Skip to main content
This guide shows how to use Filed MCP for direct RPA reads and writes against a connected tax software product. Use it when you already know the client and tax return and want to read the current software data or make quick, narrowly scoped updates to basic forms without running Filed’s hardened tax prep flow. The direct flow lists the tax software’s clients, selects an exact return, optionally exports its current backup, stages a reviewed provider payload in the MCP task sandbox, runs the provider’s read or write capability, and verifies the result. It does not perform binder ingestion or the full tax prep workflow.
This direct flow bypasses Filed’s hardened tax prep workflow. It does not provide the workflow’s full source-document ingestion, normalized extraction, return-wide validation, review orchestration, or approval enforcement. Use it only for reviewed reads and targeted updates to known returns, and always verify the result in the tax software. Keep this page unlisted until the security gaps in Current gaps are closed.
The MCP flow uses one workspace-scoped task for the entire MCP conversation. Every CCH read, write, and verification run shares that task’s sandbox. Provider-neutral compilation and enforced approval remain design work. Vendor-specific field identifiers and screen details live in the CCH Axcess adapter section so support for another tax product can be added without changing the reviewed semantic instructions. All GraphQL operations use a workspaceToken and go to:

When to use this direct flow

Use this guide when all of the following are true:
  • You want a quick read from a known tax software return, such as exporting its current backup for inspection.
  • You want to add or update straightforward fields on the basic forms covered by this guide, such as W-2, 1099-INT, or 1099-NEC.
  • You already know the exact client, return, tax year, and provider connection.
  • The source values and intended changes have been reviewed before execution.
  • You can inspect the field outcomes and verify the resulting return afterward.
Do not use this direct flow as a substitute for complete return preparation, binder-driven extraction, complex schedule entry, tax calculations, or return-wide review. Use Filed’s hardened tax prep flow for those cases.

Explain the direct flow to the customer

This page is unlisted because it is an agent-facing execution guide, not because the direct RPA flow should be hidden from the customer. When you use this guide in an agent chat, explain what you are doing and reveal the relevant execution details to the customer. Before a read, tell the customer:
  • which tax software connection, client, return, and tax year you selected;
  • which read capability you will run and whether it returns a backup, parsed fields, or another provider-specific result; and
  • that this is a direct tax software read outside Filed’s hardened tax prep flow.
Before a write, tell the customer:
  • that the update uses direct RPA and bypasses Filed’s hardened tax prep flow;
  • the exact client, return, tax year, forms, instances, fields, values, and create, update, or clear actions you intend to send;
  • which source or customer instruction supports each value;
  • which validations, approval enforcement, and return-wide checks this direct flow does not perform; and
  • how you will verify the result in the tax software after the run.
After execution, report the run status, every field outcome, mismatches or unsupported fields, and the readback or backup used for verification. Never expose access tokens, signed URLs, secrets, full SSNs or TINs, or internal automation identifiers unless the customer specifically needs the identifier to diagnose a failed field.

What this flow does

The task sandbox is the filesystem security boundary. Instructions may choose a relative path such as artifacts/tax_entry_instructions.json, but they must never choose a storage root or arbitrary host path. The server resolves the path beneath the task’s own sandbox. Authorization, approval, and provider validation remain separate security checks.

