjs` with no fallback, because Claude Code resolves the `${CLAUDE_PLUGIN_ROOT:-.}` form to `.` for a plugin and then looks for the bundle in the session's working directory.
- [`.mcp.json`](.mcp.json) is for running straight from a clone opened at the repo root — including claude.ai cloud sessions, where the `SUMIT_*` values come from the cloud environment's env vars.
`test/plugin-config.test.ts` keeps the two in step. `SUMIT_MAIN_COMPANY_ID`/`SUMIT_MAIN_API_KEY` are deliberately bare `${VAR}` placeholders with no default. When one is unset, Claude Code still launches the server and passes the placeholder through as literal text, so the server enforces this itself: it never accepts an unexpanded `${VAR}` as a credential, and it exits at startup when no usable account is left, which shows up as a failed connection instead of a server whose every call fails. Charging additionally stays behind its own env opt-ins (below).
## Safety
Charging requires `SUMIT_ALLOW_CHARGE=1`, always goes prepare → user approval → execute, and needs a browser-minted one-time card token. See the skill's safety ladder. Set `SUMIT_CONFIRM_SECRET` to a fixed random value (e.g. `openssl rand -hex 32`); charging refuses to run without it.
The full threat model — what a misbehaving agent could try and which control stops it — is in [SECURITY.md](SECURITY.md).
## Links
- SUMIT API: <https://app.sumit.co.il/developers/api/>
- Companion runtime libs: [`sumit-api`](https://github.com/Digitizers/sumit-api), [`sumit-react`](https://github.com/Digitizers/sumit-react)
---
Built with ❤️ for OpenClaw by [Digitizer](https://www.digitizer.studio)
### Windows note
The plugin ships its skill through a git **symlink** (`skills/` → the in-repo
source). On Windows, enable Developer Mode and set
`git config --global core.symlinks true` **before** cloning or installing —
the plugin cache clone inherits it. Changing the config does not repair an
existing checkout (the repo may have recorded `core.symlinks=false` locally).
To repair one, run these two commands inside it (the second re-materializes
only the plugin's symlink entry, so nothing else in your working tree is
touched):
git config core.symlinks true
git checkout -- skills/sumit-mcp
Or simply re-clone. WSL also works. macOS/Linux need nothing.