Zeno

ch.zeno-works/zenoVersion 0.1.0

AI bookkeeper for Swiss small companies: books invoices, reconciles the bank, keeps VAT current.

Status

Responds79 msNov 14, 2026, 13:42 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:42 UTC
Latency: 79 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://app.zeno-works.ch/mcpResponds79 msNov 14, 2026, 13:42 UTC

No sign-in

Claude Code

claude mcp add --transport http zeno https://app.zeno-works.ch/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: zeno
Remote MCP server URL: https://app.zeno-works.ch/mcp

Cursor

{
  "mcpServers": {
    "zeno": {
      "url": "https://app.zeno-works.ch/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"zeno","type":"http","url":"https://app.zeno-works.ch/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

50 tools

Tools of Zeno
	Description		Read-only	Idempotent	Open world
`accept_autopost_decision`One-click accept of a held decision (accountant) — posts the AI's proposal. A person's accept overrides the soft guardrails. An agent's is refused (403) unless the row is ``agent_acceptable`` or an expense receipt. Closed period, sealed year, unknown account: 409/422. The row flips ``held → posted`` (again: 409); ``accepted_by_kind`` records the channel (``mcp`` over MCP). Optional ``body``: ``expense:receipt:item:`` needs ``employee_id`` + ``category_id``; ``autopost:capitalize:`` needs ``fixed_asset_category_id`` when the hold has none, and ``needs_split_source`` a ``reclassify_from_account_code``.	One-click accept of a held decision (accountant) — posts the AI's proposal. A person's accept overrides the soft guardrails. An agent's is refused (403) unless the row is ``agent_acceptable`` or an expense receipt. Closed period, sealed year, unknown account: 409/422. The row flips ``held → posted`` (again: 409); ``accepted_by_kind`` records the channel (``mcp`` over MCP). Optional ``body``: ``expense:receipt:item:`` needs ``employee_id`` + ``category_id``; ``autopost:capitalize:`` needs ``fixed_asset_category_id`` when the hold has none, and ``needs_split_source`` a ``reclassify_from_account_code``.	Not declared	Not declared	Not declared	Not declared
`attach_cash_entry_receipt`Attach a receipt to a posted cash-book entry: a new file (``file_base64``, the raw bytes, base64) OR an existing document's ``item_id``, exactly one. ``override_duplicate`` only after a duplicate refusal you checked.	Attach a receipt to a posted cash-book entry: a new file (``file_base64``, the raw bytes, base64) OR an existing document's ``item_id``, exactly one. ``override_duplicate`` only after a duplicate refusal you checked.	Not declared	Not declared	Not declared	Not declared
`attach_claim_receipt`Attach a receipt to an expense-claim line: a new file (``file_base64``, the raw bytes, base64) OR an existing document's ``item_id``, exactly one; repeat that ``item_id`` as ``receipt_from_upload`` when ``ingest_expense_receipt`` returned it. ``override_duplicate`` only after a duplicate refusal you checked.	Attach a receipt to an expense-claim line: a new file (``file_base64``, the raw bytes, base64) OR an existing document's ``item_id``, exactly one; repeat that ``item_id`` as ``receipt_from_upload`` when ``ingest_expense_receipt`` returned it. ``override_duplicate`` only after a duplicate refusal you checked.	Not declared	Not declared	Not declared	Not declared
`call_operation`Run any operation by name — the ones in your tool list and the unlisted ones alike. ``name`` is an operation name from ``find_operations``; ``arguments`` is the object described by ``describe_operations`` (omit it for an operation that takes none). The result, and any error, are exactly what calling the operation directly would give you.	Run any operation by name — the ones in your tool list and the unlisted ones alike. ``name`` is an operation name from ``find_operations``; ``arguments`` is the object described by ``describe_operations`` (omit it for an operation that takes none). The result, and any error, are exactly what calling the operation directly would give you.	Not declared	Not declared	Not declared	Not declared
`collect_api_key`Collect the key once the user has approved. `status` is one of: - `pending` — nobody has approved yet, or (with `throttled: true`) we were rate-limited and learned nothing. Wait `poll_interval_seconds`, then call again — every answer carries it. Do not ask the user to tell you when they are done: you cannot detect it any other way, and handing the wait back to the user is how these sessions die. - `ready` — `api_key` is the credential. Follow the `note` that comes with it before anything else: the key does nothing until the client's configuration holds it, and calling again issues nothing. `scope` says what it can reach (`onboarding`, `company` or `full`) and `company_id` which company, if any. When `scope` is `onboarding` the user has no company yet and this key exists to make one: call `onboarding_guide` next — it needs no key, so read it while the user installs this one. It is the only place that says which documents to ask them for, and asking for them all at once is the difference between one conversation and seven. - `collected` — this request already issued its key and nothing new was issued. Follow the `note`. - `denied` — stop. Do not start another request; a human refused it ("that was not me"). Raising a second one is how a refusal turns into a prompt the user has to refuse repeatedly. - `expired` — the request timed out. Do not simply open another one, and what to do depends on which door you opened, which only you know. `request_api_key`: ask whether they saw the approval page, and call it again if they want to retry. `start_signup`: they may have finished registering in the browser meanwhile, in which case they now HAVE an account and `request_api_key` is the path — ask. If they did not, tell them plainly that it timed out; starting another signup without asking is how a refusal turns into a prompt they have to refuse repeatedly. A `pending` answer is a success, not an error; it is deli	Collect the key once the user has approved. `status` is one of: - `pending` — nobody has approved yet, or (with `throttled: true`) we were rate-limited and learned nothing. Wait `poll_interval_seconds`, then call again — every answer carries it. Do not ask the user to tell you when they are done: you cannot detect it any other way, and handing the wait back to the user is how these sessions die. - `ready` — `api_key` is the credential. Follow the `note` that comes with it before anything else: the key does nothing until the client's configuration holds it, and calling again issues nothing. `scope` says what it can reach (`onboarding`, `company` or `full`) and `company_id` which company, if any. When `scope` is `onboarding` the user has no company yet and this key exists to make one: call `onboarding_guide` next — it needs no key, so read it while the user installs this one. It is the only place that says which documents to ask them for, and asking for them all at once is the difference between one conversation and seven. - `collected` — this request already issued its key and nothing new was issued. Follow the `note`. - `denied` — stop. Do not start another request; a human refused it ("that was not me"). Raising a second one is how a refusal turns into a prompt the user has to refuse repeatedly. - `expired` — the request timed out. Do not simply open another one, and what to do depends on which door you opened, which only you know. `request_api_key`: ask whether they saw the approval page, and call it again if they want to retry. `start_signup`: they may have finished registering in the browser meanwhile, in which case they now HAVE an account and `request_api_key` is the path — ask. If they did not, tell them plainly that it timed out; starting another signup without asking is how a refusal turns into a prompt they have to refuse repeatedly. A `pending` answer is a success, not an error; it is deli	Not declared	Not declared	Not declared	Not declared