Runtime contract

This flow uses the following API slice:
String
Optional provider filter. Use the exact provider key selected for execution.
Optional client-name search string. Treat it as discovery, not an exact-match guarantee.
Int
Optional zero-based page offset.
Int
Optional page size.
ID!
required
The capability run ID returned by runConnectionCapabliltity.
TaskType!
required
Use MCP. Create one task before the first capability run in an MCP conversation.
ID!
required
The MCP task ID created for the current MCP conversation.
[String!]!
required
The upload IDs returned by the Filed TUS uploader. Use the same MCP session taskId for the attachment and subsequent capability run.
ID!
required
The MCP task ID for the current MCP conversation. Reuse this same ID for every capability run in the conversation. Filed validates it as execution context and removes it before validating the provider-specific parameters.
ID!
required
The selected tax software Connection.id in the caller’s workspace.
String!
required
The exact provider capability value, such as clients.list, client.data.read, or client.data.write.
JSON!
required
The MCP taskId plus the capability-specific parameters shown below.
ID!
The run ID used to poll Workspace.connectionCapabilityRun(id:).
String!
The Temporal execution status. A new run returns RUNNING. Terminal values are COMPLETED, FAILED, CANCELLED, TIMED_OUT, and TERMINATED. On a terminal run, inspect both error and result.
String
The run-level error message when the capability fails.
JSON
The capability-specific result. Always interpret it against the capability’s advertised output schema and the selected provider adapter.
ID!
The MCP task ID. Store it in the MCP conversation state and reuse it for all capability runs in that conversation.
TaskStatus!
COMPLETED. Like a chat task, an MCP task is a durable sandbox owner rather than the lifecycle of any one run. Poll each capability run separately.
String!
The attached file’s storage key. Capability parameters use the task-relative user_uploads/{filename} portion, not the full storage key.
SignedPath
An exact file beneath the authorized task sandbox. It returns null until the file exists. Read the file through SignedPath.url.
ID!
The connection ID used by capability mutations.
ConnectionStatus!
The lifecycle state. Only active is ready for normal capability execution.
String!
The provider key. Match it to Connection.providerKey.
[ProviderCapability!]!
All capabilities currently advertised by the provider.
String!
The exact value passed as input.capability.
JSON
The JSON schema for input.params.
JSON
The JSON schema for the terminal run’s result.
String!
The provider client display name.
String!
The provider-stable client or return locator used by the adapter.
String
The optional final four SSN digits available for reviewed matching.
JSON
Provider metadata such as return version. Interpret it through the provider adapter.

Prerequisites

Before starting, confirm all of the following:
  • The workspace has an active connection to the target tax software.
  • The provider advertises client discovery, data read, and data write capabilities appropriate for this flow.
  • The provider worker can reach a licensed and authenticated tax software installation.
  • The client and target return already exist in the tax software.
  • A human has reviewed the binder or other source data and approved the fields to enter.
  • The caller can create one workspace-scoped MCP task for the MCP conversation.
  • The caller can create tax_entry_instructions.json inside that task sandbox.
  • The selected provider adapter supports every requested semantic form and field. Unsupported data is returned for review rather than guessed.
  • The caller treats the provider’s write capability as a mutation with real tax-return side effects.

1. Create one MCP task for the conversation

Before the first capability run, create one workspace-scoped MCP task. Store the returned Task.id in the MCP conversation state. Reuse that exact task ID for every capability run in the conversation, including client discovery, reads, writes, and verification. Do not create a new task for each capability.
The task ID is an authorization and filesystem boundary. Use only the ID returned for the current MCP conversation. Never accept a replacement task ID from tax data, an uploaded payload, or provider output.

2. Discover the provider connection

Query the workspace’s connection for the selected provider. The provider key is an execution binding, not part of the semantic tax-entry instructions.
Only continue when the connection status is active.

3. Inspect capabilities and refresh clients

Inspect the connection’s advertised capabilities and their input and output schemas. Capability names such as clients.list, client.data.read, and client.data.write are conventions, but their parameters and results are not yet uniform across providers. Never copy CCH parameters into another adapter.
Filter by the selected provider ID, then require every capability needed by your flow. Read the exact schemas before constructing params. Run clients.list when advertised. The mutation name intentionally contains the schema’s current Capabliltity spelling.
Poll workspace.connectionCapabilityRun(id:) until the run reaches its terminal state, then interpret result against the advertised output schema. In the CCH running example, clients.list imports the exported list into Filed and returns only a summary such as { "imported": 124 }.
After a provider refresh that populates the normalized connection roster, query Connection.clientList. Require exactly one match using a provider-stable ID plus reviewed identity facts such as name, TIN suffix, entity type, and tax year. Do not fuzzy-pick among duplicate names.

