SevDesk

Host a copy with our keys and logs.

• SEVDESK_API_TOKEN — sevDesk API token (Settings > Users > API token). It has full access to the account; ideally create it for a dedicated user. To keep it out of the client configuration, set up the server by hand with SEVDESK_API_TOKEN_KEYCHAIN (OS keychain) or SEVDESK_API_TOKEN_FILE instead: https://sevdeskmcp.lanfermann.dev/docs/en/configuration#token
• SEVDESK_ALLOW — Comma-separated permission tiers to enable: read, write, commit, external, or all. Tools above the allowed tiers are not registered. read is always on.
• SEVDESK_READ_ONLY — Set to true to allow only read tools, whatever SEVDESK_ALLOW says.
• SEVDESK_DRY_RUN — Set to true to make write tools only return a preview of what they would do, without sending anything.
• SEVDESK_CONFIRM — How a human confirms commit and external actions: elicit (in the client), browser (local approval page) or off (also needs SEVDESK_I_UNDERSTAND_NO_CONFIRM=1).
• SEVDESK_AUDIT_LOG — Path of a local JSON Lines file that records every write the server makes (redacted). Unset: no audit log.
• SEVDESK_TOOLSETS — Comma-separated toolsets to load, e.g. invoices,vouchers,banking. Unset loads all except advanced; all adds advanced.
• SEVDESK_FILE_DIRS — Absolute folders (separated like PATH) that receipts and e-invoices may be read from, for voucher uploads and e-invoice import. Unset: no local file is read.
• SEVDESK_OUTPUT_DIR — Folder where PDFs, e-invoice XML, CSV and DATEV exports may be saved. Unset: the file-saving tools are not offered.