QuickBooks MCP: When Intuit's Official Connector Is Enough, and When You Need Your Own

A QuickBooks MCP server lets AI assistants like Claude or ChatGPT read and write your QuickBooks through a set of tools: search customers, list open invoices, create an invoice. For QuickBooks Online you no longer need to build one: Intuit publishes an open-source MCP server with 145 tools, and QuickBooks has a connector for Claude. Build your own when you run QuickBooks Desktop, when the assistant has to work across QuickBooks and your other systems, or when you want writes to wait for a person's approval rather than a switch that turns them all on or off. Below: what the official options cover, and a run on a live sandbox where the assistant drafts an invoice and a person approves it.

---

The official options

Intuit's QuickBooks Online MCP server is open source on GitHub. It has 145 tools across 29 entity types (customers, invoices, bills, payments and the rest) and 11 reports such as the balance sheet and profit and loss. It runs locally, as a subprocess of the assistant, against one QuickBooks Online company. You register an app on Intuit's developer portal and complete a one-time OAuth handshake; after that, it runs without further browser interaction until the refresh window lapses. Read tools are always on, and three flags can switch off all create, all update or all delete tools.

The QuickBooks connector for Claude is the no-setup version: you connect it from Claude and sign in to QuickBooks. It is part of what Anthropic bundles in Claude for Small Business.

For a bookkeeper asking questions of their own books ("Which invoices are more than 60 days overdue?", "What did we spend on subcontractors last quarter?"), either one is enough. Use it.

When you need your own

• You run QuickBooks Desktop. The official server and connector are for QuickBooks Online. Desktop is reached through the Web Connector and qbXML, which we explain in QuickBooks Web Connector and qbXML.
• The work crosses systems. An order arrives in your ERP, your CRM or a WhatsApp chat and has to become a QuickBooks invoice. The assistant needs tools on both sides, with the same permission rules.
• Writes need an approval, not a switch. A flag that removes every create tool is safe and useless for invoicing. What most businesses want is "draft freely, write only what a person approved".
• Matching is specific to you. Your customers order by nickname, your items have three spellings, your prices depend on the customer. That logic belongs in the server, not in a prompt.
• Several people, one hosted service. A local subprocess per person works for one bookkeeper. A team needs a hosted server where each user signs in and acts with their own permissions.

A run on a live sandbox

We built a small QuickBooks MCP server to see what this takes in practice, and ran it against a QuickBooks Online sandbox company. The code is on GitHub, Apache 2.0. It has five tools: search_customers, search_items and list_open_invoices are read-only; draft_invoice writes nothing; create_invoice is the only write.

The order, as a customer would email it: "2 fountains, 30 sprinklers and 3 hours of install for Cool Cars."

1. The assistant drafts it. draft_invoice matched "Cool Cars", "fountain" to Rock Fountain at $275, and "install" to Installation at $50 an hour. Then it stopped:

ready: false
problems: "sprinkler" matches 2 items (Sprinkler Heads, Sprinkler Pipes): which one?

It didn't pick one. A wrong guess here is a wrong invoice.

2. The person answers "sprinkler heads". The new draft is ready: $550 + $60 + $150 = $760. The assistant shows it.

3. The assistant tries to create it with the old total. The server refuses:

total is now 760.00 but 700.00 was approved; show the new draft first

create_invoice rebuilds the draft from QuickBooks and only writes if its total equals the approved_total the person saw. If a price changed in between, or the assistant passes a stale number, nothing is created.

4. With the approved total, it writes. Invoice 1038 for Cool Cars, $760, due 30 days later, and it appears in list_open_invoices.

That is the whole safety model, and none of it is in the prompt: names that match several records are reported, not resolved; the only write requires a draft a person approved; and the server checks the approval itself.

What we learned building it

• The API is the easy part. OAuth, a query endpoint and an invoice endpoint took an afternoon. The matching and the approval rule are where the thinking goes. More on the API side in QuickBooks API integration.
• Refresh tokens rotate. Each refresh returns a new refresh token and retires the old one. Save it every time, or the connection dies weeks later for no visible reason.
• Mark the tools honestly. Four of the five are read-only, and say so. Assistants and clients use that flag to decide what they can call without asking.
• Keep the tool list short. 145 tools is complete coverage. Five tools shaped around one job are easier for an assistant to use correctly, and easier for you to audit. See MCP server examples for how we shape tools in other systems.

Questions to ask before you connect an assistant to QuickBooks

• Which tools can write, and can a write happen without a person seeing it first?
• What happens when a name matches two customers or two items?
• Does it act as each user, or with one shared connection?
• Where are the tokens stored, and who rotates them?
• Does it reach the other systems the work depends on?

Related: QuickBooks automation with AI, QuickBooks API integration, and How to build an MCP server.