The gateway
and the plugin

One key travels left to right. Nothing travels back except compact JSON the model turns into a sentence.

Skills are not thin

The mistake worth skipping: one of mine runs past four hundred lines, and almost none of it is instructions for calling tools. It is the rules for telling an invoice from a statement of account, and what to do when the document is neither.

Next.js on Vercel, Postgres behind it. Nothing exotic, and that is deliberate — you want boring here. The MCP route itself is about twenty lines: it starts the handler, registers the tools, and stops. Thin by design, not by accident. Everything interesting lives one level down, in the tools.

1. Validate the key
2. Check the caller is allowed to do this
3. Do the work
4. Write it down
5. Return something the model can read back to a human

Same order, every time. When a tool does not fit that shape, it is usually two tools.

This is the design call most people get wrong.

Optimise for dollars and you build a beautiful importer for one supplier and leave the daily grind alone. That is why the daily entry screen is the most-used surface in the system — and why it is phone-first, not a desktop table with a mobile fallback. The person filling it in is standing up, holding paper, in the middle of a shift. If it needs a laptop, it does not get done.

Costs arrive by email, so the gateway watches the mailbox

The queue matters more than it sounds. It is the difference between a system that forgets and a system that can tell you it forgot. Anything still sitting there shows on the dashboard — fourteen of them, oldest one nine days old. Nobody has to remember to check.

• Register a supplier the moment you see a new one, instead of asking anybody to set it up. Every invoice after that gets checked against the list. The thing that would normally be a settings page nobody maintains just maintains itself.
• One table owns the truth for each fact, and everything else points at it. When two tables can both claim to be right, you will spend your life reconciling them.

• None of them needs a screen to exist yet.
• The key is printed once and then gone — only the hash is stored. Break into the database and you get hashes, not working keys.
• Auth stays deliberately small: email, invite-only, no self-signup. You are building for nine people, not nine thousand. Every extra login option is a support call you take on a Sunday.
• The first user is a special case: the owner cannot be invited, because there is nobody there yet to invite them.

The connection is five lines of JSON: a name and a URL. One setting the client fills in — the key, marked sensitive — rides along on every call. Inside, a routing agent reads the request and picks a skill.

The gateway owns the data. The skill owns the judgment. That is the split.

The poller is blind, so the skill has to see

The mailbox poller queues every attachment it finds. It has no idea what any of them are. An invoice and a statement of account look similar and mean completely different things — and it is not the database that tells them apart.

The tell is the shape, not the title. Item lines under one invoice number is an invoice, even if somebody typed Statement across the top.

A document ends up one of four ways

Prose is not a state. Saying it in the summary is not the same as closing it. Leave one document open and it blocks the month close for every outlet, because nobody knows yet which one it belongs to. A helpful paragraph in the report changes nothing — the agent has to write the state down.

Incidents become rules in the skill file

The first live run filed a statement as an invoice. The damage went past untidy: reconciliation never re-checks what a document was filed as, so the junk row got reconciled anyway and invented a variance that did not exist. One bad row, and the owner spends an afternoon chasing a supplier about money that was never missing. That is what a skill is for.

No curl, no secrets in a skill file

If it needs something, it asks the gateway. Which also means the client can read the skills — they are markdown. An owner who wants to know what the thing does can open the file and find out. On the other build the skills drive a browser under the client's own login: no shared passwords, nothing scraped. They already pay for that data; the system just uses the seat they have, the way a staff member would. That one detail has closed more conversations than any feature.

• The key is the only secret the plugin ever holds. One string, marked sensitive.
• Stored hashed, so even you cannot read it back out.
• The database credential never leaves the server. Claude holds a key to your API, never a key to their data.
• Revoke from a dashboard without touching the database. Lose a laptop and it is a thirty-second job.

gw_live_…  one key, switchable, per client

Every client has the same worry underneath the questions: what if it does something stupid while I am asleep? The gate is the answer, and you sell it as a feature. The system does the boring ninety percent and stops at the part with consequences. Nothing that matters happens without a person saying yes.

