The agent is the interface

What an MCP server is

The Model Context Protocol is an open standard through which an AI agent calls tools. A program exposes its capabilities as named tools, the agent calls them, and it gets structured answers back. No screen scraping, no guessing at form fields.

The difference from a chat window inside accounting software is where the capability sits. A chat window is a feature in a product. An MCP server is the product, callable from outside, by whichever agent you choose.

In TILL the MCP server was not added afterwards. It is the interface the Studio itself speaks through. What you can do in the Studio, an agent can do too, and the other way round. There is no second, poorer path for machines.

Where Swiss accounting software stands

As of 28 October 2026

We found two Swiss accounting products that offer MCP themselves: Infinity says in its changelog (infinity.swiss/en/changelog) that it supports MCP natively, in every plan, and KLARA documents its own MCP server (mcp.klara.ch), where you approve writes in the browser. For bexio, Banana, CashCtrl and AbaNinja we found no official, vendor-maintained MCP server. These statements rest on what the vendors publish, read on the date above.

Community-built wrappers do exist, among others for Lexoffice, sevDesk, DATEV and bexio. They are real work and often useful. But they sit on top of the REST interface the vendor built for something else, and they can only pass through what that interface already offers.

This is not a complaint about those vendors. It is an observation about when a piece of software was built and what for. Anyone building a GUI in 2015 was not building tools for agents that did not exist.

A flat wrapper is not enough

As of 28 October 2026

QuickBooks' official MCP server, published by Intuit, lists 145 tools in its README. They follow the QuickBooks Online API: create, read, update, delete and search for 29 kinds of record, plus 11 reports.

An agent given one tool per record type has to work out the order of calls for an invoice and hold the state in between. In bookkeeping, a half-finished operation is precisely what nobody wants.

TILL cuts its tools along the operations a human would name anyway. One operation is one call, it applies whole or not at all, and it is idempotent: the same call twice does not post twice. The number of tools is not the point. The cut is the point.

What this means day to day

You tell your agent what happened and it records it. It reads the bank statement in camt.053 format, proposes the matching and posts it once you approve. It prepares the MWST return and shows you which entries every figure came from.

You keep the ledger itself, not just a log of it. Every entry an agent makes sits in the same file as your own, with the same provenance and the same audit trail.

And you keep control of the agent. TILL does not ship one. You connect the one you trust. For bookings, payments, granting access and deleting data for good, you decide area by area whether it may act on its own or has to ask first. The dial covers agents that connect to TILL. An agent that can drive your browser or run commands on your computer can act as you: give your agent TILL, not your browser or your shell.

The human stays in it

Agent first does not mean nobody looks any more. TILL ships the Studio, a GUI for exactly the moments a human has to decide: review, approve, correct, look at the closing.

By default, your agent waits for your OK before it books anything, moves your money, grants access or deletes your data for good. The agent drafts, and you approve in the Studio. Much of what you can change back, such as drafts and contact details, it does without asking. TILL records every call it makes.

A posted entry is never overwritten. A correction is a new entry beside the original, and both stay visible. That holds for you and for the agent, and it is why you can trust an entry a machine made at all.