`create_gl_journal_entry`Create a draft journal entry by hand — accountant. It carries NO source document unless you name one. Only the pipeline paths stamp ``source_ref_type``/``source_ref_id`` (an ingested document is ``'item'``), so by default a booking made here cannot be traced back to what justified it. ``document_id`` is the retrofit: name an existing ``gl_document`` (create one with ``POST …/gl/documents``) and it is attached as the entry's source document, so the entry is not evidence-less. The same attach is available afterwards at ``POST …/gl/journal-entries/{id}/documents`` — including on a posted entry. Use it for bookings with genuinely no document behind them — reclassifications, provisions, accruals, year-end adjustments. Do not transcribe a document into it and then attach the file — that files the evidence beside a booking nobody derived from it. Each of these has a door that keeps the evidence attached: - an invoice, receipt or statement → ingest the file (``POST …/uploads/`` or ``…/intake``), then accept what the coder proposes (``…/autopost-decisions``); - an already-ingested item → ``POST …/gl/items/{item_id}/coding``; - a bank movement with no document → ``POST /bank-entries/{entry_id}/manual-coding``; - opening balances → ``POST …/opening-entries`` and post the proposal. ``auto_reverse_date`` arms the entry as a one-shot accrual (ZCT-527): once posted, the auto-reversal executor reverses it in full on/after that date. It must be after ``posting_date`` (422 otherwise), and it can only be set while the entry is a draft — on the create here or on the ``PUT`` replace. Drafts do not touch the books until ``…/post``. See ``doc/pipeline.md §"Accounting"``.	Create a draft journal entry by hand — accountant. It carries NO source document unless you name one. Only the pipeline paths stamp ``source_ref_type``/``source_ref_id`` (an ingested document is ``'item'``), so by default a booking made here cannot be traced back to what justified it. ``document_id`` is the retrofit: name an existing ``gl_document`` (create one with ``POST …/gl/documents``) and it is attached as the entry's source document, so the entry is not evidence-less. The same attach is available afterwards at ``POST …/gl/journal-entries/{id}/documents`` — including on a posted entry. Use it for bookings with genuinely no document behind them — reclassifications, provisions, accruals, year-end adjustments. Do not transcribe a document into it and then attach the file — that files the evidence beside a booking nobody derived from it. Each of these has a door that keeps the evidence attached: - an invoice, receipt or statement → ingest the file (``POST …/uploads/`` or ``…/intake``), then accept what the coder proposes (``…/autopost-decisions``); - an already-ingested item → ``POST …/gl/items/{item_id}/coding``; - a bank movement with no document → ``POST /bank-entries/{entry_id}/manual-coding``; - opening balances → ``POST …/opening-entries`` and post the proposal. ``auto_reverse_date`` arms the entry as a one-shot accrual (ZCT-527): once posted, the auto-reversal executor reverses it in full on/after that date. It must be after ``posting_date`` (422 otherwise), and it can only be set while the entry is a draft — on the create here or on the ``PUT`` replace. Drafts do not touch the books until ``…/post``. See ``doc/pipeline.md §"Accounting"``.	Not declared	Not declared	Not declared	Not declared
`customer_statement`One customer's open items + totals (the aging row's drill-down). ``as_of`` mirrors ``GET …/ar/aging`` — set, it reconstructs the items open at that date so the statement agrees with a historical aging report.	One customer's open items + totals (the aging row's drill-down). ``as_of`` mirrors ``GET …/ar/aging`` — set, it reconstructs the items open at that date so the statement agrees with a historical aging report.	Not declared	Not declared	Not declared	Not declared
`describe_operations`Get the full argument schema for operations found via ``find_operations``. Returns each operation's description and JSON-Schema arguments — everything a listed tool would have shown you. ``include_output_schema`` is the ONLY way to obtain an operation's result shape: ``tools/list`` publishes no output schema for any operation, listed or not (they are 67 % of the payload, and a schema describing a result is not what you need to choose a tool). Ask for it when you must know the shape in advance; the result itself comes back as JSON either way, so usually you do not. Up to 10 operations per call; anything beyond that is reported in ``omitted`` rather than dropped.	Get the full argument schema for operations found via ``find_operations``. Returns each operation's description and JSON-Schema arguments — everything a listed tool would have shown you. ``include_output_schema`` is the ONLY way to obtain an operation's result shape: ``tools/list`` publishes no output schema for any operation, listed or not (they are 67 % of the payload, and a schema describing a result is not what you need to choose a tool). Ask for it when you must know the shape in advance; the result itself comes back as JSON either way, so usually you do not. Up to 10 operations per call; anything beyond that is reported in ``omitted`` rather than dropped.	Not declared	Not declared	Not declared	Not declared
`entry_candidates`Entry Candidates	Entry Candidates	Not declared	Not declared	Not declared	Not declared
`find_operations`Search EVERY operation this server offers, including the ones not in your tool list. The tool list you can see holds only the common operations. Several hundred more — payroll, VAT returns, year-end close, fixed assets, expenses, cash book, settings, integrations, onboarding — are available but unlisted, and this is how you find them. Search here before concluding that Zeno cannot do something. Call with no arguments to browse the catalogue of areas (tags) with their operation counts; with ``tag`` to list one area; with ``query`` to search by keyword. Every word contributes and matching all of them doubles the score, so extra words widen the search rather than narrowing it — the AND-then-fall-back- to-OR behaviour this said before was removed in `ef47aa9ab`. A word matching an operation's name counts for far more than one found in its description, so prefer the noun you are looking for over a sentence. ``limit`` is capped at 100 per call; when more matched, ``next_offset`` gives the ``offset`` that returns the following page, so an area of any size can be read in full. Paging is stable — the ranking is deterministic and the registry is fixed at startup, so no operation is dropped or repeated between pages. Pass a promising ``name`` to ``describe_operations`` for its arguments, then run it with ``call_operation``.	Search EVERY operation this server offers, including the ones not in your tool list. The tool list you can see holds only the common operations. Several hundred more — payroll, VAT returns, year-end close, fixed assets, expenses, cash book, settings, integrations, onboarding — are available but unlisted, and this is how you find them. Search here before concluding that Zeno cannot do something. Call with no arguments to browse the catalogue of areas (tags) with their operation counts; with ``tag`` to list one area; with ``query`` to search by keyword. Every word contributes and matching all of them doubles the score, so extra words widen the search rather than narrowing it — the AND-then-fall-back- to-OR behaviour this said before was removed in `ef47aa9ab`. A word matching an operation's name counts for far more than one found in its description, so prefer the noun you are looking for over a sentence. ``limit`` is capped at 100 per call; when more matched, ``next_offset`` gives the ``offset`` that returns the following page, so an area of any size can be read in full. Paging is stable — the ranking is deterministic and the registry is fixed at startup, so no operation is dropped or repeated between pages. Pass a promising ``name`` to ``describe_operations`` for its arguments, then run it with ``call_operation``.	Not declared	Not declared	Not declared	Not declared