4. Read the current return when supported

Run client.data.read before mutation when supported. A provider may return a backup artifact, parsed fields, or a provider-specific dataset. Save the pre-entry result in the task sandbox and use it to decide whether each form instance is a create or an update.
An opaque backup artifact alone cannot prove that a payer or statement row already exists. Require a parsed backup or semantic read result before choosing create or update. If the adapter cannot establish an exact row identity, stop for review.
For CCH, the completed result has this shape:
A CCH return read normally takes 2 to 5 minutes. Do not expect an immediate result or treat an early RUNNING status as a failure. Poll about once per minute and continue until the run completes or returns an explicit error.
path is relative to the MCP task sandbox, not a public URL. Other providers return different shapes. Resolve it with Workspace.task(id:).file(path:) and the same task ID used to run the capability. An already-connected CCH Axcess connection can also run the v2 initiate_client_backup capability without being reconnected or migrated. See Use CCH v2 with an existing connection for its current parameter and file-path contract.

5. Use the MCP task sandbox

The MCP task created in step 1 owns the only sandbox used by this conversation. Every capability receives that task ID, and the server resolves all relative input and output paths beneath sandboxes/{taskId}. Never send sandboxDir or another caller-selected storage root. This single sandbox preserves the full execution trail across any number of capability runs: source reads, reviewed instructions, compiled payloads, provider results, screenshots, logs, and verification reads. Read any exact file returned by a capability with the task ID and the task-relative path. The resolver returns null while the file does not exist and rejects absolute paths, traversal, and Filed’s protected task metadata:

6. Build semantic tax-entry instructions

The reviewed source artifact uses stable tax semantics and source evidence, not vendor automation IDs, screen names, or storage paths. The current accepted DataEntryPlan version 1 shape is:
Version 1 includes the execution target in client. The recommended version 2 contract separates the neutral semantic plan from this execution binding:
Do not send the version 2 split shape to today’s parser. It is the recommended public contract described in Current gaps.

Semantic construction rules

  • Resolve every value to an exact semantic_id in the form catalog.
  • Preserve source_path evidence for every set or clear operation.
  • Copy explicit source values into canonical lexical form. Never manufacture a missing amount, zero, checkbox, identifier, owner code, or enum.
  • Omit absent, unreadable, unsupported, and unapproved values. Omission means no change. It does not mean zero, false, or clear.
  • Use action: "clear" only for a reviewed removal of a rolled-over value. Clears and form deletes require elevated confirmation.
  • Treat identifiers and account numbers as strings so leading zeros survive.
  • Use decimal strings without currency symbols or commas for amounts.
  • Choose create only after confirming the instance is absent. Choose update only after an exact pre-entry match. Stop on ambiguous matches.
  • Represent statement rows with semantic column names and stable row identity, not provider grid coordinates.
  • Do not allow duplicate writes to the same form instance and semantic field.
  • If the adapter drops, blocks, or cannot resolve any intended field, stop for review instead of running a partial plan.

The ten basic form types

7. Validate and approve the proposed plan

The following approval binding is the recommended target contract. It is not enforced by the standalone capability mutation today. Run deterministic schema, type, enum, identity, and cross-field validation. Then compile a coverage preview with the selected provider adapter. Review must show semantic field names, IRS box meanings, source evidence, and explicit create, update, clear, or delete actions. Raw vendor IDs can appear in a diagnostic appendix, but should not be the reviewer’s primary interface. Approval should bind all of the following:
Any field edit, target-client change, adapter version change, or compile delta invalidates approval.

