Zeno

npx add-mcp 'https://app.zeno-works.ch/mcp'

Working through an AI assistant (MCP)

Point the AI assistant you already use at your Zeno books over MCP — how to connect it, what it can reach, and what it can never exceed.

---

The web app is not the only way into Zeno. If you already use an AI assistant — the desktop or command-line kind — you can point it at your books and describe what you want in your own words instead of clicking through screens. This chapter covers what the connection is, what an assistant can and cannot reach, how to set it up, and what it means for the safety of your books.

What MCP is

MCP is a published convention for letting an AI assistant use an outside system as a tool, and Zeno speaks it. Once the two are connected, your assistant can look things up in your books and carry out work in them, the same way it already uses the other tools you have given it. You need to learn nothing about the convention itself — only an assistant that supports it, one address, and one key.

What an assistant can reach

Zeno’s own web app has no private back door: every screen you use works by calling the Zeno interface, and the tools your assistant is offered are generated from that same interface when the connection starts. Neither surface is a hand-kept copy of the other, so the two do not drift apart, and an assistant reaches nearly everything the app does: reading and booking the books, bank reconciliation, open items, supplier and customer invoices, dunning, payroll, VAT periods, fixed assets and the year-end close.

A few things are deliberately kept off it, and they are worth naming rather than hiding:

• Some file uploads have no equivalent. Receipts attached to expense claims and to cash-register entries, the per-employee expense-receipt form, the logo on your invoice issuer profile, the payroll employee import file, a whole-configuration import and the ESTV Quellensteuer tariff file can only be uploaded in the app. Documents in general are fine — a supplier invoice, a receipt, a bank statement or last year’s annual accounts all go in through the same door as Documents → Inbox.
• Keys cannot manage keys. Creating, listing or revoking an API key needs a signed-in browser session. An assistant holding a key cannot mint another one, and that is deliberate.

One thing surprises people. Your assistant is shown a short list of everyday actions, not the whole of Zeno. Several hundred more are connected and callable but not on that list, and the assistant is told to search for an action by name before concluding anything is unsupported. Some forget. If yours ever tells you Zeno cannot do something you know it can, ask it to search for the action by name.

Why it is worth doing

The work Zeno models is queue-shaped, and a queue is what an assistant is good at. When documents arrive, anything the AI accountant was unsure about is held rather than booked, and clearing that queue in the app means opening items one at a time. An assistant can page through the whole of it and tell you what it accepted and what it left for you.

The kind of instruction this suits:

• “Go through last month’s supplier invoices and tell me which ones look wrong — wrong VAT rate, a supplier we have never paid before, an amount out of line with the last one.”
• “Everything the AI accountant held for approval this month: show me each one with the document, book the ones that are obviously right, and list the rest.”

A full-access key also covers every company you belong to, which suits a Treuhänder working across a book of clients without switching company for each one.

Be clear about what does not change. Your role governs an assistant exactly as it governs you at the screen: it can do what you can do in that company, and nothing more. What it does not pass through is Settings → Autonomy, which decides how much the AI accountant may book unattended from documents arriving in Zeno — not what an outside assistant may book. A booking an assistant makes is made when it makes it, so whether it checks with you first is your client’s habit and not a Zeno control. Nor does a whole backlog travel this way: documents move through the assistant one at a time, fine for a handful and hopeless for a year of paperwork. For a backlog, connect a mailbox or a folder under Settings → Integrations, or drop the files on Documents → Inbox, and let the assistant work the queue that produces.

Setting it up

Any MCP-capable client will do, as long as it can add an HTTP server and set a request header. A client that cannot set headers cannot send your key at all — see the last troubleshooting bullet.

Account settings → API keys: each key with its scope, its public prefix, when it was last used, and Revoke.