`get_ar_invoice`One authored outgoing invoice with its lines (CompanyMember read). Carries the header (customer, dates, currency, discounts), every line with its computed ``net_amount``/``vat_amount``/``gross_amount``, the document totals, and the lifecycle: ``status`` (``draft`` → ``issued`` → ``cancelled``), ``document_no`` (assigned at issue — ``null`` on a draft), ``commercial_document_id`` / ``snapshot_document_id`` (the booked document and the frozen PDF), plus the derived ``payment_status`` and ``open_amount`` read from the linked open item. This is the authored arm only. A receivable that arrived as an ingested document is an ``item``, not an ``ar_invoice``; the two arms are listed together by ``GET …/ar/receivables``. Use ``GET …/ar/invoices/{invoice_id}/related`` for the journal entry, the settling bank transactions and the credit-note chain.	One authored outgoing invoice with its lines (CompanyMember read). Carries the header (customer, dates, currency, discounts), every line with its computed ``net_amount``/``vat_amount``/``gross_amount``, the document totals, and the lifecycle: ``status`` (``draft`` → ``issued`` → ``cancelled``), ``document_no`` (assigned at issue — ``null`` on a draft), ``commercial_document_id`` / ``snapshot_document_id`` (the booked document and the frozen PDF), plus the derived ``payment_status`` and ``open_amount`` read from the linked open item. This is the authored arm only. A receivable that arrived as an ingested document is an ``item``, not an ``ar_invoice``; the two arms are listed together by ``GET …/ar/receivables``. Use ``GET …/ar/invoices/{invoice_id}/related`` for the journal entry, the settling bank transactions and the credit-note chain.	Not declared	Not declared	Not declared	Not declared
`get_bank_entry`Get Bank Entry	Get Bank Entry	Not declared	Not declared	Not declared	Not declared
`get_bank_status`Composed bank snapshot — "is my banking up to date?" (CompanyMember). "Reconciled" means entries matched, NOT ledger = statement balance (the close check ``BANK_BALANCE_DOES_NOT_TIE_OUT`` compares that). Per-account entry-status and ``in_suspense`` counts, each account's latest closing balance, and the company-level cumulative GL Suspense balance. Non-zero suspense blocks a clean VAT close. Read-only. Gaps come from the account's full history: coverage windows are merged and every internal hole reported (ZCT-509), so a run of missing statements is ONE gap. Not period-scoped; use ``…/reconciliation/completeness`` per month. ``period_gaps`` caps at 10/account, ``period_gap_count`` stays exact — HOLES, not missing months. Explicit non-member ``company_id`` → 403.	Composed bank snapshot — "is my banking up to date?" (CompanyMember). "Reconciled" means entries matched, NOT ledger = statement balance (the close check ``BANK_BALANCE_DOES_NOT_TIE_OUT`` compares that). Per-account entry-status and ``in_suspense`` counts, each account's latest closing balance, and the company-level cumulative GL Suspense balance. Non-zero suspense blocks a clean VAT close. Read-only. Gaps come from the account's full history: coverage windows are merged and every internal hole reported (ZCT-509), so a run of missing statements is ONE gap. Not period-scoped; use ``…/reconciliation/completeness`` per month. ``period_gaps`` caps at 10/account, ``period_gap_count`` stays exact — HOLES, not missing months. Explicit non-member ``company_id`` → 403.	Not declared	Not declared	Not declared	Not declared
`get_company`Get one company (jwt, scoped). 403 for a non-member non-admin, 404 if absent.	Get one company (jwt, scoped). 403 for a non-member non-admin, 404 if absent.	Not declared	Not declared	Not declared	Not declared
`get_financial_statements`Computed balance sheet + P&L for a fiscal year, from the journal (CompanyMember). Aggregates every posted GL journal line whose posting date falls in the fiscal year's window, classifies each account against the chart of accounts, and reports problems (unbalanced trial balance, unclassified accounts, year-not-opened, mixed currency). Read-only and distinct from the uploaded balance-sheet snapshots (``GET .../balance-sheets``): nothing here reads a snapshot. ``fiscal_year`` optional → the latest FY with journal data. ``month`` (``YYYY-MM``, inside the FY — 422 otherwise) narrows the statement to one month: the balance sheet stays cumulative (as of month end, YTD equity fold) while the P&L + cash flow cover that month's flows. Explicit non-member ``company_id`` → 403. The cut: ``posting_date`` inside the fiscal year's own window (``fiscal_year_cut``; ``period_start``..``period_end`` is what was aggregated, ZET-166). ``/gl/reports/*`` cuts by the line's stamped ``fiscal_year_id``, so the two can differ on a line dated outside the year it is stamped to.	Computed balance sheet + P&L for a fiscal year, from the journal (CompanyMember). Aggregates every posted GL journal line whose posting date falls in the fiscal year's window, classifies each account against the chart of accounts, and reports problems (unbalanced trial balance, unclassified accounts, year-not-opened, mixed currency). Read-only and distinct from the uploaded balance-sheet snapshots (``GET .../balance-sheets``): nothing here reads a snapshot. ``fiscal_year`` optional → the latest FY with journal data. ``month`` (``YYYY-MM``, inside the FY — 422 otherwise) narrows the statement to one month: the balance sheet stays cumulative (as of month end, YTD equity fold) while the P&L + cash flow cover that month's flows. Explicit non-member ``company_id`` → 403. The cut: ``posting_date`` inside the fiscal year's own window (``fiscal_year_cut``; ``period_start``..``period_end`` is what was aggregated, ZET-166). ``/gl/reports/*`` cuts by the line's stamped ``fiscal_year_id``, so the two can differ on a line dated outside the year it is stamped to.	Not declared	Not declared	Not declared	Not declared
`get_gl_account_ledger`One account's ledger (Kontoauszug) — every booking that touched it, in date order, with Soll/Haben and the running balance after each line (CompanyMember). No fiscal-year parameter: the chart is FY-owned, so ``account_id`` already fixes the year. Posted and reversed entries are included (a reversal is a second posted entry, so both legs must show or the balance is wrong); drafts are not. The running balance is carried across pages by the server — ``page_opening_balance`` enters this page's first row, while ``closing_balance``/``total_debit``/``total_credit`` describe the whole window. 404 when the account is not this company's; 422 when ``date_from`` is later than ``date_to``.	One account's ledger (Kontoauszug) — every booking that touched it, in date order, with Soll/Haben and the running balance after each line (CompanyMember). No fiscal-year parameter: the chart is FY-owned, so ``account_id`` already fixes the year. Posted and reversed entries are included (a reversal is a second posted entry, so both legs must show or the balance is wrong); drafts are not. The running balance is carried across pages by the server — ``page_opening_balance`` enters this page's first row, while ``closing_balance``/``total_debit``/``total_credit`` describe the whole window. 404 when the account is not this company's; 422 when ``date_from`` is later than ``date_to``.	Not declared	Not declared	Not declared	Not declared
