docs: MCP integration inventory

design/mcp-integrations.md

@@ -0,0 +1,31 @@
+# MCP and SaaS integrations
+
+## Principle
+
+| Path | Technology |
+|------|------------|
+| **Agent ↔ SaaS** | **MCP when available** — **remote preferred**, **local only if necessary** |
+| **Scripts / CI / health / install** | **REST/SDK or fixtures** — no MCP required |
+
+## Inventory
+
+| Integration | MCP reality | Runtime | Agent allow (summary) | Deny (summary) |
+|-------------|-------------|---------|----------------------|----------------|
+| **Square** | Official remote MCP (`mcp.squareup.com`) | Remote MCP | Bookings, customers, catalog, inventory/location reads | Payments, refunds, cards, checkout, payouts |
+| **QuickBooks Online** | Local stdio MCP ([intuit/quickbooks-online-mcp-server](https://github.com/intuit/quickbooks-online-mcp-server)) | Local MCP process on same Docker network as Hermes | Reports; search/get invoices, bills, vendors, customers; company info | create_payment, bill_payment, money movement; write/update/delete off for MVP |
+| **Vagaro** | No public MCP | REST + webhooks in our services | Appointments, clients, services, staff | No scrape |
+| **WhatsApp / Telegram / Email** | N/A as Square-like SaaS MCP | Hermes channels via NemoClaw channel commands | Owner ↔ agent | Client outbound draft-first |
+
+## Hermes MCP registration
+
+Managed `/sandbox/.hermes/config.yaml` `mcp_servers` with `tools.include` / `tools.exclude`, applied via **host sealed** `nemohermes` config paths — not agent free-edit of config files.
+
+## Connection walkthrough (after install)
+
+1. Explain read scope and hard limits (no pay, no auto-publish).  
+2. Owner completes vendor browser/bot steps.  
+3. Operator `connect-*.sh` registers providers/MCP/policy via `nemohermes`/`openshell`.  
+4. Health check.  
+5. Capability report: connected | skipped | later | error.
+
+Owner connects **their** accounts, not demo tenants only.