The server provides 144 tools in total. These cover create, read, update and delete operations across 29 entity types including Customer, Invoice, Bill and Payment, although some entities have no create or delete tool. It also exposes 11 financial reports such as the Balance Sheet and Profit and Loss, plus tools for attachments, company information, invoice PDF download and tax lookups.
Authentication runs on OAuth 2.0. The user registers an application on the Intuit Developer Portal and completes a one-time browser handshake. The sandbox accepts localhost redirect URIs, while production requires a public HTTPS callback for that initial handshake. Refresh tokens rotate automatically within a 100-day refresh window.
The repository is public under the Intuit account, shows 343 stars and 198 forks, and claims 396 tests at full coverage. It carries no release dates or version history, the Releases section is empty, and the licence is stated inconsistently: the README says MIT while the repository sidebar says Apache 2.0.
144 tools, and three environment variables that take most of them away
The governance detail is the commercially interesting one. Setting QUICKBOOKS_DISABLE_WRITE, QUICKBOOKS_DISABLE_UPDATE or QUICKBOOKS_DISABLE_DELETE prevents those categories of tool from registering at all. Read tools remain available in every configuration.
That is a meaningfully different security posture from an integration that holds full permissions and relies on the model behaving well. The capability is removed before the agent ever sees it.
For bookkeepers, fractional finance teams and the accounting software firms that serve them, this is where a service sits. Most small businesses will not configure an MCP server, decide which tool categories to disable or manage an OAuth application. They will, however, pay someone to answer questions against their own ledger without handing an assistant the ability to post entries.
A read-only configuration covering reports, invoices and customer records is a defensible first product. It answers the questions owners actually ask, cash position, overdue invoices, spend by supplier, without creating an audit problem.
Xero has been moving the same way. Its own MCP server exists and the company reported usage growing tenfold between December 2025 and May 2026, exceeding one million API calls by June. Two of the largest small-business ledgers are now addressable by agents through the same protocol.
The constraints are real. The Intuit server runs locally, which suits a developer or a partner operating on behalf of a client but not a self-service product. Production OAuth needs a public callback. And no release history means no visible commitment to stability.
A sensible test is one client and one question set. Configure the server read-only, work through the twenty questions that client asks most often each month, and measure how many are answered correctly without a human opening the ledger. If accuracy is poor on the questions that matter, the write controls were never the hard part.
More information
Source and more information: Intuit – QuickBooks Online MCP Server