A QuickBooks MCP server built for real books. Exposes QuickBooks Online as callable tools over the Model Context Protocol, with every create, update and delete gated behind human approval and a plain-
View on GitHub ↗A QuickBooks Online MCP server built for real books — writes pause for a human, and QuickBooks text is never trusted
Safety Model Quick Start Available Tools Authentication Limitations
Giving an AI assistant write access to live accounting data is a different proposition from giving it read access. A misread instruction doesn't produce a wrong answer — it produces a wrong invoice, sent to a real customer, or a deleted transaction recoverable only from an audit log.
This server exposes the full QuickBooks Online API as MCP tools, and adds two things around them: writes stop for human approval, and text that came out of QuickBooks is treated as data rather than instructions.
Every create, update and delete call surfaces an approval prompt describing the operation in plain English before it executes:
Money documents always prompt, regardless of amount. Master-data creates (customers, vendors, items, classes) execute and are reported afterwards, so bulk setup work stays usable.
Tier Behaviour Tools :--:----: Always ask invoices, bills, estimates, purchases, payments, journal entries, transfers, deposits, credit memos, attachments, every delete 52 Auto customers, vendors, employees, items, accounts, classes, departments, terms, payment methods, time activities 19
The gate fails closed. Unparseable input, a missing build, a crashed summariser — every error path produces a prompt, never silent execution. An unrecognised tool name asks by default, so a tool added later is gated before anyone remembers to classify it.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/nichewizard--quickbooks-mcp.html)
MCP security scanner — vet a Model Context Protocol server before you add it to Claude Code, Cursor, or Windsurf. Grades it A–F, catching credential theft, tool-poisoning, and install-script payloads
Smitner-Studio/facetRender agent-written Markdown as a live local page, and send the human's click back to the agent as typed data. Human-in-the-loop approval gates for coding agents.
herry2059/project-os-for-codexOpen-source control plane for Codex projects: Git-backed context, visible agent progress, scoped MCP access, resumable work, and safe handoffs.
illiahaidar/mcptrustcheckerMCP security scanner — offline, deterministic A–F Trust Score for Model Context Protocol servers. Detects tool poisoning, prompt injection & toxic flows.
flankerhqd/cyvisguardSecurity control plane for AI agents — identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP. Guards a real Claude Code end to end.
abluva/mcp-remoteThe bridge for remote MCP — seamless OAuth, resilient auth recovery, production-grade reliability
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.