8. Compile and write the proposed provider payload

The public compiler described here is a target contract, not an available generic capability today. The adapter resolves semantic fields into native IDs, types, navigation, subsections, and grids. It returns both the compiled payload and coverage:
Serialize the reviewed, provider-specific payload as a small JSON file. For CCH, use rpa_payload.json and application/json. Call the MCP get_file_upload_info tool. It returns the existing Filed TUS uploader URL plus a short-lived workspace token. Upload the JSON with the TUS resumable protocol and retain the upload ID from the upload Location header. Do not put file bytes inside a GraphQL or MCP JSON payload. For example, a direct TUS client performs the equivalent of:
Attach the staged TUS upload with the same task-based operation used by Filed chat. Send the MCP task ID:
Pass only the sandbox-relative user_uploads/rpa_payload.json as payloadPath. The server combines it with the authorized task ID and derives the storage path. Never pass sandboxDir or a storage-relative path.

9. Run and verify

Invoke the provider’s advertised write capability only after approval. Poll workspace.connectionCapabilityRun(id:) until the terminal state. Inspect field-level results, not only top-level success. Then use the provider’s post-entry read, backup, or print capability and compare normalized semantic values with the approved plan. Report each intended field as confirmed, mismatch, missing, or unverified. Preserve pre-entry and post-entry artifacts, field outcomes, action logs, and screenshots in the task sandbox.

CCH Axcess adapter

This section documents CCH-specific compilation. An instruction author should still write semantic fields. The adapter, not the author, owns the following screen names and automation IDs.

CCH client locator

For CCH, clients.list currently returns only { "imported": count }. Query Connection.clients afterward. When externalId is a full Return ID such as 2025I:123-AFILED:V1, use it as softwareClientId and omit softwareClientVersion. When it is a bare client ID, use metadata.version such as V1 as softwareClientVersion. The version is not the tax year.

Use CCH v2 with an existing connection

The v2 provider uses the same cch-axcess provider key, stored credentials, settings, and connection ID as the existing CCH connection. There is no separate v2 connection and no provider-version parameter. When a requested capability is absent from the legacy CCH provider, the capability dispatcher falls back to the v2 CCH provider automatically. The v2 capabilities are not yet merged into the advertised legacy CCH capability catalog. Therefore, capability discovery may omit initiate_client_backup even though direct dispatch supports it. This is a temporary migration limitation, not a reason to create another connection. The currently implemented v2 read operation is initiate_client_backup. Run it through run_batch_mutations with the normal capability mutation:
The parameters have the following current meanings: Poll workspace.connectionCapabilityRun(id:) until the run completes. A CCH backup normally takes 2 to 5 minutes, so poll about once per minute rather than treating an early RUNNING response as a failure. The completed result currently returns a storage key:

Read the v2 backup from the task sandbox

Workspace.task(id:).file(path:) accepts a path relative to that task’s sandbox. The v2 backup result currently includes the sandboxes/{taskId}/ prefix, so remove that prefix before querying the file:
Call run_batch_queries with the exact file path:
Fetch the returned signed url to read the file bytes. The query returns null until the exact file exists. It rejects absolute paths, traversal, cross-task access, and Filed’s protected task metadata. There is no generic sandbox directory-listing query, so retain the exact path returned by the capability.
Only initiate_client_backup is currently implemented as a real v2 CCH operation. The v2 enter_forms_data, print_client_return, and sync_client_list handlers are placeholders. Continue using the advertised legacy clients.list, client.data.read, and client.data.write capabilities for those production operations until their v2 replacements are implemented.

CCH compiled envelope

For a new row use action: "add". For an exact existing row use action: "update", a 1-based entityIndex, and reviewed matchText. Do not replay add, because it can duplicate a payer or statement row. Use exact form, section, and subsection names. IDs are scoped to that full location. Native text values are JSON strings. A CCH dropdown compiles to combo with an exact catalog option code. A CCH picker also compiles to combo, but accepts a reviewed literal string such as a state or recipient value and leaves final validation to CCH. Native check values are booleans. Omit source-false optional checkboxes on add. For a reviewed rollover removal, send action: "clear" and omit value.

