Bookkeeping with Copilot

Which Copilot works, as of October 2026

Microsoft and GitHub ship several Copilots. Here is the state for each.

Before you start: key and organisation policy

• Create the key in the app under Buchhaltung → Einstellungen → “KI-Agent & API” (Bookkeeping → Settings). Administrators or the workspace creator can do this, confirmed with the second factor.
• Choose rights and expiry: read is always included; add write to book, send to email invoices, finalize to lock periods. Keys expire after 30, 90 or 365 days; up to ten per company, 120 requests per minute each.
• One key belongs to exactly one company — your GmbH, UG or other legal form. We store only its hash.
• On Copilot Business and Copilot Enterprise, the organisation policy “MCP servers in Copilot” must be switched on — it is off by default. Individual Copilot plans are not governed by it.
• Copilot Studio is subject to your Power Platform data policies; your administrator may need to allow the connection.

GitHub Copilot in VS Code

Save as .vscode/mcp.json in a workspace or in your user-level mcp.json.

The ${input:jab-key} placeholder makes VS Code prompt for the key once and keep it in secure storage. The file itself contains no secret.

VS Code may ask you to confirm each tool invocation. Keep that confirmation for write tools rather than allowing them permanently.

{
  "inputs": [
    {
      "type": "promptString",
      "id": "jab-key",
      "description": "jahresabschluss.io API key",
      "password": true
    }
  ],
  "servers": {
    "buchhaltung": {
      "type": "http",
      "url": "https://api.jahresabschluss.io/functions/v1/bookkeeping-mcp",
      "headers": { "Authorization": "Bearer ${input:jab-key}" }
    }
  }
}

GitHub Copilot in JetBrains IDEs, Xcode and Eclipse

The same server, with the header under requestInit.

Add the entry to Copilot's MCP configuration in your editor. Here the key is written into the file, so keep that file out of version control and give the key only the rights you need.

{
  "servers": {
    "buchhaltung": {
      "url": "https://api.jahresabschluss.io/functions/v1/bookkeeping-mcp",
      "requestInit": {
        "headers": { "Authorization": "Bearer jab_live_…" }
      }
    }
  }
}

Copilot Studio: key in the X-API-Key header

Tools → Add a tool → New tool → Model Context Protocol.

Copilot Studio lets you name the header, so X-API-Key is the simplest choice: users paste the key exactly as the app shows it, without “Bearer”. Our server accepts the key as X-API-Key as well as in the Authorization header. Copilot Studio connects over Streamable HTTP, which is what our server speaks.

Because every user of the agent brings their own key, one Copilot Studio agent can serve several people, each working in the company their key belongs to.

Server name:     buchhaltung
Server URL:      https://api.jahresabschluss.io/functions/v1/bookkeeping-mcp
Authentication:  API key
Type:            Header
Header name:     X-API-Key
Key:             entered by each user — jab_live_…

What to ask Copilot

Sentences in plain English, and the tools Copilot calls for them.

• “List the supplier invoices that are still unpaid and due this month.” → list_open_items
• “Create a customer Example GmbH in Hamburg with a payment term of two weeks — check first whether it already exists.” → list_business_partners, create_business_partner
• “Draft an invoice to Example GmbH for twelve hours of consulting at €120 net plus 19 % VAT, and show it to me before issuing.” → create_outgoing_invoice
• “Email that invoice as XRechnung to the customer's stored address.” → send_outgoing_invoice (needs the send right)
• “Book today's cash sale of €340 gross at 19 % VAT into the Kassenbuch (cash book).” → book_cash_entry

Guardrails and what stays in the app

• Copilot sees only the tools your key allows — the 31 read tools with a read-only key, up to 71 with every right.
• Before irreversible steps (issuing or emailing an invoice, cancelling one, deleting a receipt, locking a period) our server instructs the agent to state what will happen and wait for your explicit yes.
• GoBD (Germany's rules for proper digital bookkeeping) apply to every write: no deleting or overwriting, Storno reversals instead, debit equals credit, locked periods stay locked. Retries with the same idempotency_key never book twice.
• Receipt texts and bank references are data, never instructions. Balance-sheet companies need a receipt before a bank line books to income or expense.
• Stays in the app: bank OAuth, company settings, partners' IBAN and BIC, a first year's manual opening balance and every ELSTER filing, including the Umsatzsteuer-Voranmeldung (VAT return).
• Annual accounts and E-Bilanz are prepared in the app; publish_trial_balance hands the Saldenliste (trial balance) to that module.
• Our advice: confirm every write tool, and use a read-only key for reporting.

Frequently asked questions

Which Copilot can do my bookkeeping?

GitHub Copilot in VS Code, JetBrains IDEs, Xcode and Eclipse, and agents built in Copilot Studio. All of them can send our company key as a header. Microsoft 365 Copilot cannot today.

Why doesn't Microsoft 365 Copilot work?

Microsoft does not support API keys for MCP plugins in declarative agents. Its agent connectors take a single key registered by the publisher, which does not fit a key per company. Copilot Studio or GitHub Copilot are the working alternatives.

My organisation uses Copilot Business — what do I need?

An administrator has to switch on the policy “MCP servers in Copilot”, which is off by default for Copilot Business and Copilot Enterprise. After that, the configuration above works as described.

Does Copilot ask before it books?

VS Code may ask you to confirm each tool invocation. For Copilot Studio, Microsoft's setup page does not describe confirmations, so rely on the key's rights and our server's rule that irreversible steps need your explicit yes — and use a read-only key where booking isn't needed.

Can one Copilot Studio agent work for several companies?

Yes, in the sense that each user enters their own key. A key always belongs to one company, so each person works only in the company their key was created for.

What does the connection cost?

API and MCP server come at no extra charge with the bookkeeping subscription (Solo or Gesamtpaket) or the EÜR subscription. Copilot licences are separate.