DATEV MCP server

What is an MCP server for DATEV?

An MCP server for DATEV is a specialised bridge between an AI agent (Claude, GPT, Gemini, Microsoft Copilot) and your DATEV systems. It translates natural-language requests — “Show me the BWA (management accounts) for client Meyer GmbH for April” — into clean, authorised queries against DATEV interfaces such as DATEVconnect, the DATEV Unternehmen online API or REWE data structures.

At its core, MCP for DATEV delivers exactly what firms have been missing for years: standardised, secure tool access that does not have to be rebuilt with every model change. Anyone who has once understood what the Model Context Protocol is and how it works will immediately see: DATEV is one of the most rewarding areas of application, because highly structured data sits here in complex processes.

Important: a DATEV MCP server does not replace certified DATEV software. It adds an AI operating layer — with clear permission boundaries, logging and without client data falling into the wrong hands.

Is there an official DATEV MCP server? (as of October 2026)

No. So far DATEV has not published its own MCP server, nor any interface through which external AI models such as Claude or ChatGPT can be connected directly to DATEV. Neither the product page nor the description of DATEV’s own AI assistant mentions MCP or an opening for third-party models (DATEV shop, item no. 90431, retrieved on 19 October 2026).

What does exist are three routes from outside:

• Community projects, mostly based on EXTF export files. Good for trying things out, but usually without a permissions concept, audit log or warranty.
• Commercial gateways and feeders that encapsulate DATEVconnect or the online interfaces, often with a fixed tool scope.
• Your own MCP server on the existing DATEV interfaces, limited to your use cases and run on your EU infrastructure. That is what this page is about.

For the choice, the number of tools matters less than the question of who may see which client data and where it is processed.

DATEV Copilot or your own MCP server?

Since May 2026, the DATEV Copilot has been available in MyDATEV. According to DATEV, it drafts texts from bullet points, translates, summarises documents of up to 1,000 pages and works protected within the DATEV cloud. The basic licence is free of charge but has to be ordered. DATEV names one limit explicitly: “Structured data sets such as BWAs, tables or other reports cannot currently be analysed.” (DATEV: what the AI assistant can do today)

• DATEV Copilot fits if your team wants to produce texts, client information and document summaries faster and everything should stay within the DATEV world.
• An MCP server fits if an AI model of your choice should work with structured accounting data, connect processes beyond DATEV (CRM, email, document storage) or you want to define permissions, logging and hosting yourself.

The two are not mutually exclusive: the Copilot for texts, an MCP server for the cases where data from several systems comes together.

MCP server vs. classic DATEVconnect integration

Many firms ask: “We already have DATEVconnect online — why do we need an MCP server on top?” The difference is fundamental. DATEVconnect is a purely technical interface: REST endpoints, data in, data out. A developer can work with that — but an AI model cannot. Claude, GPT or Gemini do not know which endpoint to use when, which mandatory parameters a posting expects or which permissions a client’s secretarial staff have.

An MCP server is the semantic translation layer on top: it defines tools such as get_kontensalden(mandant_id, monat), list_offene_posten(mandant_id) or buchungsvorschlag(beleg_id) — each with a description, parameter schema and permission rule. The AI uses these tools the way an employee operates buttons in a user interface. The model cannot “make anything up”, but can only do what the MCP server allows.

In practice this means: anyone who connects DATEVconnect directly to an LLM builds themselves a black-box risk. Anyone who puts an MCP server in front builds audit security, role separation and the ability to swap the AI provider into a single layer.

The DATEV MCP architecture — how it works technically

Architecturally, the MCP server sits between your AI model and DATEV. Four layers, from top to bottom:

1. AI client — Claude Desktop, a custom firm chat front end, Microsoft Copilot or a webhook from an n8n workflow.
2. MCP transport — JSON-RPC over stdio (local) or Streamable HTTP (networked), which according to the MCP specification replaces the earlier HTTP+SSE transport. Encrypted, authenticated, rate-limited.
3. MCP server on EU hosting — your container on Hetzner, IONOS or in the Azure region Germany West Central (Frankfurt). Three sub-layers: auth (which user/role?), tool registry (which tools are approved?), audit log (what was called when and by whom?).
4. DATEV adapter — encapsulates DATEVconnect in the firm network, approved DATEV online APIs or EXTF exports. Credentials and tokens live here, never in the LLM context.

The red line beneath the MCP server is the client-confidentiality boundary: client data in plain text leaves this point only in authorised, logged and purpose-bound responses. That is the difference between an AI gimmick and a solution that can be defended under professional law.

