Implement S7 operator connect helpers for SaaS and channels.

Add dry-run-default connect dispatcher and per-integration scripts with gitignored local capability state, docs, and unit tests. Mutations require --apply and use nemohermes/openshell only.
2026-07-27 13:32:42 -07:00
parent 76df8b7ab6
commit d6b74c42f6
17 changed files with 2229 additions and 35 deletions
@@ -1,8 +1,59 @@
 # QuickBooks Online

-**Status:** Outline. Design: [design/mcp-integrations.md](../../design/mcp-integrations.md).
+**Status:** Connect script implemented. Design: [design/mcp-integrations.md](../../design/mcp-integrations.md).

- **Agent path:** local QBO MCP on Docker network with Hermes.  
- **Allow:** P&L/reports, invoice/bill/vendor/customer read, company info.  
- **Deny:** payment/bill_payment tools; write/update/delete off for MVP.  
- **Connect:** operator `scripts/connect/connect-quickbooks.sh` (build).  
+- **Agent path:** local QBO MCP on Docker network with Hermes.
+- **Allow:** P&L/reports, invoice/bill/vendor/customer read, company info.
+- **Deny:** payment/bill_payment tools; write/update/delete off for MVP.
+- **Connect:** operator `scripts/connect/connect-quickbooks.sh`.
+
+## Connect procedure
+
+```bash
+# Preview (default)
+./scripts/connect.sh quickbooks --dry-run
+
+# Execute (prompts for credentials)
+./scripts/connect.sh quickbooks --apply
+```
+
+### What the script does
+
+1. **Dry-run:** Shows MCP image, container name, Docker network, allowed/denied tools.
+2. **Apply:**
+   - Prompts for QBO Client ID, Client Secret, Access Token, Realm ID.
+   - Stores credentials via `openshell provider set qbo-*`.
+   - Registers MCP server type via `nemohermes config set`.
+   - Applies tool allowlist (read-only) and denylist (payment/write tools).
+   - Records status in `.local/capability_state.json`.
+   - Provides guidance for starting the MCP container.
+
+### Owner steps (browser only)
+
+1. Create a QBO application at [developer.intuit.com](https://developer.intuit.com).
+2. Complete OAuth flow to obtain Client ID, Client Secret, and Access Token.
+3. Note the Realm ID (company ID).
+4. Provide credentials to the operator.
+
+### Tool filters
+
+| Allowed (read) | Denied |
+|----------------|--------|
+| `get_report` | `create_payment` |
+| `search_invoice` | `bill_payment` |
+| `get_invoice` | `create_invoice` |
+| `search_bill` | `update_invoice` |
+| `get_bill` | `delete_invoice` |
+| `search_vendor` | `create_bill` |
+| `get_vendor` | `update_bill` |
+| `search_customer` | `delete_bill` |
+| `get_customer` | |
+| `get_company_info` | |
+
+### MCP container
+
+The QBO MCP server runs as a Docker container on the same network as Hermes:
+
+- **Image:** `ghcr.io/intuit/quickbooks-online-mcp-server:latest`
+- **Container:** `lumina-qbo-mcp`
+- **Network:** `lumina-network`