Summation Sign-in

Auth is owned by the host MCP client. You never mint, poll, store, or inject a credential. External and internal flows differ — detect mode first.

0. Detect mode (do this first)

printf '%s' "${SUMMATION_PLUGIN_INTERNAL:-${ADDISON_PLUGIN_INTERNAL:-}}"

Treat as internal only if the value is 1, true, yes, or on (case-insensitive). Anything else (including empty) is external.

Fixed environments (allowlist — never free-form hosts)

The plugin’s bundled mcp.json points summation at production (https://mcp.summation.com/mcp). Internal users can switch env at sign-in.

External flow (default)

Do not ask about environments or tenants. There is one host and one org session.

E1. Check auth

Call MCP whoami on server summation.

E2. Authenticate

Summation needs a one-time browser sign-in. When the host prompts you to authenticate summation, approve it in the browser (same account/SSO as the web app). No password or token is pasted into this chat.

Invoke whoami again. Prefer the host Authenticate control (/mcp, or codex mcp login summation) if tools are not yet authed.

E3. Confirm

get_default_project or list_projects. Report identity + org. Ready.

Internal flow (SUMMATION_PLUGIN_INTERNAL=1)

I1. Choose environment

Ask which environment they want: prod, staging, or sandbox (only these three). Default suggestion: prod (matches the plugin default).

Do not accept arbitrary URLs or hosts.

I2. Tenant (org)

Explain clearly:

MCP auth binds to the org you approve in the browser (your active org on the Summation web app for that environment).
To use a different tenant: switch org on that env’s web app first, then we re-authenticate.
Env and tenant both change only by signing out and signing in again.

If they need a specific tenant now, pause until they’ve switched org on the web app, then continue.

I3. Point summation at the chosen env (headerless)

User-scope override so the chosen env wins over the plugin default. Do not set an Authorization header or any bearer token — host OAuth owns the credential.

# replace URL with the allowlisted URL for the chosen env
# Claude Code:
claude mcp remove -s user summation
claude mcp add -s user --transport http summation '<ENV_MCP_URL>'
# Codex:
codex mcp logout summation
codex mcp remove summation
codex mcp add summation --url '<ENV_MCP_URL>'

Remove may fail with “not found / not registered” — that is fine; continue to add. Surface any other remove failure. Add must succeed before auth.

If the host CLI add is unavailable (Desktop-only), tell them to set the Summation MCP URL to the chosen env’s allowlisted host in the host MCP UI (still no Authorization header), or re-auth after an admin points the plugin default.

I4. Authenticate

Same browser prompt as external, for server summation. Then whoami.

I5. Confirm

Report: environment, identity, org/tenant, scopes. Note that switching either env or tenant requires the signout skill, then this flow again.

After sign-in (both modes)

Sign-in only connects MCP. Before any data work, load the api skill — surface routing (sumcli when a shell is available, MCP otherwise), the CLI's separate sumcli auth login credential, and safety rules live there, and nothing else puts them in context. For first-time users, suggest the start skill.

Rules (both modes)

• Never print, log, or commit tokens.
• Never ask the user to paste client secrets, device codes, or bearers into chat.
• Never use sum_api.py login / login-poll / mcp-connect for host MCP auth.
• On later 401/403: re-run this skill (re-auth), do not improvise REST auth.
• Prefer the plugin/server named summation when multiple Summation-related MCP entries exist (unless the user explicitly wants another).