A QuickBooks Online MCP server that provides 141 API tools with a safety model that pauses risky writes for human approval and treats QuickBooks text as untrusted input to prevent injection attacks.

Stars

4

7-day growth

No data

Forks

0

Open issues

0

License

Apache-2.0

Last updated

2026-07-30

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It addresses the unique risk of giving AI write access to real accounting data by implementing a two-tier safety model: writes require human approval and QuickBooks text is delimited and flagged for injection, making it production-ready for live books.

Who it is for

  • Developers integrating AI assistants with QuickBooks Online
  • Accountants and bookkeepers using AI-powered tools
  • Businesses automating accounting workflows with human oversight
  • MCP server developers seeking a reference for safe write access

Use cases

  • Automating invoice, estimate, and bill creation with manual approval
  • Retrieving financial reports (balance sheet, P&L) via natural language queries
  • Bulk updating master data (customers, vendors, items) without prompting
  • Safe experimentation in a sandbox environment before production deployment

Strengths

  • 141 tools covering the full QuickBooks Online API, including 70 read-only tools and 52 write tools requiring approval
  • Read-only mode is enforced at registration time, preventing write tools from being registered at all
  • Injection detection with delimiters and 14 pattern rules, plus a fail-open fallback
  • Comprehensive test suite: 771 tests with 100% code coverage

Considerations

  • The approval gate is a prompt, not a policy engine; it does not prevent an approved but incorrect write
  • Injection detection is pattern-based and may miss novel phrasings
  • Only tested on macOS with Claude Code; other MCP clients get the sanitizer but no confirmation gate

README quick start

Quick Start

Description

A QuickBooks MCP server built for real books. Exposes QuickBooks Online as callable tools over the Model Context Protocol, with every create, update and delete gated behind human approval and a plain-English summary, and all QuickBooks text treated as untrusted input rather than instructions.

Related repositories

Similar projects matched by category, topics, and programming language.

0xwilliamortiz
Featured
0xwilliamortiz GitHub avatar

openclaude-improved

OpenClaude is an open-source CLI coding agent that runs on any platform and supports a wide range of LLM providers, offering the same tools and workflows as Claude Code.

AI & Machine LearningLarge Language Models
577
mereyabdenbekuly-ctrl
Featured
mereyabdenbekuly-ctrl GitHub avatar

clodex-ide

Clodex is an open-source, local-first agentic IDE that combines persistent AI tasks, code, terminal, browser, Git, models, memory, and governed execution in one Electron workspace, currently in technical preview.

AI & Machine LearningAI Agents
859
Jakubantalik
Featured
Jakubantalik GitHub avatar

thinking-orbs

A React component library that renders six hand-tuned animated thought orb loading indicators on a plain 2D canvas, with two purpose-tuned sizes and automatic theme detection for AI and agent UIs.

AI & Machine LearningAI Agents
1,191