Which DATEV interfaces an MCP server can use

The MCP server does not invent a new access route to DATEV. It uses the routes DATEV provides. Which one fits depends on your installation:

• DATEVconnect in the firm network: a local REST interface to the installed DATEV applications. It can only be reached within your own network, so the MCP server runs on a machine or server in that network or is securely connected to it.
• DATEV online APIs: cloud interfaces, for example for documents and posting data around DATEV Unternehmen online. According to the DATEV Developer Portal, the route there is fixed: register, create an organisation, create an app with credentials, subscribe to API products, develop in the sandbox, then book an appointment for the technical review and production release. Without this sign-off there is no production access.
• File-based exports and imports: EXTF/CSV batches from DATEV Rechnungswesen or towards DATEV. They need no certification but are not a real-time connection, rather regular handovers.

Which reports can be reached via which route, such as account balances, open items or BWA values, differs by module and interface. We check that in the AI Check before a single tool is built.

DATEV Unternehmen online and MCP

Many enquiries target DATEV Unternehmen online (DUO). There is no MCP server from DATEV for this either. Two directions are realistic: documents reach DUO through the approved online interfaces or import formats, and an MCP server can encapsulate this route for an AI model. Claude then checks a document, for example, suggests the assignment and hands it over after approval. Whether and which data comes back from DUO for reading depends on the respective interface and your approval, and belongs in the assessment before the project, not in a promise up front.

Code example: a DATEV MCP tool for account balances

This is what an MCP tool looks like in Python — the definition of a tool that Claude may use on its own. The address is deliberately a placeholder for your internal DATEV adapter, not a public DATEV endpoint: which interface sits behind it is decided by your installation.

from mcp.server.fastmcp import FastMCP
import httpx, os

mcp = FastMCP("datev-bridge")

# Platzhalter: interner Adapter vor DATEVconnect bzw. der
# freigegebenen DATEV-Schnittstelle, nur im Kanzleinetz erreichbar.
ADAPTER_URL = os.environ["DATEV_ADAPTER_URL"]

@mcp.tool()
def get_kontensalden(mandant_id: str, monat: str) -> dict:
    """Liefert die Kontensalden eines Mandanten für einen Monat,
    nur lesend und nur für freigegebene Mandanten.

    Args:
        mandant_id: DATEV-Mandantennummer.
        monat: Monat im Format YYYY-MM (z.B. "2026-09").

    Returns:
        Dict mit Konten, Salden und Vergleich Vormonat.
    """
    token = os.environ["DATEV_ADAPTER_TOKEN"]
    resp = httpx.get(
        f"{ADAPTER_URL}/mandanten/{mandant_id}/salden",
        params={"monat": monat},
        headers={"Authorization": f"Bearer {token}"},
        timeout=20,
    )
    resp.raise_for_status()
    return resp.json()

if __name__ == "__main__":
    mcp.run()  # startet den MCP-Server auf stdio

Three things are decisive here: the function is typed (Claude knows what goes in and out), it has a docstring (the model reads it like an instruction manual), and the credentials live in the environment, not in the prompt. This is exactly how we build production DATEV MCP servers — only with additional logging, rate limiting and a role check on every call.

Use cases: what can a DATEV MCP server do in practice?

In firms and tax departments, the same five or six use cases keep crystallising around DATEV — the typical levers that can be implemented with MCP. They are not spectacular, but they take over exactly the routine that comes back every month:

1. Automated explanations of management accounts (BWA) A client asks: “Why is my result worse in April than in March?” The AI agent fetches the monthly values from DATEV (BWA values or account balances, depending on the interface), compares accounts, identifies outliers and writes an understandable summary — including a note on seasonal effects or one-off postings.
2. Open-item analysis & dunning suggestions The MCP server reads open receivables, the agent prioritises by due date and client risk and suggests dunning levels. Final sending stays with a human — the agent only prepares.
3. Document recognition & pre-coding In combination with DATEV Unternehmen online: the AI agent checks uploaded documents, suggests the ledger account and cost centre, recognises reverse-charge cases and flags anomalies (such as a missing VAT ID).
4. Client communication Recurring questions (“Where do I find my latest VAT return?”, “What was my profit last year?”) are answered by the agent on the basis of the DATEV data — as a draft for the secretarial email or directly in the client portal.
5. Payroll queries Preparing LODAS data: personnel costs per cost centre, comparison with the previous month, notes on anomalies in hours or surcharge accounts. With strict access separation — only explicitly approved accounts.
6. Year-end closing preparation The agent runs through the ledger accounts, looks for typical sources of error (opening balances, out-of-period expenses, missing stocktake) and delivers a pre-check list before the tax advisor takes over.

