MCP for Law and Tax Firms: What the Model Context Protocol Is and What Matters

Anyone who wants to connect an AI assistant to meeting notes or documents soon arrives at the Model Context Protocol (MCP). This article explains the protocol for the people responsible for IT and for DATEV, the standard software of German tax firms, and names what has to be settled before the first connection.

What is the Model Context Protocol?

MCP is an open standard for connecting AI applications to external systems. The project site compares it to USB-C: one uniform port instead of a special solution for each device. If a service builds an MCP server, any assistant that supports MCP can in principle talk to it.

The specification has three roles. The host is the AI application, meaning the assistant. The client is the connector inside the host. The server is the service that provides data and functions, such as a meeting archive. A server can offer three kinds of things: resources (data and context), prompts (templates) and tools (functions the language model executes). The current revision is version 2026-07-28.

How does access through MCP work?

The language model selects a tool, the client calls it on the server and the result goes back to the model. If a colleague asks for the open items from the last client meeting, the model calls a suitable tool, the server returns the text and the model words the answer from it.

Tools are model-controlled: the model decides from the request what to call. The specification therefore recommends that a human can always deny calls. The data flow is also uneven. Under the architecture principles, the server receives only the necessary information and the full conversation history stays with the host. What the server returns, on the other hand, goes to the host and to the model.

Does MCP protect the data by itself?

No, MCP describes principles but cannot enforce them. The specification requires that users explicitly consent to data access and keep control. It also states that MCP cannot enforce these principles at the protocol level. Implementation is up to the makers of the server and the assistant.

Authorization is optional too. Where it is used over HTTP, it is based on OAuth 2.1: the person signs in through the browser, the assistant receives an access token and the server checks that the token was issued for it.

Labels call for caution. A tool can present itself as read-only with the hint readOnlyHint, but according to the schema such annotations are only hints and not a reliable description. Whether a server really only reads has to be enforced on the server itself.

What does a firm check before connecting meeting data?

It checks, separately for each server and each assistant, who can read what, how access is approved and who ends up receiving the content.

Is read-only access enough?

No, because read-only access protects the source system from changes, but not the content that is read. It prevents an assistant from changing data or sending anything through this server. It does not prevent the text it reads from leaving the firm.

If other servers are attached to the same assistant, for example for email, the host controls what happens between them. The specification recommends showing tool inputs before the call to avoid unintended data exfiltration. The firm therefore checks the whole configuration of an assistant.

What does the assistant's vendor receive?

It receives whatever the server returns and the model processes, which for meeting data includes confidential content. That makes the assistant's vendor a service provider in its own right, and the firm has to check it separately. The contract with the MCP server's vendor does not cover it.

For tax advisors, § 62a of the Tax Advisory Act (StBerG) applies: careful selection, a contract in text form with a secrecy obligation and, for services abroad, a comparable level of protection. For lawyers, § 43e of the Federal Lawyers' Act (BRAO) governs this, for auditors § 50a of the Public Accountants Act (WPO). The FAQ of the German Federal Chamber of Tax Advisors (BStBK) requires AI vendors to be bound before they gain knowledge of the data. This goes together with a data processing agreement, a rule on retention and clarity on whether inputs are used for training. If the language model runs at another company, that company belongs in the review too.

Private accounts are out. The BStBK advises company accounts and, without adequate contractual safeguards, treats it as a breach of the duty of secrecy if client data reaches public AI services. If the use directly serves a single engagement, § 62a(5) StBerG also requires the client's consent. According to the BStBK, it cannot be said with certainty whether this applies to AI. It therefore advises obtaining consent beforehand or anonymising the data. The firm should also check that its privacy notice and consent texts cover this recipient.

How does TaxMeet handle this?

TaxMeet (Next Intelligence GmbH, Berlin) provides meeting data read-only through an MCP server, and every call is logged. The MCP guide names Claude, Langdock, Copilot Studio, ChatGPT and Claude Code as assistants, with the ChatGPT option not yet available in every EU workspace. Each person connects their own assistant, signs in with their TaxMeet account and approves read access once. They see their own meetings and those shared within the firm.

The log records tool, meeting, outcome and duration, without content. Owners and admins can turn off external AI access for the firm, which is on by default, and decide whether assistants may read transcript text or only notes and summaries. Sending emails, creating appointments and filing into DATEV stay in the TaxMeet app, with approval.

Content goes to the vendor the firm has chosen, under the firm's contract with that vendor. The firm makes this decision together with its data protection officer. Questions to ask are in the article What should I check when choosing a vendor?, and the chamber's position in the BStBK FAQ in 12 points. How meeting data comes about and what to check along the way is covered in Why a meeting bot disrupts a client conversation.