`get_gl_journal_entry`One entry + lines, plus the subledger rows it produced/touched (Gap B detail surfacing): its ``gl_vat_posting`` rows, its ``gl_vat_zero_posting`` turnover-only declarations (zero-rated/exempt output — R2-13b: these have no VAT line to pair, so without them a correctly coded 0 % line is indistinguishable from an untagged one) and referenced ``gl_open_item`` rows. A declared base line also carries the resolved code on ``lines[].vat_code``. Drafts carry empty lists. ``documents`` carries the accounting documents explicitly attached to the entry (``POST …/documents``) — the evidence for a hand-booked entry; a pipeline-created entry carries its document through ``source_ref_*`` instead and lists nothing here. Member read, like the rest of the detail.	One entry + lines, plus the subledger rows it produced/touched (Gap B detail surfacing): its ``gl_vat_posting`` rows, its ``gl_vat_zero_posting`` turnover-only declarations (zero-rated/exempt output — R2-13b: these have no VAT line to pair, so without them a correctly coded 0 % line is indistinguishable from an untagged one) and referenced ``gl_open_item`` rows. A declared base line also carries the resolved code on ``lines[].vat_code``. Drafts carry empty lists. ``documents`` carries the accounting documents explicitly attached to the entry (``POST …/documents``) — the evidence for a hand-booked entry; a pipeline-created entry carries its document through ``source_ref_*`` instead and lists nothing here. Member read, like the rest of the detail.	Not declared	Not declared	Not declared	Not declared
`get_intake`Get one intake row by id (scoped to its company: 404/403 split).	Get one intake row by id (scoped to its company: 404/403 split).	Not declared	Not declared	Not declared	Not declared
`get_item`Item metadata (any source).	Item metadata (any source).	Not declared	Not declared	Not declared	Not declared
`get_work_list`Everything waiting for this user in this company, most severe first.	Everything waiting for this user in this company, most severe first.	Not declared	Not declared	Not declared	Not declared
`gl_trial_balance`Per-account debit/credit columns for one fiscal year, with totals. ``fiscal_year`` (year label) defaults to the latest year posted in; ``period_id`` narrows to one period of it. No all-years mode — account identity is ``(company, fiscal year, code)``, so aggregating double-counts silently (ZET-155). Unknown year/period → 404; period outside the year → 422. Cut by the line's stamped ``fiscal_year_id``, not its posting date; ``…/financial-statements`` cuts by posting date inside the same year's stored window, so the two differ only on a line dated outside the year it is stamped to. ``fiscal_year_cut`` names the cut (ZET-166).	Per-account debit/credit columns for one fiscal year, with totals. ``fiscal_year`` (year label) defaults to the latest year posted in; ``period_id`` narrows to one period of it. No all-years mode — account identity is ``(company, fiscal year, code)``, so aggregating double-counts silently (ZET-155). Unknown year/period → 404; period outside the year → 422. Cut by the line's stamped ``fiscal_year_id``, not its posting date; ``…/financial-statements`` cuts by posting date inside the same year's stored window, so the two differ only on a line dated outside the year it is stamped to. ``fiscal_year_cut`` names the cut (ZET-166).	Not declared	Not declared	Not declared	Not declared
`global_search`Full-text search across emails + items, ranked by ``ts_rank_cd``, scoped (A1). ``archive_status`` constrains item results only (the Documents → Archive page passes ``archived`` so its search box never surfaces pending/triage-parked items).	Full-text search across emails + items, ranked by ``ts_rank_cd``, scoped (A1). ``archive_status`` constrains item results only (the Documents → Archive page passes ``archived`` so its search box never surfaces pending/triage-parked items).	Not declared	Not declared	Not declared	Not declared
`import_payroll_employees`Import employees from the filled-in template (``get_payroll_employee_import_template``, .xlsx/.csv). All or nothing; existing ``employee_no`` rows are skipped. ``dry_run`` only reports. ``file_base64`` is the file's raw bytes, base64.	Import employees from the filled-in template (``get_payroll_employee_import_template``, .xlsx/.csv). All or nothing; existing ``employee_no`` rows are skipped. ``dry_run`` only reports. ``file_base64`` is the file's raw bytes, base64.	Not declared	Not declared	Not declared	Not declared
`ingest_expense_receipt`Upload ONE expense receipt to put on a claim: it is held from automatic booking; poll ``get_expense_receipt``, then attach its ``item_id`` with ``attach_claim_receipt``. ``file_base64`` is the file's raw bytes, base64.	Upload ONE expense receipt to put on a claim: it is held from automatic booking; poll ``get_expense_receipt``, then attach its ``item_id`` with ``attach_claim_receipt``. ``file_base64`` is the file's raw bytes, base64.	Not declared	Not declared	Not declared	Not declared
`list_ar_invoices`List authored AR invoices, newest first. Optional ``status`` / ``doc_type`` filter by lifecycle + document kind. Optional ``period`` (``YYYY-MM``) filters by the invoice's issue date (its month); a malformed value returns 422 ``{"msg": "period must be YYYY-MM"}``.	List authored AR invoices, newest first. Optional ``status`` / ``doc_type`` filter by lifecycle + document kind. Optional ``period`` (``YYYY-MM``) filters by the invoice's issue date (its month); a malformed value returns 422 ``{"msg": "period must be YYYY-MM"}``.	Not declared	Not declared	Not declared	Not declared
`list_autopost_decisions`Recent AI-accountant autonomy decisions (CompanyMember) — the activity feed. Shows what the autonomy policy posted (``posted``), would have posted in ``assist`` shadow mode (``shadow``), or held for human review (``held``). ``ai_no_match`` shadow rows (one per AI-consulted bank entry with no verdict) are feed noise and hidden by default; ``include_no_match=true`` surfaces them for audit. ``outcome`` / ``source_ref_id`` narrow server-side (ZET-75). Newest first, ordered ``(created_at DESC, id DESC)``. ``limit`` caps at 200 and ``offset`` walks the rest (R2-21): page with ``offset += limit`` until a call returns fewer than ``limit`` rows. The response is a bare list. ``cause`` keeps the held rows of one hold cause. An agent may accept only rows with ``agent_acceptable`` true. ``date_from`` / ``date_to`` keep rows whose ``effect_date`` (the date it affects the books) is in the period.	Recent AI-accountant autonomy decisions (CompanyMember) — the activity feed. Shows what the autonomy policy posted (``posted``), would have posted in ``assist`` shadow mode (``shadow``), or held for human review (``held``). ``ai_no_match`` shadow rows (one per AI-consulted bank entry with no verdict) are feed noise and hidden by default; ``include_no_match=true`` surfaces them for audit. ``outcome`` / ``source_ref_id`` narrow server-side (ZET-75). Newest first, ordered ``(created_at DESC, id DESC)``. ``limit`` caps at 200 and ``offset`` walks the rest (R2-21): page with ``offset += limit`` until a call returns fewer than ``limit`` rows. The response is a bare list. ``cause`` keeps the held rows of one hold cause. An agent may accept only rows with ``agent_acceptable`` true. ``date_from`` / ``date_to`` keep rows whose ``effect_date`` (the date it affects the books) is in the period.	Not declared	Not declared	Not declared	Not declared