How the integration works

Architecturally, the MCP server sits between your AI model and DATEV. It is not a cloud service from us — it runs in your EU infrastructure (Hetzner, IONOS, Azure region Germany West Central or your own in-house server):

AI agent (Claude/GPT/Gemini) ↔ MCP server (your EU host) ↔ DATEV interfaces (DATEVconnect, DATEV online APIs or exports)

The typical steps of an implementation:

• Interface audit: Which DATEV modules are in use? Does DATEV Unternehmen online exist? Is DATEVconnect already in use? Is there already an access in the DATEV Developer Portal?
• Permission concept: Which clients, ledger accounts and reports may the agent see? Which may it change? As a rule: read-only for standard queries, write permissions only under the four-eyes principle.
• Tool definitions: We build MCP tools such as get_kontensalden, list_open_invoices, fetch_account_movements — each with a clear input schema, so the model cannot misuse them “creatively”.
• Logging & audit trail: Every agent request and response is logged with timestamp, client ID and employee. You will need this at the latest at your next data protection audit.
• Onboarding the firm: A 60 to 90 minute training session for the team. Which questions work, which do not, how to escalate error cases.

Connecting Claude to DATEV: how it works

Claude cannot read DATEV on its own. The connection only comes about through the MCP server, which Claude knows as a connector. From your team’s point of view it looks like this:

1. Provide the MCP server: The server runs on your EU host or in the firm network and talks to the appropriate DATEV interface.
2. Register it in Claude as a connector: In Claude (Desktop, Team or Enterprise), the server is entered as a custom connector. On Team and Enterprise accounts, an administrator enables this for the organisation.
3. Sign in and check permissions: Each person signs in with their own access. The MCP server releases only the clients and tools that match their role.
4. Ask questions: “Which open items of client 10234 are older than 60 days?” Claude picks the right tool, the server fetches the data and logs the call.

The same works with ChatGPT, Gemini or Copilot, as long as they support MCP connectors. The MCP server stays the same, only the client changes.

GDPR, hosting & security

DATEV data is particularly sensitive — client data is subject to tax secrecy (Steuergeheimnis). That is why the following applies to every MCP server we build for DATEV:

• EU hosting mandatory. The MCP server runs in an EU data centre, usually at Hetzner or IONOS, alternatively in the Azure region Germany West Central (Frankfurt) or in the firm network — no “edge worker” with an unclear data route. If a US provider with an EU region is involved, for example for the AI model, we state this explicitly.
• Data processing agreement (DPA) with the AI provider (Anthropic Europe, Microsoft EU data residency, OpenAI Enterprise EU).
• Data does not leave the system unasked. The MCP server decides which fields end up in the prompt — client names in plain text can be pseudonymised if professional law requires it.
• Permissions follow the role. Secretarial staff see different tools than licensed professionals. Client portals see only their own client.
• Penetration test & code review before go-live, so the MCP server does not become a new attack surface.

If you want to go deeper into data protection questions, you will find a detailed treatment in our guide GDPR-compliant AI in the company.

Duty of confidentiality under § 203 StGB and professional law

Beyond the GDPR, a second, harder layer applies to tax advisory and audit firms: the criminally sanctioned duty of confidentiality under § 203(1) no. 3 StGB (German Criminal Code, professional secrecy). Anyone who discloses client secrets — even negligently — commits an offence. The decisive question is therefore not “Is AI allowed?” but “Who is the recipient of the data?”.

Since the 2017 reform (§ 203(3) and (4) StGB), holders of professional secrets may involve external service providers as “other contributing persons” if these are contractually bound to confidentiality. In practice, for AI use in a firm this means: the MCP server operator and the AI provider must conclude a corresponding confidentiality agreement with the firm. This agreement belongs in every project; we bring a template that your firm reviews.

For tax advisors, § 62a StBerG (German Tax Advisors Act) specifies this involvement: the service provider must be selected carefully, the contract needs text form and a confidentiality obligation with instruction on the criminal consequences, access to client secrets must be limited to what is necessary, and for services abroad comparable protection of secrecy must exist there (§ 62a StBerG). With the AI model in particular, this point decides whether a US provider with an EU region, an EU provider or a local model fits. This assessment is not legal advice.

Two additional hardening steps that make sense in practice: first, pseudonymisation before the LLM prompt — where possible, client names are replaced by tokens and only translated back after the response. Second, model selection in EU data residency — Anthropic Claude in the EU region, Microsoft Azure OpenAI in an EU region or local models via Ollama for highly sensitive engagements.

What does it cost?

A serious answer is: it depends on scope and modules. We give concrete prices after the initial conversation, as an individual quote. These levers keep the effort small:

• One use case first. We build iteratively: the most important use case first (often the open-items list or monthly report), then the second.
• Clear building blocks. Audit → MCP server setup → tool implementation per use case → training & operations. Each phase is offered separately.

