BeeL Claude Plugins

Official Claude Code plugins for the BeeL invoicing API.

Install
Plugins
- beel-api — BeeL invoicing API integration guide
- stripe — read-only Stripe integration auditor
- compliance-es — Spanish legal compliance generator (RGPD · 31 bis CP · Veri*Factu)
- spring-boot-multitenancy — API-first Spring Boot and PostgreSQL multitenancy playbook
Auto-enable for your project
License

Install

Open Claude Code in any project and run:

/plugin marketplace add beel-es/claude-plugins
/plugin install beel-api@beel

That's it. Claude activates the relevant installed skills automatically, or you can invoke them manually.

Plugins

`beel-api`

A docs-first toolkit for building and maintaining BeeL integrations. It keeps only stable invariants locally (auth, idempotency, envelope, invoice lifecycle) and fetches everything else — endpoints, schemas, events — from the live docs, so it never goes stale.

Skill	What it does
`/beel-api:beel-api`	Integration guide: golden rules, auth, doc lookup strategy, plus recipes (typed client / official SDK, webhook handler, invoice flow, fiscal context, debugging, `@beel_es/cli` for live sandbox verification)
`/beel-api:implement`	Guided integration: detects your stack (official `@beel_es/sdk` for Node/TS, codegen for Python, raw HTTP otherwise) and implements the flows you need
`/beel-api:audit`	Audits your integration code against the BeeL rules — idempotency, key security, error handling, rate limits, webhook verification, invoice lifecycle — and reports findings with severity and fixes
`/beel-api:webhooks`	Builds a correct webhook receiver: HMAC-SHA256 signature verification, raw-body handling, deduplication, retry-aware processing
`/beel-api:upgrade`	Checks your integration against the live OpenAPI spec and SDK releases: breaking changes, deprecated patterns, new features worth adopting

Docs: docs.beel.es/docs/claude-code

Bundled MCP: installing beel-api also connects the hosted BeeL MCP (https://mcp.beel.es/mcp, OAuth in the browser), so the same session gets live tools (create/issue invoices, manage NIFs…) and docs search alongside the skills. No API key needed.

`stripe`

Read-only auditor for Stripe integrations. Scans your codebase (and, optionally, your live Stripe account via the official Stripe MCP) and returns a structured report with finding → severity → evidence → fix for every issue.

Install (skip the first line if you've already added the marketplace):

/plugin marketplace add beel-es/claude-plugins
/plugin install stripe@beel

Run:

/stripe:audit              # full audit
/stripe:audit webhooks     # only webhooks
/stripe:audit payments     # only PaymentIntents / charges / refunds
/stripe:audit subscriptions
/stripe:audit secrets      # API keys + version pinning

The plugin will detect whether the Stripe MCP is connected and offer to install it for higher-confidence findings (live webhook endpoints, dashboard API version, recent failed events, real subscription state).

What gets audited

Each area can be run on its own. /stripe:audit (no scope) runs all of them.

Webhooks

/stripe:audit webhooks

The most common source of production incidents: forged events, double-fulfillment on retries, dropped deliveries.

Signature verification + raw-body parsing
Per-endpoint secret hygiene
Event-ID deduplication
Async processing (return 2xx fast)
Replay-window tolerance
HTTPS / method enforcement
Stripe Connect routing
PII in logs
Dead routes vs handlers (live, with MCP)

Payments

/stripe:audit payments

PaymentIntents, charges and refunds — idempotency, SCA, amount handling.

Idempotency keys on every write (paymentIntents.create, refunds.create, etc.)
Stable key shape (no Date.now() / randomUUID())
SCA / requires_action flow not dropped
Amount type bugs (floats, zero-decimal currencies)
Server-trusted amounts (the $0.01 for $100 attack)
Manual capture without a capture call
Refund async handling
PII in logs
Recent failed PIs cross-check (live, with MCP)

Subscriptions

/stripe:audit subscriptions

Proration, dunning and lifecycle — most subscription bugs only show up at month-end.

Explicit proration_behavior on plan changes
Idempotency / in-flight lock on plan changes
Dunning handlers for the four critical events (invoice.payment_failed, subscription.updated → past_due, subscription.deleted, invoice.payment_succeeded)
Trial logic uses Stripe state, not app state
Cancel flow respects cancel_at_period_end
Metered billing idempotency
automatic_tax requirements
Live past_due / unpaid cross-check (live, with MCP)

API version & secrets

/stripe:audit secrets

Version pinning and key hygiene — leaked keys, drift, missing pins.