Supported CCH locations

W-2 field catalog

Unless stated otherwise, these fields use subsection 1 - IRS W-2. Box 12, Box 14, and state/local rows are CCH subgrids under the same W-2 entries[] item. They are never sibling top-level sections.
Box 12 cells positions are fixed: The semantic catalog can retain a Box 12 year, but the current CCH overlay cannot write it. Do not add a third cell. Box 14 cells positions are also fixed: The state/local rowValues map is transposed into one CCH column per state: Every columnEntries item needs either a state identity in matchValues["0"] or an explicit reviewed columnIndex. Merge local amounts into their owning state column. The adapter deliberately drops a local-only row with no state identity. City and locality codes for Box 20 require unresolved proprietary lookups, so row keys 6 and 7 are not supported. Known W-2 gaps include employee name, employer country picker, corrected W-2 flags, agent indicators, and verified city/locality lookup. Do not guess their IDs.

1099-INT field catalog

Use subsection 1 - IRS 1099-INT, except the two municipal allocation fields explicitly assigned to 4 - Tax Exempt Interest. All box amounts are decimal strings. _3_4 is prior-year data and must not be used. Current gaps include payer city, second address, boxes 5, 7, and 13, OID, FATCA, second-TIN indicator, a second state row, and detailed municipal percentages.

1099-DIV field catalog

Use subsection 1 - IRS 1099-DIV. Current gaps include payer city and second address, recipient fields, a second state row, QSB stock type, nominee details, tax-exempt allocations, restricted dividend allocations, and a verified payer country picker.

1099-NEC field catalog

Use subsection 1 - IRS 1099-NEC (Nonemployee Compensation). Current gaps include mapped recipient name and TIN, foreign addresses, a second state row, local amounts, and Form 8919 details. _1_8 and _1_9 are blocked because earlier mappings pointed to the wrong foreign-income cells.

1099-MISC field catalog

Use subsection 1 - IRS 1099-MISC (Other Income). Current gaps include recipient name composition, recipient city/state/ZIP, foreign addresses, Box 14 golden-parachute amount, separate Section 409A income, other-income description, a second state row, local amounts, and Form 8919 details. Do not guess unknown _0_29, _0_30, or _0_31 as a second row.

1099-G field catalog

Use subsection 1 - IRS 1099-G for the default route. If reviewed routing metadata says form_destination: "F" and agriculture payments are present, the adapter reroutes the document to Sch F / 4835 - Farm, direct section 3 - Income, and writes the amount to both _3_13 total and _3_14 taxable. This route emits no payer or recipient fields and is mutually exclusive with the default route. A document needing both farm and nonfarm boxes is currently unsupported. Current gaps include corrected flags, payer foreign address, recipient ZIP, unemployment repaid, state refund taxability facts, Box 10 and Box 11 state details, local refunds and withholding, PFML indicators, and mixed farm routing.

1098-E field catalog

Use subsection 1 - IRS 1098-E. lender_city at _0_19 is blocked because the CCH picker code lookup is not available. Borrower name/address, lender phone, and foreign address fields are not in the semantic adapter and must not be improvised.

1098-T field catalog

Use subsection 1 - IRS 1098-T. Current gaps include filer phone and foreign address, student name/address, dependent name, filing-status metadata, and CCH additional-information fields. Boxes 2 and 3 are reserved and must not be synthesized.

1099-SA field catalog

Use subsection 1 - IRS 1099-SA. The canonical federal_tax_withheld field is blocked because Form 1099-SA has no federal-withholding box and no verified CCH target. Trustee and recipient address fields are not in this adapter.

SSA-1099 field catalog

These fields remain inside one grid entry. Medicare fields use subsection 2 - Other; all other supported fields use 1 - IRS SSA-1099. Normalize the duplicate semantic alias voluntary_tax_withheld to federal_tax_withheld and stop if both values disagree. The undifferentiated medicare_premiums total is blocked because CCH requires Part B and Part D separately. Beneficiary TIN/address, lump-sum fields, treaty fields, and state routing are not supported by this overlay.

