Verified

Quickbooks MCP Server

QuickBooks Online accounting data management with human-in-the-loop write protection.

Data last scanned today · Reviewed today

50 15 dangerous tools111 tools★ 4TypeScriptApache-2.0

Overview

This TypeScript-based server provides access to the QuickBooks Online API for AI assistants, offering 141 tools to manage financial data. It is structured to support both read-only operations and complex write functions, allowing users to query ledger information directly through an MCP-compliant interface. The server implements a tiered safety model to mitigate risks inherent in automated accounting. It distinguishes between master data operations and high-risk actions—such as processing payments, generating invoices, or modifying company structure—by forcing human approval before executing any sensitive transaction.

Our verdict

This server carries a high risk level with a security score of 30/100. Because it is a community-maintained project rather than an official QuickBooks integration, and because its authentication and read-only modes remain editorially unverified, it should be used with extreme caution. Users must carefully review the approval-gate configuration, as the project relies on specific client-side permission rules to enforce its safety model. It is not recommended for production environments where rigorous, independent security audits are required.

Supports 141 distinct QuickBooks Online API operations
Implements a strict approval gate for 52 risky write tools
Features a dedicated read-only mode with 70 tools
Maintains a small footprint with only 6 direct dependencies

Community-maintained project with no official vendor support
Authentication methods have not undergone editorial review
Low bus-factor risk due to being maintained by one contributor
Security architecture relies on client-side enforcement of approval rules

Setup

Claude Desktop

{
  "mcpServers": {
    "quickbooks-mcp": {
      "args": [
        "-y",
        "@nichewizard/quickbooks-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
get_balance_sheet	Assets, liabilities, and equity snapshot	low
get_profit_and_loss	Income and expenses over a period	low
get_cash_flow	Cash inflows and outflows	low
get_trial_balance	Debit and credit balances	low
get_general_ledger	Complete transaction history	low
get_customer_sales	Sales by customer	low
get_aged_receivables	Outstanding customer invoices	low
get_aged_receivables_detail	Detailed aging breakdown	low
get_customer_balance	Current customer balances	low
get_aged_payables	Outstanding vendor bills	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›Does this server support a read-only mode?

Yes, you can use the bin/qbo wrapper which registers only 70 read-only tools and excludes all 71 write tools entirely.

›How does the server handle sensitive write operations?

52 tools related to money movement, deletions, and structural edits are classified as 'always-ask', requiring your explicit approval via Claude Code before execution.

›How does the server prevent prompt injection from QuickBooks data?

The server wraps text responses in delimiters and flags potential injection patterns, treating customer-provided data as untrusted input rather than instructions.

›Where does the server store my OAuth credentials?

The server retrieves your OAuth client secret from the macOS Keychain rather than from .env files for enhanced security.

›Can I register both the read-only and write wrappers simultaneously?

No, you should register only one at a time because bin/qbo-write already includes all the read tools found in the standard read-only wrapper.

›What happens if the data sanitizer encounters an error?

The sanitizer is designed to fail open, meaning it will return the data with a warning banner rather than blocking the response.