skilled-plus4u-mcp

MCP server with secure Plus4U authentication and on-demand skill execution.

Features

• Secure token storage: Tokens stored in OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
• Agent-driven skill discovery: The agent (Claude Code, Cursor, Codex, …) discovers SKILL.md and skill.js itself;
• Token injection: Skills receive an authenticated HTTP client without ever seeing the token
• OIDC authentication: Interactive browser-based login with Plus4U

Installation

npm install
npm run build

Configuration

Add to your MCP configuration (e.g., mcp.json):

{
  "mcpServers": {
    "skilled-plus4u-mcp": {
      "command": "node",
      "args": ["/path/to/skilled-plus4u-mcp/build/index.js"],
      "env": {
        "LOG_LEVEL": "info"
      }
    }
  }
}

Environment Variables

| Variable | Default | Description | |----------|---------|-------------| | LOG_LEVEL | info | Logging level: error, warn, info, debug |

MCP Tools

login

Authenticate with Plus4U. Opens browser for OIDC login and stores token in OS keychain.

logout

Clear authentication token from keychain.

getAuthStatus

Check if authenticated with Plus4U without triggering login. Returns authenticated: true/false.

executeSkill

Execute a skill script identified by absolute path.

{
  "scriptPath": "/Users/me/.claude/skills/bookkit-read/skill.js",
  "params": {
    "url": "https://uuapp.plus4u.net/uu-bookkit-maing01/AWID/book/page?code=home"
  }
}

The agent is responsible for resolving scriptPath from its own SKILL.md discovery (Claude Code skills, Cursor rules, Codex skills, …). Convention: skill.js co-located with SKILL.md in the same directory.

batchExecuteSkill

Execute a skill script multiple times in parallel.

{
  "scriptPath": "/Users/me/.claude/skills/bookkit-read/skill.js",
  "paramsList": [
    { "url": "…/page1" },
    { "url": "…/page2" }
  ]
}

Writing Skills

Skills are JavaScript modules exporting execute:

async function execute(params, http) {
    const result = await http.get('https://api.example.com/data');
    return result;
}

module.exports = { execute };

The server caches loaded modules per absolute path and invalidates the cache when the script's mtime changes — no reloadSkills tool needed.

SKILL.md ↔ skill.js linking

The agent learns about a skill through its own SKILL.md. To run that skill, the agent passes the absolute path to the executable script (typically skill.js co-located with SKILL.md) to executeSkill. This server has no opinion about how the agent finds those files.

Security

• Skills never see the token — they only receive the http object
• http.get() / http.post() auto-add the Bearer token
• Token is stored in OS keychain, not in env vars or files

License

MIT