`list_bank_accounts`The company's bank accounts — the ``bank_account_id`` every statement import, bank-entry list and reconciliation call needs (CompanyMember read). Oldest first, no filter and no paging. Each row carries the ``iban``, ``currency``, ``label``/``bank_name`` and ``ledger_account_number`` — the chart code this account posts through; without one a bank movement cannot be coded, and it is set with ``PUT /bank-accounts/{account_id}``. ``auto_created`` marks an account inferred from an imported statement rather than declared by a human; it starts ``ownership_status`` unconfirmed with ``needs_ownership_review: true`` — confirm it before trusting its balances, since an unconfirmed IBAN may not be the company's at all. ``statement_count`` / ``entry_count`` are ``null`` here (filled by the single-account ``GET /bank-accounts/{account_id}``), which is not the same as zero.	The company's bank accounts — the ``bank_account_id`` every statement import, bank-entry list and reconciliation call needs (CompanyMember read). Oldest first, no filter and no paging. Each row carries the ``iban``, ``currency``, ``label``/``bank_name`` and ``ledger_account_number`` — the chart code this account posts through; without one a bank movement cannot be coded, and it is set with ``PUT /bank-accounts/{account_id}``. ``auto_created`` marks an account inferred from an imported statement rather than declared by a human; it starts ``ownership_status`` unconfirmed with ``needs_ownership_review: true`` — confirm it before trusting its balances, since an unconfirmed IBAN may not be the company's at all. ``statement_count`` / ``entry_count`` are ``null`` here (filled by the single-account ``GET /bank-accounts/{account_id}``), which is not the same as zero.	Not declared	Not declared	Not declared	Not declared
`list_bank_entries`List Bank Entries	List Bank Entries	Not declared	Not declared	Not declared	Not declared
`list_companies`List companies (jwt, scoped). Non-admins see only their member companies.	List companies (jwt, scoped). Non-admins see only their member companies.	Not declared	Not declared	Not declared	Not declared
`list_counterparties`List a company's counterparties (filter by ``kind``/``q``, paginated). ``kind`` repeats to filter on a set (``?kind=customer&kind=both``) — a role-shaped picker asks for every kind that plays the role. A single ``?kind=supplier`` keeps its original meaning.	List a company's counterparties (filter by ``kind``/``q``, paginated). ``kind`` repeats to filter on a set (``?kind=customer&kind=both``) — a role-shaped picker asks for every kind that plays the role. A single ``?kind=supplier`` keeps its original meaning.	Not declared	Not declared	Not declared	Not declared
`list_gl_accounts`List the postable chart (CompanyMember). ``fiscal_year`` filters to one year's chart (the chart is FY-scoped, so codes repeat across years).	List the postable chart (CompanyMember). ``fiscal_year`` filters to one year's chart (the chart is FY-scoped, so codes repeat across years).	Not declared	Not declared	Not declared	Not declared
`list_gl_journal_entries`List journal entries. ``period_ids`` narrows to specific fiscal periods, and is how a caller asks for one fiscal year: the year's period ids (ZET-285). Without it the route lists every fiscal year. ``total`` is the filtered total. ``untagged_subledger_control=true`` narrows to the entries that posted to an AR/AP control account without touching the subledger, under ``allow_untagged_control`` (ZET-150) — the postings a subledger-vs-control divergence traces back to. ``origin``: one entry origin (ZEN-42). ``account_id``: entries with a line on it; ``date_from``/``date_to``: posting date; ``amount_min``/``amount_max``: the entry total.	List journal entries. ``period_ids`` narrows to specific fiscal periods, and is how a caller asks for one fiscal year: the year's period ids (ZET-285). Without it the route lists every fiscal year. ``total`` is the filtered total. ``untagged_subledger_control=true`` narrows to the entries that posted to an AR/AP control account without touching the subledger, under ``allow_untagged_control`` (ZET-150) — the postings a subledger-vs-control divergence traces back to. ``origin``: one entry origin (ZEN-42). ``account_id``: entries with a line on it; ``date_from``/``date_to``: posting date; ``amount_min``/``amount_max``: the entry total.	Not declared	Not declared	Not declared	Not declared
`list_gl_open_items`One page of the AR/AP subledger (member read). ``direction`` filters server-side (ZCT-577) — omit it for both. ``commercial_document_id`` narrows to one document's item (D09-G13); not with ``as_of``. ``as_of`` (ZCT-577) reconstructs each item's open amount from posted journal lines dated on or before that date, instead of reading today's cached amount. Items are considered regardless of their current status — one settled since that date was open on it — so ``status`` is refused alongside it rather than silently ignored: a filter that appears to apply and does not is worse than an error. ``original_amount`` and ``status`` on each row remain the item's own, which are current facts, not as-of ones; the screen says so.	One page of the AR/AP subledger (member read). ``direction`` filters server-side (ZCT-577) — omit it for both. ``commercial_document_id`` narrows to one document's item (D09-G13); not with ``as_of``. ``as_of`` (ZCT-577) reconstructs each item's open amount from posted journal lines dated on or before that date, instead of reading today's cached amount. Items are considered regardless of their current status — one settled since that date was open on it — so ``status`` is refused alongside it rather than silently ignored: a filter that appears to apply and does not is worse than an error. ``original_amount`` and ``status`` on each row remain the item's own, which are current facts, not as-of ones; the screen says so.	Not declared	Not declared	Not declared	Not declared
`list_gl_periods`The company's accounting periods — the months a journal entry may post into (CompanyMember read). A period belongs to one fiscal year and carries ``period_no`` (1..12 within the year), ``date_from``/``date_to`` and a ``status``: ``open`` accepts postings, ``soft_closed`` still accepts them, and ``closed``/``year_closed`` refuse them — a posting date inside a closed period fails until an accountant explicitly reopens the period (``POST …/gl/periods/{period_id}/reopen``, reason required, recorded in the close-run ledger — ZET-161). ``fiscal_year_id`` narrows to one year; omitted, every year's periods come back. This is not the VAT filing calendar — those are the ``gl_vat_period`` rows of ``GET …/gl/vat/periods``, which have their own quarterly/monthly cadence and their own ``filed``/``paid`` sealing. Use this list to find the ``period_id`` a manual journal entry needs, and to check why a posting date was refused.	The company's accounting periods — the months a journal entry may post into (CompanyMember read). A period belongs to one fiscal year and carries ``period_no`` (1..12 within the year), ``date_from``/``date_to`` and a ``status``: ``open`` accepts postings, ``soft_closed`` still accepts them, and ``closed``/``year_closed`` refuse them — a posting date inside a closed period fails until an accountant explicitly reopens the period (``POST …/gl/periods/{period_id}/reopen``, reason required, recorded in the close-run ledger — ZET-161). ``fiscal_year_id`` narrows to one year; omitted, every year's periods come back. This is not the VAT filing calendar — those are the ``gl_vat_period`` rows of ``GET …/gl/vat/periods``, which have their own quarterly/monthly cadence and their own ``filed``/``paid`` sealing. Use this list to find the ``period_id`` a manual journal entry needs, and to check why a posting date was refused.	Not declared	Not declared	Not declared	Not declared
