Connect your AI agent to Money to consult and manage your school's financial information through the official PADMA Tools plugin. ## Before starting You need: - A PADMA user with access to the school. - A recent version of Codex or Claude Code with support for remote MCP servers and OAuth. ## Install the plugin ### Codex 1. Add the PADMA Tools marketplace: ```bash codex plugin marketplace add dwaynemac/padma-tools ``` 1. Open /plugins in Codex CLI or Plugins in the Codex app. 1. Choose PADMA Tools and then install Money. 1. Start a new task for the agent to load the skill and tools. To update the catalog and installed plugins: ```bash codex plugin marketplace upgrade padma-tools ``` ### Claude Code ```bash claude plugin marketplace add dwaynemac/padma-tools claude plugin install money@padma-tools ``` Start or restart Claude Code to load the skill and tools. ## Authenticate the connection Money uses Dynamic Client Registration (DCR). Each installation automatically registers its own OAuth client and opens PADMA Accounts for you to log in and authorize one or more accounts. Money will only show the enabled businesses that you can also use locally. ### Codex After installing or updating the plugin, start a new task. If Codex does not open the browser automatically, run: ```bash codex mcp login money --scopes openid,profile,account,money ``` Complete the login and authorization in PADMA Accounts. Codex receives the result in a local callback and saves the OAuth session in its secure storage. ### Claude Code 1. Open Claude Code and run /mcp. 1. Select money and choose Authenticate. 1. Leave empty Client ID and Client Secret: DCR obtains them automatically. 1. Complete the login and authorization in PADMA Accounts. ## Verify the connection Ask the agent: > List the Money businesses I have authorized. The agent must execute list\_businesses, which returns only the businesses authorized by OAuth and usable in Money. - If it returns one, it can select it automatically. - If it returns several, the agent should use the business you indicate or ask you which one you want to use; it should not guess. Then it must execute get\_business\_context for the selected business and report its currency, timezone, capabilities, and limits. In all the following tools it will keep the same business\_id when selection is necessary. Then test a read-only query: > List my accounts and their currencies. Before writing, the agent must show the exact proposed change and ask for confirmation, unless you have already authorized that same operation in the current conversation. ## What the plugin includes The plugin Money: - Configures the remote MCP server https://money.derose.app/mcp. - It authenticates using OAuth and DCR, without credentials shared in prompts, environment variables, or project files. - It discovers the authorized businesses through list\_businesses and selects one for each workflow. - It incorporates the skill padma-money, with the Money financial model, secure workflows, and real tool limitations. - Queries accounts, categories, contacts, transactions, and reports. - Analyzes expenses, income, periods, subtotals, and possible anomalies. - Creates and updates transactions, accounts, categories, recurring transactions, plans, and automation rules. - Applies confirmation, idempotency, concurrency control, and verification after each write. OAuth defines the list of allowed businesses. business\_id It functions only as a selector within that list: It does not grant access on its own. A nonexistent or unauthorized ID is rejected without revealing if it belongs to another tenant. ## Examples - "How much did we spend last month, separated by category?" - "Search for uncategorized transactions and suggest how to classify them".” - "Record this expense after showing me exactly what you will create".” - "Compare this month with the previous one and explain the relevant variations".” - "Review this account against the statement and list the differences without modifying anything".” ## Security - Do not paste authorization codes, access tokens, or refresh tokens into prompts, shared documents, repositories, URLs, or logs. - Do not share dynamically registered Client IDs between users or teams. - If the business you need does not appear in list\_businesses, disconnect money and reauthorize including the corresponding account. - Write access does not broaden the request: The agent must modify only the authorized fields and records. - If you suspect a session was exposed, close it from the MCP client and reauthenticate. ## Troubleshooting - The plugin does not appear: update the marketplace with codex plugin marketplace upgrade padma-tools and reopen the catalog. - The server appears without tools: update or reinstall the plugin, restart the agent and authenticate money. - “The requested redirect URI is malformed or doesn't match…”: there is a static or previous OAuth configuration. Delete the connection and add it again so that DCR registers the exact callback. Do not add a callback with \*. - Error 401: the OAuth session is missing, expired or revoked. Run login again or Authenticate. - Error 403: the authenticated user does not have sufficient access, the authorization does not include the required scopes or the business\_id does not belong to the authorized list. Do not try other IDs randomly. - Error business\_required: there are several authorized businesses and the tool needs you to select one. Run list\_businesses and repeat the operation with one of the returned IDs. - Error 429 during registration: more than 10 registrations were exceeded from the same IP in 60 seconds. Wait the time indicated in Retry-After and try again. - The expected business is missing: Disconnect the session and reauthorize including the corresponding account in PADMA Accounts. - The agent asks for confirmation to write: this is the expected behavior and helps avoid accidental changes. ## More information - PADMA Tools Repository - PADMA Money - PADMA Accounts