signin

Files (1)

• SKILL.md

SKILL.md (first lines)

# Summation Sign-in

Auth is owned by the host MCP client. You never mint, poll, store, or inject a credential. **External** and **internal** flows differ — detect mode first.

## 0. Detect mode (do this first)

```bash
printf '%s' "${SUMMATION_PLUGIN_INTERNAL:-${ADDISON_PLUGIN_INTERNAL:-}}"
```

Treat as **internal** only if the value is `1`, `true`, `yes`, or `on` (case-insensitive). Anything else (including empty) is **external**.

| Mode | Who | Experience |
|---|---|---|
| **External** (default) | Customers | One environment (plugin MCP URL). No env or tenant questions. |
| **Internal** | Summation employees (`SUMMATION_PLUGIN_INTERNAL=1` in the shell that launched Claude; `ADDISON_PLUGIN_INTERNAL` still works) | Ask **environment**, then **tenant** guidance, then auth. |

## Fixed environments (allowlist — never free-form hosts)

| Env | MCP URL |
|---|---|
| `prod` | `https://mcp.summation.com/mcp` |
| `staging` | `https://staging-mcp.summation.com/mcp` |
| `sandbox` | `https://sandbox-mcp.summation.com/mcp` |

The plugin’s bundled `mcp.json` points `summation` at **production** (`https://mcp.summation.com/mcp`). Internal users can switch env at sign-in.

---

## External flow (default)

Do **not** ask about environments or tenants. There is one host and one org session.

### E1. Check auth

Call MCP **`whoami`** on server **`summation`**.

| Outcome | Action |
|---|---|
| Identity returned | Report who they are; done (or hand off to `start`). |
| Needs authentication | Continue to E2. |
| Server missing | Enable/reload the **summation** plugin; do not hand-register alternate URLs. |

### E2. Authenticate

> Summation needs a one-time browser sign-in. When the host prompts you to authenticate **summation**, approve it in the browser (same account/SSO as the web app). No password or token is pasted into this chat.

Invoke **`whoami`** again. Prefer the host Authenticate control (`/mcp`, or `codex mcp login summation`) if tools are not yet authed.

### E3. Confirm

`get_default_project` or `list_projects`. Report identity + org. Ready.

---

## Internal flow (`SUMMATION_PLUGIN_INTERNAL=1`)

### I1. Choose environment

Ask which environment they want: **prod**, **staging**, or **sandbox** (only these three). Default suggestion: **prod** (matches the plugin default).

Do not accept arbitrary URLs or hosts.

### I2. Tenant (org)

Explain clearly:

> MCP auth binds to the **org you approve in the browser** (your active org on the Summation web app for that environment).  
> To use a different tenant: switch org on that env’s web app first, then we re-authenticate.  
> Env and tenant both change only by signing out and signing in again.

If they need a specific tenant now, pause until they’ve switched org on the web app, then continue.

### I3. Point `summation` at the chosen env (headerless)

User-scope override so the chosen env wins over the plugin default. Do **not** set an `Authorization` header or any bearer token — host OAuth owns the credential.

```bash
# replace URL with the allowlisted URL for the chosen env
# Claude Code:
claude mcp remove -s user summation
claude mcp add -s user --transport http summation '<ENV_MCP_URL>'
# Codex:
codex mcp logout summation
codex mcp remove summation
codex mcp add summation --url '<ENV_MCP_URL>'
```

Remove may fail with “not found / not registered” — that is fine; continue to **add**. Surface any other remove failure. **Add** must succeed before auth.

If the host CLI add is unavailable (Desktop-only), tell them to set the Summation MCP URL to the chosen env’s allowlisted host in the host MCP UI (still no `Authorization` header), or re-auth after an admin points the plugin default.

### I4. Authenticate

Same browser prompt as external, for server **`summation`**. Then **`whoami`**.

### I5. Confirm

Report: **environment**, identity, **org/tenant**, scopes. Note that switching either env or tenant requires the `signout` skill, then this flow again.

---

## After sign-in (both modes)

Sign-in only connects MCP. Before any data work, load the **api** skill — surface routing (sumcli when a shell is available, MCP otherwise), the CLI's separate `sumcli auth login` credential, and safety rules live there, and nothing else puts them in context. For first-time users, suggest the `start` skill.

## Rules (both modes)

- Never print, log, or commit tokens.
- Never ask the user to paste client secrets, device codes, or bearers into chat.
- Never use `sum_api.py login` / `login-poll` / `mcp-connect` for host MCP auth.
- On later 401/403: re-run this skill (re-auth), do not improvise REST auth.
- Prefer the plugin/server named **`summation`** when multiple Summation-related MCP entries exist (unless the user explicitly wants another).

From summationai/summation-plugin, MIT.

More from summationai/summation-plugin