# MCP and SaaS integrations

## Principle

| Path | Technology |
|------|------------|
| **Agent ↔ SaaS** | **MCP when available** — **remote preferred**, **local only if necessary** |
| **Scripts / CI / health / install** | **REST/SDK or fixtures** — no MCP required |

## Inventory

| Integration | MCP reality | Runtime | Agent allow (summary) | Deny (summary) |
|-------------|-------------|---------|----------------------|----------------|
| **Square** | Official remote MCP (`mcp.squareup.com`) | Remote MCP | Bookings, customers, catalog, inventory/location reads | Payments, refunds, cards, checkout, payouts |
| **QuickBooks Online** | Local stdio MCP ([intuit/quickbooks-online-mcp-server](https://github.com/intuit/quickbooks-online-mcp-server)) | Local MCP process on same Docker network as Hermes | Reports; search/get invoices, bills, vendors, customers; company info | create_payment, bill_payment, money movement; write/update/delete off for MVP |
| **Vagaro** | No public MCP | REST + webhooks in our services | Appointments, clients, services, staff | No scrape |
| **WhatsApp / Telegram / Email** | N/A as Square-like SaaS MCP | Hermes channels via NemoClaw channel commands | Owner ↔ agent | Client outbound draft-first |

## Hermes MCP registration

Managed `/sandbox/.hermes/config.yaml` `mcp_servers` with `tools.include` / `tools.exclude`, applied via **host sealed** `nemohermes` config paths — not agent free-edit of config files.

## Connection walkthrough (after install)

1. Explain read scope and hard limits (no pay, no auto-publish).  
2. Owner completes vendor browser/bot steps.  
3. Operator `connect-*.sh` registers providers/MCP/policy via `nemohermes`/`openshell`.  
4. Health check.  
5. Capability report: connected | skipped | later | error.

Owner connects **their** accounts, not demo tenants only.