`list_gl_vat_periods`List Gl Vat Periods	List Gl Vat Periods	Not declared	Not declared	Not declared	Not declared
`list_items`List/filter items, scoped to the caller's member companies (A1). Optional ``period`` (``YYYY-MM``) filters by the item's effective date (invoice date, falling back to the Europe/Zurich-local ingestion date); a malformed value returns 422 ``{"msg": "period must be YYYY-MM"}``. ``exclude_triage_status`` drops items carrying that triage verdict (NULL-safe; for ``unrelated`` not a booked one, ZCT-954). Optional ``q`` is free text: a case-insensitive partial (substring) match over the filename and the counterparty name from both of its sources (the linked counterparty and the extracted ``data.company``). ``duplicate`` filters on the row's ``is_duplicate`` flag (ZET-413); ``credit_note`` on its ``is_credit_note`` flag (ZET-429) — both server-side, so ``total`` stays exact. ``posted`` filters on the posting badge (ZCT-811): ``true`` = posted, ``false`` = held, reversed or not booked; a copy filed with the booking of the same invoice ("Already booked", ``posting.filed_with``) is in neither (ZEN-1). ``overdue`` (D08-G14): due before today (Zurich), still owing, not a credit note. Owing is the open item's rest; a document with no open item is owing until a bank movement is linked to it (R2-2).	List/filter items, scoped to the caller's member companies (A1). Optional ``period`` (``YYYY-MM``) filters by the item's effective date (invoice date, falling back to the Europe/Zurich-local ingestion date); a malformed value returns 422 ``{"msg": "period must be YYYY-MM"}``. ``exclude_triage_status`` drops items carrying that triage verdict (NULL-safe; for ``unrelated`` not a booked one, ZCT-954). Optional ``q`` is free text: a case-insensitive partial (substring) match over the filename and the counterparty name from both of its sources (the linked counterparty and the extracted ``data.company``). ``duplicate`` filters on the row's ``is_duplicate`` flag (ZET-413); ``credit_note`` on its ``is_credit_note`` flag (ZET-429) — both server-side, so ``total`` stays exact. ``posted`` filters on the posting badge (ZCT-811): ``true`` = posted, ``false`` = held, reversed or not booked; a copy filed with the booking of the same invoice ("Already booked", ``posting.filed_with``) is in neither (ZEN-1). ``overdue`` (D08-G14): due before today (Zurich), still owing, not a credit note. Owing is the open item's rest; a document with no open item is owing until a bank movement is linked to it (R2-2).	Not declared	Not declared	Not declared	Not declared
`onboarding_guide`How to onboard and create a NEW company: what to ask the user for, which documents to request, and the order to run the setup in. Discovery does not depend on search: this tool is in the tier, so it is listed for every caller, and `BASE_INSTRUCTIONS` names it. `find_operations` does reach it ("new company setup" ranks it first), but a query made only of common words is still decided by whichever tool happens to contain them. Read this before you start a company setup, and before you tell a user that something cannot be done here. It answers the questions the create's own schema cannot: which of fifteen sections actually matter, which documents produce them, and what it costs to skip one. If your API key's purpose is `onboarding`, this is the only job it has.	How to onboard and create a NEW company: what to ask the user for, which documents to request, and the order to run the setup in. Discovery does not depend on search: this tool is in the tier, so it is listed for every caller, and `BASE_INSTRUCTIONS` names it. `find_operations` does reach it ("new company setup" ranks it first), but a query made only of common words is still decided by whichever tool happens to contain them. Read this before you start a company setup, and before you tell a user that something cannot be done here. It answers the questions the create's own schema cannot: which of fifteen sections actually matter, which documents produce them, and what it costs to skip one. If your API key's purpose is `onboarding`, this is the only job it has.	Not declared	Not declared	Not declared	Not declared
`post_gl_journal_entry`Post a draft entry into the books — accountant. One-way. A posted entry can no longer be replaced or discarded (both refuse with 409); the only general correction is ``…/reverse``, which leaves both the original and the reversal visible. The one exception is ``PUT …/guessed-account``, which re-points a ``coding_guessed`` entry's expense account in place — and it works only on a posted entry. Check the draft before posting rather than after.	Post a draft entry into the books — accountant. One-way. A posted entry can no longer be replaced or discarded (both refuse with 409); the only general correction is ``…/reverse``, which leaves both the original and the reversal visible. The one exception is ``PUT …/guessed-account``, which re-points a ``coding_guessed`` entry's expense account in place — and it works only on a posted entry. Check the draft before posting rather than after.	Not declared	Not declared	Not declared	Not declared
`request_api_key`Ask the user to hand this session a Zeno API key. Use this first — every current Zeno user already has an account. `email` is the address on their Zeno account. Ask them for it; you cannot guess it, and the request is aimed by it — Zeno will only show it to somebody signed in as the owner of that address. Pass `client_name` too: it is the only thing identifying you on the approval page, and without it the person is asked to trust "an unnamed client". Returns a plain `verification_uri`. Tell the user to open it, sign in, and approve the request waiting there; we also email them a notice. There is no code, in either direction: nothing to read out, nothing to type, and nothing for you to put in a link. Then call `collect_api_key` with the `claim_token` returned here, waiting `poll_interval_seconds` between calls, until its `status` stops being `pending`. The user chooses on the page what the key may reach — usually a single company — so expect the key to be scoped, and read a 403 elsewhere as that scope rather than as a failure. The answer is the same whether or not that address has a Zeno account. If nothing ever arrives, the likeliest cause is a mistyped address — ask, do not assume.	Ask the user to hand this session a Zeno API key. Use this first — every current Zeno user already has an account. `email` is the address on their Zeno account. Ask them for it; you cannot guess it, and the request is aimed by it — Zeno will only show it to somebody signed in as the owner of that address. Pass `client_name` too: it is the only thing identifying you on the approval page, and without it the person is asked to trust "an unnamed client". Returns a plain `verification_uri`. Tell the user to open it, sign in, and approve the request waiting there; we also email them a notice. There is no code, in either direction: nothing to read out, nothing to type, and nothing for you to put in a link. Then call `collect_api_key` with the `claim_token` returned here, waiting `poll_interval_seconds` between calls, until its `status` stops being `pending`. The user chooses on the page what the key may reach — usually a single company — so expect the key to be scoped, and read a 403 elsewhere as that scope rather than as a failure. The answer is the same whether or not that address has a Zeno account. If nothing ever arrives, the likeliest cause is a mistyped address — ask, do not assume.	Not declared	Not declared	Not declared	Not declared