API version pinned in code
Stale or drifting versions across services
Code vs dashboard version mismatch (live, with MCP)
Live keys in source and git history
Secret keys in client bundles
Restricted-key hygiene for server-to-server jobs
Webhook secret handling
Error logging captures requestId / code / type
Custom retry layers without idempotency forwarding

Output

A single Markdown report with:

A summary table of findings by severity (critical / high / medium / low / info).
An "Action required immediately" callout if any critical items exist.
One section per finding: file:line, the actual snippet (secrets redacted), why it matters in concrete terms, and the fix snippet.
A "What looked fine" section for areas that passed.
An optional, brief "Invoicing & compliance" section for Spanish projects.

Hard rules

The auditor is read-only. It will never edit code, call any Stripe write API (create_*, update_*, cancel_*, create_refund), or rotate keys — even if it finds a leaked one.

`compliance-es`

Audits a repo and generates, without a lawyer, the full legal-compliance documentation for a Spanish SaaS or company. Each conclusion cites the article of the law that backs it, contrasted against the official text (BOE / EUR-Lex / AEPD / AEAT). Multi-framework (packs), with versioned state in .compliance/.

Install (skip the first line if you've already added the marketplace):

/plugin marketplace add beel-es/claude-plugins
/plugin install compliance-es@beel

Run (inside the repo to audit):

/compliance-es

Frameworks covered

Pack	Norm	Status	Covers
`rgpd-lopdgdd`	RGPD + LOPDGDD	in force	consent, data-subject rights, RAT, DPA, security, breaches (72 h), international transfers, DPIA
`compliance-penal`	Art. 31 bis Criminal Code + Ley 2/2023	in force	organisation model, code of ethics, criminal-risk matrix, whistleblowing channel
`verifactu`	RD 1007/2023 (Veri*Factu)	corporate 1-Jan-2027 · others 1-Jul-2027	SIF conformity, responsible declaration, record retention

What it produces

A versioned .compliance/ state in the audited repo: state.json (posture per framework + per-control evidence), RESUMEN.md (prioritised gaps + diff vs the previous run), INSTRUCTIVO.md (runbooks: rights, breach, AEPD/tax inspection), and docs/ with every filled-in document. Each run is a commit.

Hard rules

Every legal statement cites norm + article + source; anything unverifiable is flagged [verificar contra fuente oficial]. It resolves the decisions (DPO? DPIA? transfer mechanism? VeriFactu obligation?) instead of leaving them open, and it never claims "guaranteed/certified compliance". When a project invoices, it offers to integrate a VeriFactu-compliant provider (the BeeL API) rather than re-implementing hash/QR/chaining by hand.

`spring-boot-multitenancy`

An agent-ready playbook for designing, implementing and auditing multitenancy in Spring Boot, Spring Security and PostgreSQL. It uses a fictional project-management domain and covers environment/account/company scope, API keys, session cookies, hierarchical permissions, fail-closed RLS, transaction and pool safety, async work, caches, token rotation and adversarial tests.

Install:

/plugin marketplace add beel-es/claude-plugins
/plugin install spring-boot-multitenancy@beel

Skill	What it does
`/spring-boot-multitenancy:design`	Inspects a repository and produces an implementation-ready architecture package
`/spring-boot-multitenancy:implement`	Executes the design in reversible vertical slices
`/spring-boot-multitenancy:audit`	Audits tenant isolation and authorization with concrete evidence

See the plugin README.

Auto-enable for your project

Add this to your project's .claude/settings.json to suggest the marketplace automatically when the project is opened:

{
  "extraKnownMarketplaces": {
    "beel": {
      "source": {
        "source": "github",
        "repo": "beel-es/claude-plugins"
      }
    }
  }
}

License

MIT

Name		Name	Last commit message	Last commit date
.claude-plugin		.claude-plugin
assets		assets
plugins		plugins
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md

Navigation Menu

Uh oh!

Repository files navigation

BeeL Claude Plugins

Contents

Install

Plugins

`beel-api`

`stripe`

What gets audited

Webhooks

Payments

Subscriptions

API version & secrets

Output

Hard rules

`compliance-es`

Frameworks covered

What it produces

Hard rules

`spring-boot-multitenancy`

Auto-enable for your project

License

About

Releases

Packages

Contributors

Languages

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

BeeL Claude Plugins

Contents

Install

Plugins

beel-api

stripe

What gets audited

Webhooks

Payments

Subscriptions

API version & secrets

Output

Hard rules

compliance-es

Frameworks covered

What it produces

Hard rules

spring-boot-multitenancy

Auto-enable for your project

License

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`beel-api`

`stripe`

`compliance-es`

`spring-boot-multitenancy`