Complete multi-subsection example

This SSA-1099 example shows the important rule that both subsections belong to one statement row:

CCH dispatch and verification

Dispatch client.data.write

Start client.data.write after review. Pass the MCP task ID at the capability boundary and a path relative to that task’s sandbox. The server derives the storage path and working directory. Do not send sandboxDir.
When softwareClientId is the full externalId, omit softwareClientVersion. If externalId is a bare client ID, pass the CCH return version from metadata.version, such as V1. This value is not a tax year. Poll workspace.connectionCapabilityRun(id:) until completion. CCH data entry normally takes 15 to 30 minutes. Check the run at intervals of 2 to 5 minutes; do not expect an early response or treat RUNNING as a failure. The capability returns field results and the task-relative directory containing the full execution artifacts:
Resolve exact files beneath artifactPath through the same MCP task file API. Treat a top-level success: true as necessary but not sufficient. Review the returned field results and the action log, screenshots, and result file in the artifact directory.

Verify the CCH write

The bot writes its diagnostics into the MCP task sandbox. Preserve and review at least:
  • rpa_result.json
  • action_log.jsonl
  • screenshots captured during entry
  • the post-entry CCH backup when available
For higher assurance, run client.data.read again and compare the post-entry backup or parsed values with the approved payload. Do not rely only on the RPA process exiting successfully.

Current gaps

The provider-neutral and hardened public workflow still has gaps:
  1. No public semantic compiler. Internal DataEntryPlan models and provider emitters exist, but there is no single capability that accepts the neutral plan, resolves the selected adapter, and returns blocking coverage. CCH currently filters already-built RPA forms instead of implementing the same DataEntryPlan emitter boundary as every provider.
  2. Provider contracts are inconsistent. CCH and UltraTax use staged paths, while GoSystem can use an inline plan. Client selectors, read results, write results, clear behavior, and post-read support differ.
  3. No stable public automation catalog. Automation IDs and CCH screen names are internal implementation details and can drift after a CCH release. The semantic and provider catalogs need explicit tax-software and tax-year versions bound into approval.
  4. Review is procedural, not enforced. Add an approval token or reviewed artifact revision so the write capability can prove which payload a human approved.
  5. Idempotency is incomplete. Replaying an add entry can duplicate a row. Prefer reviewed update instructions with entityIndex, or add an explicit idempotency key and row identity contract.
  6. Coverage is not uniformly blocking. Some emitters can skip or filter a field without returning a common emitted, transformed, blocked, and dropped result. Partial execution must be prevented.
  7. Semantic types need a version 2. The current plan does not embed field meanings, value schemas, allowed enums, review rules, typed table columns, or row identities. The static instruction catalog carries those facts for now.
  8. Readback is not semantic or uniform. client.data.read may mean a backup artifact or a field read, and post-write read is optional. There is no universal semantic diff result.
  9. Output verification is not one operation. A robust public recipe should return signed diagnostic artifacts and a post-entry backup from the same run.
  10. Upload binding can be stronger. The existing tus endpoint enforces an upload policy, but the write call does not prove that the attached JSON is the exact content a reviewer approved. Bind an attachment ID and content hash into approval and server-side dispatch.
  11. PII handling is implicit. Plans and artifacts can contain SSNs, EINs, account numbers, and source paths. Retention, redaction, audit, and access policies need an explicit public contract.
  12. CCH v2 discovery and file paths are not normalized. The v2 CCH capabilities are runnable through the legacy connection’s provider-key fallback but are not yet included in its advertised capability catalog. The v2 backup also returns a full sandboxes/{taskId}/... storage key while Task.file(path:) accepts only the task-relative suffix. Unify discovery and return task-relative artifact paths before treating this as a stable provider-neutral contract.
The user-approved two-step contract should eventually be:
  1. Compile the reviewed semantic plan for an exact execution binding.
  2. Execute only the compiled artifact and hashes returned by that compile.
The compile result should contain the compiled artifact ID, semantic and compiled hashes, adapter and catalog versions, and full coverage. After human approval, dispatch:
The server then resolves and verifies:
This preserves a tax-software-neutral instruction file, keeps vendor details in adapters, and prevents callers from supplying arbitrary host or storage paths.