Pacioli — the ERPNext broker you can hand the books MCP server

Least-privilege governance for ERPNext, and a governed agent front door built on top of it — MCP and A2A, one spine behind both. A door admits; it never decides.

In 1494, in Venice, Luca Pacioli printed the Summa de arithmetica — and inside it, the tract that taught the world double-entry bookkeeping. He wrote it down not because merchants couldn't count, but because they couldn't trust. His rule is one sentence deep: no debit without a credit. Every action gets an equal, opposite, recorded counterpart — and a book that doesn't balance confesses on the spot. Five hundred years of prove it or it didn't happen.

This repo is that tract, written again for a new clerk. The merchant's problem hasn't changed; the clerk has. He balanced books for merchants who couldn't watch every clerk. This balances them for owners who can't watch every agent. Same problem, five centuries apart. Same fix.

See it before you read the rest: the demo. One command on a bare pip install pacioli pacioli-guard shows the floor deciding, and a sealed receipt that will not be quietly rewritten. Every verdict is the shipped code; nothing is staged.

Tavola I — The friar at his slate, attributed to Jacopo de' Barbari, 1495. The glass rhombicuboctahedron hangs at his left; the Summa sits under the dodecahedron at his right. This repo's device is that hanging solid.

Distinctio I — Of the Two Instruments

There are two instruments in this house, and they compose — they do not couple. The first guards every api-key credential on the site whether an agent is involved or not; the second is the one governed door an agent may use. The first is the floor under that door; the second stands on it and submits to it. What follows is each instrument as the treatise would have it: what it is, what it refuses, and how it is installed.

What the floor covers, plainly, because a floor that overstates itself is not a floor. Two questions, two of frappe's own public hooks, each at the altitude where its question is legible.

Which credential is acting, and what may it call? The credential gate rides authhooks, which runs when an api-key credential authenticates. It governs token/Basic api-key requests across every REST mount, and it does not** govern OAuth2 Bearer tokens, desk/cookie sessions, background jobs, the scheduler, server scripts, or the bench console. "Which credential is this" only exists at authentication time, so this gate can only live here, and that boundary is inherent to it.

Shortened. The full README is on GitHub.