gl-importer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gl-importer (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Import CSV/XLSX accounting data into QuickBooks Online or Xero from inside Claude Code, using the Synder Importer API.
This plugin bundles:
/api/v1) — full read + write,19 tools covering account, companies, settings, entities, fields, mappings, imports, status polling, results, cancel, revert, plus two composite "happy path" tools.
gl-importer agent skill with natural-language guidance for the two-stepimport flow (dry-run → confirm).
/plugin command available)IMPORTER_API_TOKEN in your shell env.Generate at importer.synder.com → Account → API Keys.
/plugin marketplace add SynderAccounting/gl-importer-plugin
/plugin install gl-importerThen set your token in the shell that launches Claude Code:
export IMPORTER_API_TOKEN="your_token_here"Download the latest .mcpb bundle from Releases and double-click it. Claude Desktop will prompt you for the API token.
git clone https://github.com/SynderAccounting/gl-importer-plugin
cd gl-importer-plugin
npm install
npm run build
# Point Claude Code at this directory:
claude --plugin-dir .| Env var | Required | Default | Purpose |
|---|---|---|---|
IMPORTER_API_TOKEN | yes | — | Bearer token for the Synder Importer API |
IMPORTER_BASE_URL | no | https://importer.synder.com/api/v1 | Override for staging/test |
Once installed, talk to Claude Code naturally:
The skill will walk Claude Code through a safe two-step flow: a dry-run that shows the proposed field mapping, then a confirmed call that actually creates the import and polls until it terminates.
The MCP server exposes 19 tools. The ones an LLM will hit most often:
| Tool | Purpose |
|---|---|
import_csv | Happy path. Auto-resolves company, uploads file, runs dry-run, then (on confirm) executes + waits. |
wait_for_import | Polls a running import to a terminal state with exponential backoff (2s → 1.5× → 30s cap). |
list_companies / list_entities / get_fields | Discover what you can import where. |
list_mappings / create_mapping / update_mapping / delete_mapping | Saved-mapping CRUD. |
auto_import / execute_import | Lower-level: create an import with auto-mapping or an explicit mapping. |
get_import_status / get_import_results / cancel_import / revert_import | Lifecycle. |
get_settings / update_settings | Per-company import settings. |
get_account | Whoami / token check. |
Full schemas are emitted at MCP startup — the agent skill (skills/gl-importer/SKILL.md) also documents the conventions.
npm install
npm run build # tsc → dist/
npm test # vitest, 60+ unit tests, virtual-clock polling tests
npm run watch # tsc --watch for iterative devCI runs on every push and PR (.github/workflows/ci.yml).
version in package.json and .claude-plugin/plugin.json (keep them in sync).git tag v0.x.y && git push --tags.publish.yml workflow publishes to npm on the tag push (uses NPM_TOKEN secret).MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.