`reverse_gl_journal_entry`Storno a posted journal entry: post its mirror image (accountant role). Nothing is deleted; the original stays, linked, and the reversal entry is returned. The only VAT-correct storno door — VAT postings, open items and what the document spawned are all unwound. ``body.posting_date`` dates the reversal and decides its period; omitted, it reuses the original's. A closed-period entry needs one in an open period and a person: the reversal is booked there; the entry stays unchanged. 409 when: the entry is a reversal or already corrected; a payroll run holds it; the date falls in a filed VAT period; an open item still carries a live settlement; the target period is closed or sealed; or a closed-period entry cannot be corrected (the reason is named).	Storno a posted journal entry: post its mirror image (accountant role). Nothing is deleted; the original stays, linked, and the reversal entry is returned. The only VAT-correct storno door — VAT postings, open items and what the document spawned are all unwound. ``body.posting_date`` dates the reversal and decides its period; omitted, it reuses the original's. A closed-period entry needs one in an open period and a person: the reversal is booked there; the entry stays unchanged. 409 when: the entry is a reversal or already corrected; a payroll run holds it; the date falls in a filed VAT period; an open item still carries a live settlement; the target period is closed or sealed; or a closed-period entry cannot be corrected (the reason is named).	Not declared	Not declared	Not declared	Not declared
`settle_entry`Post this reconciled bank entry into the GL (clean-bank settlement). Matched → Dr Bank / Cr AR; unmatched → Dr Bank / Cr Suspense; a previously-suspensed entry now fully matched → Dr Suspense / Cr AR. Idempotent, and a no-op (``skipped``) when the GL chart is not configured for native settlement. The matcher still owns ``reconciliation_status``. See doc/architecture.md §"Posting general ledger". A Skonto the person confirms (ZEN-526). ``cash_discounts`` names, per open item this movement pays, the cash discount the counterparty took: the item is released by the cash plus that, the discount booked on the direction's Skonto account with its VAT taken back, exactly as ``POST …/gl/payments`` books ``cash_discount_amount``. 422 when no Skonto account is configured, when an item is not one this settle pays, when cash + discount exceeds what is open or the VAT it takes back does not fit it, and when the settle books no payment for the item at all (the movement already settled it, a blocker): the transaction rolls back, so nothing is booked. Never proposed or applied without a person naming it.	Post this reconciled bank entry into the GL (clean-bank settlement). Matched → Dr Bank / Cr AR; unmatched → Dr Bank / Cr Suspense; a previously-suspensed entry now fully matched → Dr Suspense / Cr AR. Idempotent, and a no-op (``skipped``) when the GL chart is not configured for native settlement. The matcher still owns ``reconciliation_status``. See doc/architecture.md §"Posting general ledger". A Skonto the person confirms (ZEN-526). ``cash_discounts`` names, per open item this movement pays, the cash discount the counterparty took: the item is released by the cash plus that, the discount booked on the direction's Skonto account with its VAT taken back, exactly as ``POST …/gl/payments`` books ``cash_discount_amount``. 422 when no Skonto account is configured, when an item is not one this settle pays, when cash + discount exceeds what is open or the VAT it takes back does not fit it, and when the settle books no payment for the item at all (the movement already settled it, a blocker): the transaction rolls back, so nothing is booked. Never proposed or applied without a person naming it.	Not declared	Not declared	Not declared	Not declared
`start_signup`Create a Zeno account for somebody who does not have one yet. Use `request_api_key` first if they might already have an account — this tool cannot tell you, and deliberately never will. We email `email` a verification link. The user opens it, sees that you asked (by the name in `client_name`, shown as an unverified claim), chooses their own password, and decides separately whether to connect you. You never see the link, and you must not ask for it: it is what proves they own the mailbox, and a link you could repeat is a link anyone could. Then poll `collect_api_key` with the `claim_token` returned here. `denied` is terminal and means the person chose to create the account without connecting you, or refused outright — tell them plainly and stop; do not start another.	Create a Zeno account for somebody who does not have one yet. Use `request_api_key` first if they might already have an account — this tool cannot tell you, and deliberately never will. We email `email` a verification link. The user opens it, sees that you asked (by the name in `client_name`, shown as an unverified claim), chooses their own password, and decides separately whether to connect you. You never see the link, and you must not ask for it: it is what proves they own the mailbox, and a link you could repeat is a link anyone could. Then poll `collect_api_key` with the `claim_token` returned here. `denied` is terminal and means the person chose to create the account without connecting you, or refused outright — tell them plainly and stop; do not start another.	Not declared	Not declared	Not declared	Not declared
`upload_accounting_document`Upload a company's BALANCE SHEET, P&L or VAT return (PDF, PNG, JPEG, XLSX) to be read; queued, follow ``get_accounting_document``. ``fiscal_year`` when the file does not say; ``force`` re-reads a file already read. ``file_base64`` is the file's raw bytes, base64.	Upload a company's BALANCE SHEET, P&L or VAT return (PDF, PNG, JPEG, XLSX) to be read; queued, follow ``get_accounting_document``. ``fiscal_year`` when the file does not say; ``force`` re-reads a file already read. ``file_base64`` is the file's raw bytes, base64.	Not declared	Not declared	Not declared	Not declared
`upload_accounting_import`Import a JOURNAL EXPORT (CSV/Excel) from another accounting system (``source_system``, e.g. bexio, abacus) and match it against the bank entries. ``file_base64`` is the file's raw bytes, base64.	Import a JOURNAL EXPORT (CSV/Excel) from another accounting system (``source_system``, e.g. bexio, abacus) and match it against the bank entries. ``file_base64`` is the file's raw bytes, base64.	Not declared	Not declared	Not declared	Not declared
`upload_bank_statement`Import a BANK STATEMENT: CAMT.053 XML is booked into bank entries at once; PDF, CSV or Excel is queued for reading (follow ``list_bank_statement_imports``); a .zip is split per file. ``file_base64`` is the file's raw bytes, base64.	Import a BANK STATEMENT: CAMT.053 XML is booked into bank entries at once; PDF, CSV or Excel is queued for reading (follow ``list_bank_statement_imports``); a .zip is split per file. ``file_base64`` is the file's raw bytes, base64.	Not declared	Not declared	Not declared	Not declared
