hey all, john here again.
you’ll have seen pieces of this from me scattered across a few threads this week. i’m pulling it into one place, because the ask under all of them deserves its own room.
I’ve spent the last while reading nearly everything this forum has posted about agents and mcp, and i want to start by saying it plainly: this community is building the real thing, fast, and in the open. so before i make my case, i want to credit the people already doing the work, because the case only stands on top of what they’ve built.
rushabh framed it best in the agentic-world thread. agentic coding feels magical, he said, but it’s “a trick under the hood,” the model is just “a clever binding to something underneath.” that’s exactly right. and on an erp, the something underneath is your books. so the question i want to put on the table for all of us is simple: what sits between the agent and the ledger.
look at what’s already shipped.
casys.ai put out an mcp server with over a hundred tools across the whole erpnext surface. it’s the breadth reference everyone points at, and it’s active and open. rakeshgangwar’s erpnext-mcp-server is the standalone people actually clone and run. frappe assistant core (buildswithpaul) went furthest on the plumbing: oauth2, permission scoping, an audit log, real infrastructure, and it’s the most-starred of the lot for a reason. applied relevance built the python path with deep filtering and broad api coverage. mascor’s frappe-mcp-server reached for the hard part on purpose, granular permissions and audit logging, and it points the right way.
agentready took the gateway road: discover the real installation, wrap it in a small governed action set, put approvals and audit around execution. and they said the honest thing themselves, that a gateway can’t shrink the erp credential sitting underneath it. mith tech wrote the security playbook: don’t connect as administrator just to test, start read-only, build a purpose-built user with a tight role. erpgulf shipped changai, an open agent with natural language and voice. damcio20 is building a kiosk on erpnext with a local llm for the shop floor. sambhaji and varun turned a skills race into a merge, co-operation over competition, which is the exact spirit i’m writing in.
and the official frappe mcp library and skills are what they should be: a good door and a good toolbelt. the library runs the tool it is handed and leaves the guarding to the app and the framework around it. that is the right design for a library. the door is not the floor. the floor has to live somewhere else.
so here’s the one thing i keep coming back to, and it is not a knock on anyone above.
on frappe, an api credential carries no scope. when a key authenticates, the code runs frappe.set_user(user), and from that line on the request is that user, with every permission the user has. the key is a field on the user, not its own object. roles are real and they work, but they attach to the person, not to the credential. so a token you minted for one small job can call anything that user can call. and narrowing the user doesn’t close it. a scoped-down user’s key still carries that whole user’s reach, with no consent before a write and no receipt after. it only lowers the ceiling.
that is fine, most of the time. on a dev site, on read-heavy work, with one person watching the agent in a chat window, you do not need a floor. it would only be in the way. use these tools. they work.
a floor starts to matter when three things change. the human leaves the loop, which is the whole point of an agent. the books are real, so a wrong submit is a filed document and a wrong delete is gone. and someone asks later what happened, which nobody needs until they need it badly.
and here is the tell that this isn’t my hobby horse. look at what microsoft just shipped in business central, their own erp. they made agents first-class and generally available, a sales order agent and a payables agent. and look at how they governed them, because it is this exact floor. each agent runs under its own business central user account, not a person’s, scoped by a permission set built to touch only what that one job needs. every consequential step, sending a quote, posting an invoice, stops for a human to review and approve before it happens, and business central records who reviewed it and when. that is a dedicated agent identity, scoped below any human, a human yes before the write, and a receipt of who said it. plan, consent, prove, shipped in the biggest proprietary erp there is.
and microsoft is blunt about where that floor has to sit. their own guidance for agent identity says that the moment an agent authenticates with a plain api key instead of a minted identity, conditional access “won’t apply.” same truth we are living on frappe: a floor has to bind the credential itself, it cannot just sit in a tool above it.
the only thing left to argue is ownership. microsoft’s version is proprietary and lives in their cloud. erpnext’s can be open, and live in the platform. that is the whole point of writing this.
so my ask, and it’s two honest roads to the same place.
one, fix it in core. the extension point already exists. auth_hooks runs right after the key authenticates and before the request dispatches, which is exactly where a per-credential allowlist belongs. this is platform work, and rushabh already said the agentic refactor lives in develop and v17. a credential floor belongs in that future.
two, until it does, use ours. i built pacioli-guard for exactly this: a bench app that binds any credential to an allowlist of methods and doctypes, deny by default, no core fork, given freely. run it as your floor, or read it as the reference for what core should do. and a governed broker on top that makes every write go plan, consent, prove, so an agent can’t forge a yes and can’t quietly erase what it did.
either way, same ask. fix the floor. i’d rather say it now, with the code open, than after the first agent does something a scoped credential would have stopped.
i’m not selling anything. it’s open, it’s apache, check every word: GitHub - john-broadway/pacioli: Least-privilege governance for ERPNext — the credential floor + a governed agent broker, MCP · A2A · API, one spine. No debit without a credit: PLAN · CONSENT · PROVE · UNDO. · GitHub . and if you want the full read of where each of these servers actually stops, i wrote it up line by line and i’ll link it in a reply.
we’re early. let’s build the floor together. adopt it into frappe, or run pacioli, or both 
