ELSTER MCP server: can an AI agent file your tax return?

Type "ELSTER MCP" into Google and you get one repository, six stars, and a page of disclaimers. Type "WISO Steuer MCP" and you get nothing that answers the question. We watch both queries land on our site every month and bounce, because the pages they hit are about accounting software and the person searching wants something narrower: can I point an AI agent at the German tax office and have it file?

Short answer: everything up to the signature can be automated today, and the signature itself cannot be, by design. That is one line in a process with about a dozen steps, and the other eleven are where all the work actually is. We built our product on exactly that split, so the rest of this is what we learned putting it into production rather than a theory about what somebody could build.

Is there an ELSTER MCP server?

There is one public build, and it deserves credit for being honest about what it does. lukasschwarz/elster-mcp-server drives the ELSTER web portal with Puppeteer, using a real browser session and credentials you supply. Its own README says it takes "the same path a human user takes."

Its tool list shows where the seams are: fill a UStVA, run the portal's own Prüfen step, stop. A separate tool submits, only after you confirm, and the EÜR and income-tax tools never transmit at all.

That is not a shortcut someone took to save a weekend. It is the only door available to anyone who is not a registered filing vendor. There is no ELSTER endpoint to POST a return to, which is why the interesting question is not "who wrapped the portal" but "what can be connected to an agent legitimately, and by whom".

Why can't an MCP server just call ELSTER?

Because the interface is not a web API. It is ERiC, the ELSTER Rich Client: a native C library the tax administration hands to registered developers. You register as a software manufacturer, the Bavarian State Office for Taxes checks that you are really building tax software, you get a Hersteller-ID, and you link the library into your own process. It does validation, encryption and transport. The licence terms are restrictive enough that free-software projects have historically been unable to ship it.

Then there is the signature. A transmission is signed with a certificate belonging to a taxpayer, unlocked with a PIN. That is not an API key that happens to be sensitive. It is what makes a filing legally attributable to a person, and no protocol design makes it delegable to a model.

There is a timing irony here. The 2026-07-28 MCP specification turned the protocol into a stateless request/response core: no sessions, no handshakes, any request landing on any instance. ERiC is stateful, process-global, and expects to be initialised once and shut down once.

What running the certified path actually costs

We file German returns through ERiC in production, on the order of a thousand so far across UStVA, annual VAT, EÜR, income tax, trade tax and Zusammenfassende Meldung. Three things no protocol diagram shows.

The library owns the process, not the request. ERiC's initialise and shutdown calls are process-global. A reasonable-looking handler that builds a fresh binding per request works in development, then in production hits "already initialised" on a call that arrives while an earlier object is still waiting to be garbage collected. From that moment every declaration endpoint in the process fails until the container is recycled. The fix is not clever code, it is accepting that the request handler is a guest:

# what looks right and is not
def handle(request):
    eric = Eric(home_dir)        # process-global init, every time
    return eric.submit(payload)  # teardown depends on the GC

Designing an MCP server on top of this, that one fact reshapes the deployment: a single long-lived worker owns the library and everything else talks to it. That is a queue, not a request path.

The channel speaks in codes, not sentences. ELSTER rejects with identifiers like E6000026. To show a human "your tax number is missing" instead, we maintain a hand-written map from error code to form field: ninety-odd entries for the EÜR alone, on top of close to two hundred named ERiC error constants in our binding. Each was added because a real submission failed and somebody worked out what the number meant. An agent that surfaces the raw code has done nothing for the user.

The gate has to survive a rewrite. Our approval is bound to a hash of the exact figures a person saw, so a return edited after approval simply does not transmit. Design write-up: the agent that files your VAT return.

What can an AI agent actually do in a German tax filing?

That is a design brief, not a list of limitations. One row is closed and the other seven are open, and the seven are where the twenty minutes go.

This is the product we actually sell, so I will be direct about it rather than coy. Norman is a registered filing vendor: ERiC runs inside our infrastructure, our agent does the rows above the signature line, and our MCP server exposes that work to whatever assistant you already use, listed in the Claude connector directory and the ChatGPT plugin directory so connecting is a click rather than an integration project. The agent assembles the return, explains the plausibility errors in German, and puts one screen in front of you. You approve, and the transmission goes out through the certified path with your certificate. Nobody has to hand a browser robot their PIN.

So what should an ELSTER MCP server expose?

Not a file_my_taxes tool. The NSA's MCP security guidance from May 2026 puts it in less friendly language: align tools with data classification zones, and explicitly control and segregate the ones touching regulated information. A tool that can transmit a legal declaration belongs in its own zone, with a human standing in it.

Other jurisdictions reached a different answer. Avalara shipped a family of MCP servers in May 2026 that includes filing, because US sales tax typically runs through a service provider acting under delegated authority. Germany put the signature on the taxpayer instead. That is not backwardness, it is a decision about who is accountable when the number is wrong, and it produces a different protocol surface at every border. If you are shopping for a German tool on this basis, the question to ask is not whether it has an MCP server, it is whether the same company is also the one certified to transmit. A wrapper around someone else's API cannot close that loop.

Questions people ask

Is there an official ELSTER MCP server?

No. The tax administration publishes ERiC for registered software manufacturers and does not publish an MCP server, an OAuth-style API, or any agent-facing interface. The only public MCP server for ELSTER is a community project that automates the web portal in a browser. Treat anything advertising itself as "official ELSTER MCP" with suspicion, and check who maintains it before you hand it credentials.

Does WISO Steuer have an MCP server?

Not as of August 2026. Neither WISO nor most of the German tax and accounting stack publishes one, which is why the query returns alternatives pages rather than an answer. We covered which vendors do have one in MCP servers for accounting software. For filing specifically, the vendor's MCP server would not change the constraint: transmission still goes through certified software.

Can ChatGPT or Claude file my Umsatzsteuervoranmeldung?

Not on their own, because the submission is signed with your certificate through certified software. Connected to an accounting tool that is a registered filing vendor, they can do everything else: pull the transactions, categorise them, compute the return, run the plausibility check and explain what failed. That is what our MCP server is for. The agent builds it, you approve the exact figures, and the transmission goes out through the certified path.

Is it safe to give an AI agent my ELSTER certificate?

I would not. The certificate file plus its PIN is the ability to file in your name, and a browser-automation server needs both in plain form to log in. If you use one, use a throwaway environment, never a shared machine, and understand that portal automation can also get an account flagged. Scoped, revocable, per-session tokens are the reason first-party servers exist.

Is an MCP server for bookkeeping different from one for tax filing?

Yes, and the difference is reversibility. Bookkeeping tools mostly read, and their writes can be edited afterwards. A filing tool produces a legal act with a deadline attached. Same protocol, completely different risk profile, and the second deserves a human gate the first does not need. The practical version for companies is in what an MCP server means for a GmbH's tax work.

Where I think this lands

The interesting agentic tax products in Germany will not be the ones that find a clever way to push the button. They will be the ones that make the twenty minutes before the button worth almost nothing: data gathered, return computed, plausibility errors explained in German rather than as E6000026, one screen to check. That part is not a roadmap item, it ships today, and you can point your own assistant at it.

The signature staying human is not the bottleneck. It is the only part of this that was never the problem.