`upload_document`Upload an INVOICE or RECEIPT (PDF, image, or .zip of them) for analysis. ``file_base64`` is the file's raw bytes, base64-encoded. ``direction`` is ``payable`` (incoming supplier invoice) or ``receivable`` (outgoing). Creates Item(s) and queues extraction. This door is invoices-only: it never routes a file onward by type, so a bank statement, a journal export or a balance sheet sent here is analysed and then just sits as a document. For anything that is not an invoice — or when you are not sure what the file is — use ``upload_intake``.	Upload an INVOICE or RECEIPT (PDF, image, or .zip of them) for analysis. ``file_base64`` is the file's raw bytes, base64-encoded. ``direction`` is ``payable`` (incoming supplier invoice) or ``receivable`` (outgoing). Creates Item(s) and queues extraction. This door is invoices-only: it never routes a file onward by type, so a bank statement, a journal export or a balance sheet sent here is analysed and then just sits as a document. For anything that is not an invoice — or when you are not sure what the file is — use ``upload_intake``.	Not declared	Not declared	Not declared	Not declared
`upload_intake`Upload ANY file and let the system decide what it is (the unified intake queue — the same door as "Documents → Upload" in the web app). ``file_base64`` is the file's raw bytes, base64-encoded. Prefer this whenever the file is not plainly an invoice, and always for: bank statements (CAMT.053 XML, CSV, PDF or Excel exports) — these become BankStatement + BankEntry rows, matched to the registered bank account by IBAN; journal/accounting exports; and balance sheets, P&L statements and VAT filings. Mixed .zip archives are expanded and routed per file. Returns 202 with the queue row: routing happens asynchronously, so poll ``get_intake`` for the outcome and its targets. An unroutable file becomes a failed queue row carrying the reason — it is never silently dropped.	Upload ANY file and let the system decide what it is (the unified intake queue — the same door as "Documents → Upload" in the web app). ``file_base64`` is the file's raw bytes, base64-encoded. Prefer this whenever the file is not plainly an invoice, and always for: bank statements (CAMT.053 XML, CSV, PDF or Excel exports) — these become BankStatement + BankEntry rows, matched to the registered bank account by IBAN; journal/accounting exports; and balance sheets, P&L statements and VAT filings. Mixed .zip archives are expanded and routed per file. Returns 202 with the queue row: routing happens asynchronously, so poll ``get_intake`` for the outcome and its targets. An unroutable file becomes a failed queue row carrying the reason — it is never silently dropped.	Not declared	Not declared	Not declared	Not declared
`whoami`Which user this request acts as, and which company's books it is bound to (jwt or API key). Zeno serves every tenant from one host, and an API key is opaque — nothing else tells a connected agent whose books it is about to write. Call this FIRST when working over MCP: ``company_scoped: true`` means this connection's data access is confined to ``company_id`` — ``company_name`` names it (null here means the bound company no longer exists), no other tenant is reachable, and the admin endpoints are refused however privileged the owner is. ``is_admin`` is that owner's bit: worth nothing outside this company, still full authority inside it, so a scoped key with ``is_admin: true`` may write these books even when ``company_role`` is null. ``company_scoped: false`` means the credentials carry the owner's full principal and ``memberships`` lists the companies it can act in. Read-only and cheap — at most one lookup. ZET-171, ZET-176. ``credential_purpose`` says which kind of credential this is, and is what the withholding rule keys on (SP-08): anything that is neither ``full`` nor ``session`` is confined, and gets ``memberships`` withheld — null, not empty. Working over MCP, what you book or accept is recorded as MCP — not as this user acting in person — and the app displays it that way. ``capabilities`` says what this caller may do, each verdict computed from the predicate the gate itself evaluates (SP-12) — so an agent learns what it cannot do before it collides rather than after. A credential confined to a company gets the entries whose verdict is a fact about the credential; the one that would read the owner's estate (``create_company``) is omitted, because its verdict would disclose a sibling tenant. A credential confined to no company — an onboarding key — has no sibling to disclose and does get it, which is the one operation such a key exists to call. ``pending_admin_actions`` is present and empty until PRE-03/PRE-04 fill it.	Which user this request acts as, and which company's books it is bound to (jwt or API key). Zeno serves every tenant from one host, and an API key is opaque — nothing else tells a connected agent whose books it is about to write. Call this FIRST when working over MCP: ``company_scoped: true`` means this connection's data access is confined to ``company_id`` — ``company_name`` names it (null here means the bound company no longer exists), no other tenant is reachable, and the admin endpoints are refused however privileged the owner is. ``is_admin`` is that owner's bit: worth nothing outside this company, still full authority inside it, so a scoped key with ``is_admin: true`` may write these books even when ``company_role`` is null. ``company_scoped: false`` means the credentials carry the owner's full principal and ``memberships`` lists the companies it can act in. Read-only and cheap — at most one lookup. ZET-171, ZET-176. ``credential_purpose`` says which kind of credential this is, and is what the withholding rule keys on (SP-08): anything that is neither ``full`` nor ``session`` is confined, and gets ``memberships`` withheld — null, not empty. Working over MCP, what you book or accept is recorded as MCP — not as this user acting in person — and the app displays it that way. ``capabilities`` says what this caller may do, each verdict computed from the predicate the gate itself evaluates (SP-12) — so an agent learns what it cannot do before it collides rather than after. A credential confined to a company gets the entries whose verdict is a fact about the credential; the one that would read the owner's estate (``create_company``) is omitted, because its verdict would disclose a sibling tenant. A credential confined to no company — an onboarding key — has no sibling to disclose and does get it, which is the one operation such a key exists to call. ``pending_admin_actions`` is present and empty until PRE-03/PRE-04 fill it.	Not declared	Not declared	Not declared	Not declared
`zeno_info`What this server is, which MCP revision it speaks, and how to get a credential. Needs no credential. Call it first if a tool has just refused you: the `authentication` block names the tools that can get this session connected.	What this server is, which MCP revision it speaks, and how to get a credential. Needs no credential. Call it first if a tool has just refused you: the `authentication` block names the tools that can get this session connected.	Not declared	Not declared	Not declared	Not declared
`zeno_overview`What Zeno does, in one page — the platform's capabilities and its limits. Needs no credential. Read this before telling a user that Zeno cannot do something; it covers VAT, payroll, reconciliation and the AI accountant.	What Zeno does, in one page — the platform's capabilities and its limits. Needs no credential. Read this before telling a user that Zeno cannot do something; it covers VAT, payroll, reconciliation and the AI accountant.	Not declared	Not declared	Not declared	Not declared

Details

Registry status: Active
Published: Oct 11, 2026
Updated: Oct 11, 2026
Website: https://zeno-works.ch/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): Invoicing and accountingSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing