A QuickBooks MCP server built for real books. Exposes QuickBooks Online as callable tools over the Model Context Protocol, with every create, update and delete gated behind human approval and a plain-
View on GitHub ↗A QuickBooks Online MCP server built for real books — writes pause for a human, and QuickBooks text is never trusted
Safety Model Quick Start Available Tools Authentication Limitations
Giving an AI assistant write access to live accounting data is a different proposition from giving it read access. A misread instruction doesn't produce a wrong answer — it produces a wrong invoice, sent to a real customer, or a deleted transaction recoverable only from an audit log.
This server exposes the full QuickBooks Online API as MCP tools, and adds two things around them: writes stop for human approval, and text that came out of QuickBooks is treated as data rather than instructions.
Every create, update and delete call surfaces an approval prompt describing the operation in plain English before it executes:
Money documents always prompt, regardless of amount. Master-data creates (customers, vendors, items, classes) execute and are reported afterwards, so bulk setup work stays usable.
Tier Behaviour Tools :--:----: Always ask invoices, bills, estimates, purchases, payments, journal entries, transfers, deposits, credit memos, attachments, every delete 52 Auto customers, vendors, employees, items, accounts, classes, departments, terms, payment methods, time activities 19
The gate fails closed. Unparseable input, a missing build, a crashed summariser — every error path produces a prompt, never silent execution. An unrecognised tool name asks by default, so a tool added later is gated before anyone remembers to classify it.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/nichewizard--quickbooks-mcp.html)
Open-source MCP server for comparing products and asking the buyer before purchase.
graygnatconsole/mcp-audit-tool🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI
PyModel/jev-judge-mcpTyped judgment tools for MCP agents. TypeSafe's Jev model as verify, screen, find, classify, rerank, decide, compare, extract, review, gate, and score: the model judges, policy decides auto, review, o
Shalimov04/mcp-airlockStateless governance proxy for MCP (2026-07-28): policy, dry-run, human confirmation, audit, tracing
CTRLRun/ctrlrunThe execution safety layer for AI agents.
batrapulkit/squidbrakeBrakes for your AI agents: every tool call is checked against your rules, held for human approval when risky, and recorded in a tamper-evident audit trail. Works with Claude Code and any MCP app.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.