QuickBooks and MCP: read the books before posting

QuickBooks MCP lets an AI agent call tools connected to QuickBooks Online to retrieve records and prepare bookkeeping explanations or reconciliation drafts. As of 30 Oct 2026, Intuit publishes a local MCP server and documents an invitation-only hosted pilot; their setup and available tools differ. Start with reads and keep proposed changes outside the books until a person reviews them.

What it can do

A useful first task is explaining a movement in expenses, with evidence the bookkeeper can inspect. The local server's profit and loss tool accepts a date range and a Cash or Accrual accounting method. Ask for comparable periods and have the agent distinguish returned figures from its explanation of them.

For transaction detail, the general ledger tool supports date ranges, accounting method and an account filter. Use that output to investigate an unexpected balance. Require the answer to retain the selected company, period, account and retrieval time, rather than presenting a detached total.

For a reconciliation draft, provide an authorized statement extract alongside retrieved ledger detail. Ask the agent to propose matches, list unmatched items and explain ambiguous pairs. The deliverable should be a review table containing source references, matching reasons and unresolved questions. Treat a likely match as a suggestion; a similar amount or description does not establish that records describe the same event.

This is a proposed workflow, not a claim that either server completes bank reconciliation. For the broader connection pattern, see MCP versus APIs and the MCP servers for apps category.

Reading and changing the books are different permissions

The local repository describes both retrieval and mutation tools. Creating an invoice, updating a bill or deleting a transaction changes company data; writing a proposed adjustment into a local review document does not. Even creating a record that you intend to review later is already a write.

The local server's registration code suppresses create, update and delete categories through separate environment switches. Its classification depends on tool-name prefixes, so inspect the tools actually exposed by your installed revision. These controls restrict the server's interface; they do not reduce the authority of credentials used elsewhere.

The hosted pilot requires com.intuit.quickbooks.accounting plus restricted MCP scopes. Its invoice scopes separate retrieval (sales.tools.invoice.read) from actions (sales.tools.invoice). Local switches do not configure hosted permissions; check the current documentation with Intuit.

A prompt asking for read-only work is useful guidance, but it needs technical enforcement. Keep writes unavailable during investigation. Follow permissions-first MCP practice when deciding what the agent may call.

How to connect it safely

1. Choose the connection path. For a local setup, start from the Intuit repository and review the revision and build instructions. It runs as a local stdio process. The hosted pilot is a separate service with invitation and app onboarding requirements; knowing its endpoint does not grant access. Check the current documentation before choosing either route.

2. Authorize a test company first. The local authentication implementation uses an Intuit app, client credentials, an Accounting authorization request and a company identifier, also called a realm ID. Keep sandbox and production settings separate. Complete the documented browser authorization and confirm the selected company before retrieving anything. Protect client secrets and refresh tokens from chat, shared configuration and source control.

3. Disable mutation categories before starting. For the local implementation, configure the server process with the following settings, then inspect its discovered tools. The registration code tests for the literal value true:

text QUICKBOOKS_DISABLE_WRITE=true QUICKBOOKS_DISABLE_UPDATE=true QUICKBOOKS_DISABLE_DELETE=true

Reject an unexpected action tool. Check what it does instead of assuming its name proves it is safe.

4. Add it to an MCP-capable editor client. In VS Code, use the Command Palette command MCP: Add Server, select Command (stdio) for the local server and enter the reviewed launch command and arguments. Follow the VS Code connection guide for your selected client configuration and credential handling. An editor's MCP support does not mean every chat extension can invoke that server. See MCP in VS Code for the surrounding workflow.

5. Prove a bounded read. Request a report for a known period and accounting method. Expand the tool result, confirm the expected server handled the request and compare its figures with the corresponding report in QuickBooks Online. Save the request parameters with the draft. If the values disagree, investigate before using the explanation.

6. Review before any posting. Keep the reconciliation proposal in a document. Have the bookkeeper check references, account coding, dates and unresolved differences. If a change is approved, use a separately authorized workflow that identifies the exact records and proposed values. Then verify the resulting records. Approval of an explanation is not blanket approval to modify the ledger.

When this does not work

A connection is not established by a convincing answer. Inspect the actual tool output. A startup failure, failed authorization or missing tool leaves the agent without the evidence needed for its answer.

Authentication can fail after setup. Redirect mismatches, invalid credentials and expired or revoked authorization need diagnosis. The local client implementation also persists rotated refresh tokens. A token store that cannot be updated can disrupt continued access; check its documented storage requirements. Do not troubleshoot by pasting tokens into a prompt.

Ledger reads do not establish bank-feed coverage. Intuit Developer Support states that the Accounting API does not expose the pending bank-feed review count or bank-sync timestamp in its response about bank transaction metrics. If your reconciliation depends on those metrics, check the current documentation and obtain the missing evidence through an authorized process.

Matching needs complete evidence. A partial statement, omitted records or inconsistent reporting basis can produce a plausible but incomplete draft. Label missing inputs and ambiguous matches. Treat descriptions and notes in retrieved records as business data, not instructions to change permissions or contact someone.

Where Tvijo fits

As of 30 Oct 2026, the DSHREM VS Code extension provides an editor entry point for questions and selected context. A suitable task is explaining a redacted bookkeeping extract or reviewing a reconciliation draft. Decide which financial data may leave your machine using Permissions and data flow.

TvijoCode is a test build with the extension embedded. Tvijo MCP exposes Tvijo consultation to compatible clients; supplied-diff review is prepared, with publication pending in the dated release status. Editor integration and delegation remain planned phases. These capabilities do not establish a ready QuickBooks connector. Live ledger access requires a separately scoped and tested integration; posting must wait for review.

The Tvijo workspace shows these offers as of 31 Oct 2026: Try costs $0, allowing up to 50 tasks, 100,000 tokens or $0.05 of sponsored usage, whichever is reached first, from a shared $1 daily pool funded by TVIJO. Service credit is shown as $10 to request prepaid credit, with metered provider usage plus an 8% service markup. Payment collection is not activated; an order is not a charge.

FAQ

Is there an official QuickBooks MCP server?

Yes. Intuit publishes a local QuickBooks Online MCP repository and documents a separate hosted pilot by invitation. Choose the intended path before following setup instructions.

Does connecting MCP make access read-only?

No. For the local server, configure the category restrictions and verify the exposed tools. Restrict access to its credentials too; filtering tools does not narrow the OAuth token itself.

Can an agent reconcile and post adjustments automatically?

For this workflow, stop at a reconciliation draft. A bookkeeper reviews evidence and proposed changes; any approved posting belongs to a separate, explicitly authorized action.

QuickBooks is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.