• Nobody enters a number they would have to go and ask somebody else for. That sentence decides the permissions model. A manager knows what they spent in cash today. They do not know the rent, so they never see a rent field.
• Enforced in the database, not the interface. Hiding a field in the UI is not security, it is decoration.
• Two roles only: owner and manager. Splitting it further made everything worse.
• Every write records who typed it — not to catch anyone out, but so that when a number looks wrong in November you can ask the person who would know.
• Every automatic number drills through to the document behind it. Click a figure, see the invoice. That traceability is the whole reason to leave a spreadsheet: a cell in a workbook cannot tell you where it came from.

The thirty-second demo that closes a nervous ownerWatch 0:54youtube.com/shorts/APqu72LhB-c

Log in as one of their managers, in front of them, on their own data. Let them watch the other outlets disappear. Telling them about row-level security does nothing. Watching their own numbers vanish does all of it.

Seven credentials on every callWatch 0:22youtube.com/shorts/ItuPZR_Rpiw

The gateway had nowhere to keep them yet, so every call carried the client's whole keyring and the plugin had to be trusted with all of it. It worked, it shipped, and it was wrong. Same behaviour today — a fraction of the blast radius.

An error in the spec becomes an error in the code

A diagram in my own doc showed three things where there were only two. It built the third, confidently, and reported an empty column every month. When you build from a written spec with AI, a mistake in the spec ships fast, and without argument. I read my own diagrams like a stranger wrote them now.

Which changes what the hard part isWatch 1:02youtube.com/shorts/eZ-FnNcD7L0

Writing the code stopped being the bottleneck a while ago. Knowing whether it does what you think it does is the bottleneck now.

• Every phase gets a verification script — not unit tests. A script that runs the whole thing against the real database.
• Safe on production: everything it writes is tagged, and it deletes all of it in the cleanup block, including when it fails.
• It refuses to start if the money tables already have rows. That script should never be the thing that discovers real data by deleting it.
• Assertions in plain English. Read them and you know what the system promises.

Nobody hands a stranger fifteen thousand dollars for a system they cannot picture yet. This one came through a free build: seven days, no invoice, no contract. Two agents — two skills in a plugin, one job each, done properly.

By the time we spoke about anything bigger, they had already watched something I built do real work in their business for a month. Deliver value so high, so early, that the upsell is not a pitch — it is the obvious next step.

Then the real objection: they wanted to stay on Google Sheets. Fair — it was free, familiar, and the whole team could already use it. Arguing about databases would have gone nowhere; nobody wins that with a list of reasons. So I built a preview instead, with their actual numbers and their actual outlets, backfilled with their real history. One screen showing what month end looks like when it is already done. That is what changed their mind. Not me talking.

An edge is anywhere the system touches something that is not yours. Screens are predictable — you can build a screen on a Tuesday. Edges are where the surprises live, and they are the only thing that has ever blown a timeline.

An edge is not code. It is somebody else's login, somebody else's rate limit, and a format that changes without telling you.

The scoping call is one question, asked a dozen ways

“Where does this number come from today?” Keep asking until nobody says oh, and there’s also…. That sentence is the one that costs you a fortnight. Then write down what is out, on paper, before anybody signs. That list is the reason these projects finish — without it you do not have a project, you have a subscription to somebody's ideas.

Same architecture and the same two repos both times. The difference between a ten and a fifteen was how many systems it had to talk to — not hours spent. It is not a formula anybody can hand you, because your rate is not mine, but the shape holds: count the edges, and the number moves with that.

And the second build was much faster than the first. Same bones, a different business on top. That is the moment it stops being a favour you did once and starts being a product you sell.

• Nobody is buying a gateway. You sell the spreadsheet somebody rebuilds by hand every month, and you offer to delete that job.
• Every business has one. A file put together from other files on a Sunday, because it is the only way they can see the number.
• A website is a thing they look at. This is a thing they run the business on. That is the whole difference, and it is worth about three times as much.
• Month end used to be a build. Now it is a review. That is the sentence that lands.
• Price the thing it replaces, not the hours you spent.

Build the gateway first. Own the data and the credentials before anything else. The plugin is the easy half, and it is the half that changes — the gateway is the part you will still be running in two years.