Quickbooks Online MCP Server

Financial data and reporting access for your AI assistant via QuickBooks Online API.

Data last scanned last week · Reviewed last month

70★ 335TypeScriptApache-2.0

Overview

This server provides extensive integration with QuickBooks Online, offering support for 144 tools, 29 entity types, and 11 financial reports. It enables AI models to perform full CRUD operations on accounting data, including balance sheets and cash flow statements, using Zod-validated TypeScript interfaces. Designed for local execution via stdio, the server requires an OAuth 2.0 handshake through the Intuit Developer Portal. While it facilitates complex interactions with financial records, users must manage their own OAuth application credentials and redirect configurations for both sandbox and production environments.

Our verdict

With a security score of 45/100, this server is currently classified as high risk. This rating reflects the fact that it is community-maintained rather than official software, and critical security components like OAuth implementation and read-only mode support have not yet undergone independent editorial review. Users handling sensitive financial data should exercise caution and verify the source code before deployment.

Supports 144 distinct tools for comprehensive API coverage
Includes full CRUD operations for 29 entity types
Maintains a small footprint with only 6 direct dependencies
Features a robust test suite with 396 tests

Not maintained by the official vendor
Authentication and read-only support lack independent review
Requires manual Intuit Developer Portal application setup

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What is required to authenticate with QuickBooks Online?

You must register an app on the Intuit Developer Portal and perform a one-time, browser-based OAuth 2.0 handshake to obtain your credentials.

›Does the server require a public URL for authentication?

Sandbox environments support local http://localhost callback URLs, while production environments require a public HTTPS callback for the initial authorization.

›Can I restrict the server's ability to modify my accounting data?

Yes, you can use the environment variables QUICKBOOKS_DISABLE_WRITE, QUICKBOOKS_DISABLE_UPDATE, and QUICKBOOKS_DISABLE_DELETE to suppress those tool categories. Read operations remain available regardless of these settings.

›How long does the authentication remain valid?

The server runs locally without further browser interaction until the OAuth refresh token window, which is 100 days, lapses.

›Does the server need a constant internet connection?

Yes, it must be able to communicate with the QuickBooks Online API to perform operations, though it runs locally as a stdio subprocess on your machine.