We discuss the scope in the AI Check, depending on your number of clients, your DATEV modules and the desired use cases.

Application example: how a DATEV MCP project gets started

So that what we are talking about does not stay abstract, here is an anonymised sketch of the typical course in a firm using DATEV (realistic sketch, not a specific reference):

• Step 1 — Audit and interface inventory. Which DATEV modules are licensed? Which reports are retrieved daily? Where do recurring questions arise that an agent could answer? Result: a prioritised list of use cases.
• Step 2 — Architecture and permissions. EU hosting is set up, the connection to the chosen DATEV interface is tested, the role model is defined (licensed professional / secretarial staff / client portal).
• Step 3 — First tool in use. Mostly “open-items list” or “explain monthly report”. The agent first runs for a few employees, and every request is logged.
• Step 4 — Pilot review. What works, what does not, where is the AI too cautious or too bold? Adjustment of the tool descriptions, extension to the second use case.

After these steps it is clear whether the firm can work productively with MCP or whether adjustments are needed. Each expansion stage ends with a short demo in which you see what the agent can do now.

Frequently asked questions

Is there an official DATEV MCP server?

Not as of October 2026. With DATEV Copilot, DATEV offers its own AI assistant within the DATEV cloud, but describes no MCP server and no interface for external AI models such as Claude. Anyone who wants to connect Claude to DATEV builds their own MCP server on the existing DATEV interfaces or uses a third-party offering.

What is the difference between DATEV Copilot and an MCP server?

DATEV Copilot is DATEV’s assistant for texts, translations and document analysis within the DATEV cloud. According to DATEV, it cannot currently analyse structured data such as BWAs or tables. An MCP server gives a freely chosen AI model defined tools on your DATEV data, with permissions, logging and hosting to your specifications.

Can Claude be connected to DATEV Unternehmen online?

Not directly. Documents reach Unternehmen online via the approved online interfaces or import formats. An MCP server can encapsulate these routes for Claude, for example to check and hand over documents. Which data can be reached for reading depends on the interface and approval and is checked before the build.

Can a DATEV MCP server be operated in a GDPR-compliant way?

Yes, if the conditions are right: MCP server on EU hosting (Hetzner, IONOS or the Azure region Germany West Central in Frankfurt) or in the firm network, a DPA with the AI provider and a clear statement of where the model processes data, granular permissions per role and complete logging. For client data, the requirements from § 203 StGB and § 62a StBerG are added. We build MCP servers exclusively to these requirements.

Which DATEV interfaces does an MCP server use?

Depending on the environment: DATEVconnect in the firm network, the online APIs from the DATEV Developer Portal, or file-based exports such as EXTF/CSV. Online APIs require registration in the Developer Portal and a technical review by DATEV before production release.

Do I need a separate DATEV licence for the interface?

That depends on the route. File exports need no certification, DATEVconnect requires the matching local DATEV installation, and for the online APIs the route via the DATEV Developer Portal with a technical review is prescribed. Which licences are necessary in your case, we clarify in the audit before the project starts.

Can the AI agent post entries in DATEV?

Technically yes — but we recommend it only in tightly defined cases (such as posting suggestions with human confirmation). For most firms the added value is already in read access: reports, explanations, client communication.

Does this also work without cloud DATEV?

Yes. Even in classic DATEV installations, an MCP server can be connected to data exports or local interfaces. In the audit we analyse which route makes the most sense in your environment.

Which AI models can be connected?

All that support MCP — currently including Anthropic Claude, OpenAI ChatGPT, Google Gemini and Microsoft Copilot. You can switch the model at any time, and the MCP server stays the same.

Does using AI with client data violate § 203 StGB?

Not if the involvement meets the statutory requirements. Since 2017, holders of professional secrets may involve service providers as contributing persons (§ 203(3) and (4) StGB). For tax advisors, § 62a StBerG regulates the conditions: careful selection, a contract in text form with a confidentiality obligation, access only to the extent necessary and, for services abroad, comparable protection of secrecy. Whether a specific AI provider meets these requirements is checked by the firm case by case. Pseudonymisation, EU data residency or a local model reduce the risk further. This assessment is not legal advice.

What happens if the AI suggests a posting error — who is liable?

Postings run under the four-eyes principle by default: the agent proposes, an employee approves. Full automation only for clearly rule-based cases such as recurring rent payments. Professional responsibility stays with the licensed professional — the AI relieves routine work, it does not replace review.

What does ongoing operation cost?

Ongoing operation consists of hosting in EU data centres, AI token costs depending on usage intensity and, optionally, a maintenance contract. The amount depends on usage and scope and is offered individually.