1. Open the user menu at the bottom of the sidebar → Account settings → API keys, and choose Create API key.
2. Give it a Name you will recognise later — name it after the assistant you are connecting.
3. Pick a Scope. The choices are Full access — all your companies, which “acts with your full account access across every company you belong to”, or one of your companies by name, which is “confined to this one company, with your role there”. Choose a single company unless you have a reason not to.
4. Set an Expiry if you want one. The default is never, and the screen’s own advice is worth taking: “Prefer an expiry for a key you paste into an AI agent or a third-party tool.”
5. Copy the secret now. It is shown once, immediately after creation, and never again. Zeno keeps only a hash of it.
6. In your assistant’s connection settings, add an HTTP server. The address is your ordinary Zeno web address with /mcp on the end. Send the key as a header named X-API-Key; clients that only offer a bearer token can put the key there instead.

Most clients take a server list in this shape:

{
  "mcpServers": {
    "zeno": {
      "type": "http",
      "url": "https://your-zeno-address/mcp",
      "headers": {
        "X-API-Key": "paste-your-key-here"
      }
    }
  }
}

Some installations also offer approval in the browser instead of a pasted key: you add the address with no credential, Zeno sends you to a page to approve, and the token reaches the client without ever appearing in the conversation. Whether that is switched on belongs to your Zeno installation rather than to the assistant, so ask whoever runs yours. Where it is off, the key is the way in.

Checking it worked

The key is checked only when the assistant actually does something, so a client reporting “connected” tells you nothing about whether it can act. Prove it by asking for something that needs your data: “list my companies” or “what is my liquidity?”. A correct answer means the address, the key and your access all line up.

Security and control

• A key never exceeds your own access. Zeno resolves it back to you, and every role and company gate applies exactly as it does in the browser. An assistant connected with a member’s key can read but cannot book — booking needs the accountant or owner role.
• A single company scope is a real boundary. A key confined to company A is refused on company B, even one you belong to. The screen offers no finer scope than these two, and scope only narrows your access, never widens it — a full-access key “can do everything your account can, across every company you belong to. Treat it like your password.”
• What it does is done for real. There is no sandbox, no test mode and no dry run. A booking your assistant makes is a booking in your books, under your name in the audit trail. Corrections are forward-booked reversals, as anywhere else in the general ledger.
• The work is marked as machine work. A booking made through this connection carries the origin MCP, which Accounting → Journal shows on the entry and filters on, so you can see afterwards which entries a machine decided.
• Revoking cuts it off at once. Use Revoke on the key’s row: “Any script using this key will immediately stop working. This cannot be undone.” Revoking stops future calls; it reverses nothing already booked. Keys cannot be recovered — make a new one.
• What Zeno stores. The public Prefix, so you can tell keys apart, and the secret only as a hash. Last used records when a request last authenticated with it. The connection keeps nothing between requests: your assistant sends the key each time.

Say it plainly to yourself before pasting a key anywhere: an assistant holding one can act in your books. Scope it to one company, give it an expiry, revoke it when the work is done.

How this relates to the AI accountant

The AI accountant is already inside the app and needs none of this. An outside client is a second way in.

The AI accountant you met in Getting started is already connected and needs no key. It is the narrower of the two by design: it reads document text that anyone can mail into your company, so its own reach is deliberately limited. An outside assistant, authenticated with a key you provisioned yourself, has wider write reach. Neither replaces the other, and Settings → Autonomy governs only the first of them — how much the AI accountant may book unattended. An outside assistant is held by your role instead. See Settings and integrations.

If something goes wrong

• A message about a missing API key. The client sent no key, or under a header name other than X-API-Key or a bearer token. Remember the connection succeeds without one; it is the first tool call that fails.
• “Not authorized”, or a refusal on one company but not another. Either the key is revoked or expired, or it is company-scoped and the assistant reached for a different company. Expired and revoked give different messages, because the remedies differ.
• A refusal that mentions your role. Booking, recording payments and accepting held work need the accountant or owner role in that company. The key cannot lift that.
• The client connects but offers no Zeno actions at all. It never reached the server — check the address ends in /mcp before you suspect the key.
• The assistant says a feature does not exist. Ask it to search for the action by name. The everyday list is short on purpose; most of Zeno is behind that search.
• Adding Zeno from a connector that cannot set headers does nothing. Some connectors authenticate only in the browser and cannot send a key at all. Use a client that lets you set a header, or an installation with browser approval switched on.