QuickBooks MCP Server: How to Connect It to an AI Assistant

Yes, Intuit publishes an open-source QuickBooks Online server built on the Model Context Protocol (MCP). It runs locally on your machine as a stdio subprocess.

Connecting an AI assistant requires an Intuit developer application, a local Node environment, a completed browser-based OAuth authorization flow, and a client configuration file.

How to Connect the QuickBooks MCP Server

To connect an AI assistant, you register an app with Intuit and build the server locally with Node. You then complete a one-time OAuth handshake, set five environment variables and add the server to your MCP client. Intuit does not issue per-user Application Programming Interface (API) keys, which means every connection requires an application registered on the Intuit Developer Portal.

The setup follows the README in the official GitHub repository. The server reads the five environment variables below, and the numbered steps follow the table.

The README's clone example uses a placeholder URL containing your-username, so the real repository URL has to be copied from the repository's GitHub page before the clone works.

Set QUICKBOOKS_ENVIRONMENT to sandbox on the first run. The sandbox accepts the localhost callback used with npm run auth, and production does not, so a production company needs the public HTTPS callback described below.

• Step 1: Register an app on the Intuit Developer Portal.
• Step 2: Clone the repository, using the real URL from the repository's GitHub page.
• Step 3: Execute npm install within the project directory to install dependencies.
• Step 4: Run npm run build to compile the server source code.
• Step 5: Copy .env.example to .env and set the five variables in the table.
• Step 6: Run npm run auth to complete the one-time, browser-based OAuth handshake.
• Step 7: Add the server to your MCP client configuration as an mcpServers entry with command, args and env, as in the README's Claude Code example.

Tools and Capabilities in the QuickBooks MCP Server

The QuickBooks MCP server provides 145 tools covering 29 entity types, 11 financial reports, company preferences and attachments.

The server offers create, read, update, delete and search tools for 29 entity types, though some entities lack update or delete tools. The entities include customers, invoices, bills, vendors, payments, employees, accounts, items and journal entries. Because of those gaps, an assistant cannot edit or remove every record type even with all tools enabled.

The server includes 11 financial reports, among them the Balance Sheet, Profit and Loss, Cash Flow, Trial Balance, General Ledger, Aged Receivables and Aged Payables.

The tools also cover tax lookups, company info, preferences, attachments and invoice PDF download. A connected assistant can read reports and records, and unless the flags described below are set, it can also create, update and delete them.

Sandbox Versus Production Setup Requirements

Intuit's sandbox accepts a localhost callback, and production requires a public HTTPS callback.

For initial testing, the README recommends a sandbox company. Register http://localhost:8000/callback as the redirect URI in your Intuit app, then run npm run auth to complete the handshake.

The redirect URI registered in Intuit must match exactly, so a production app needs the public HTTPS address registered rather than localhost.

To meet the HTTPS requirement while running locally, the README suggests an ngrok tunnel or a small hosted callback handler. After the handshake succeeds, day-to-day use depends on the refresh token.

Limiting Assistant Write and Delete Access

The QuickBooks MCP server provides three environment flags to restrict an assistant's ability to create, modify, or remove financial records.

Each optional flag suppresses its matching tool category when it is set to true, and the README says a flagged category is then not registered. QUICKBOOKS_DISABLE_WRITE covers write tools, QUICKBOOKS_DISABLE_UPDATE covers update tools and QUICKBOOKS_DISABLE_DELETE covers delete tools.

Setting only QUICKBOOKS_DISABLE_WRITE does not make the server read-only, because the README says update and delete tools stay active. A team that wants an assistant limited to reading reports and records must set all three flags: QUICKBOOKS_DISABLE_WRITE, QUICKBOOKS_DISABLE_UPDATE and QUICKBOOKS_DISABLE_DELETE.

Token Rotation Mechanics and Storage Rules

Refresh tokens rotate and the server writes the new token back to .env. The README mentions a 100-day refresh window after which re-authorization is needed, so someone on the team has to own that upkeep.

On a read-only file system, set the QUICKBOOKS_TOKEN_STORE_PATH environment variable to an absolute, writable path in the host process environment. Setting it in .env has no effect. When it is set, the server does not read .env at all.

The server finds .env relative to the compiled module, not the shell's working directory, which matters when a desktop app launches it.

Model Context Protocol Definition and Supported Clients

The Model Context Protocol documentation defines MCP as an open-source standard designed to connect artificial intelligence applications to external systems. Through it, AI applications like Claude or ChatGPT can connect to data sources, tools, and workflows.

The documentation compares MCP to a USB-C port for AI applications.

The documentation names Claude, ChatGPT, Visual Studio Code and Cursor as MCP clients. For a wider look at AI in bookkeeping, see AI bookkeeping for small business.

The README's setup example targets Claude Code and uses an mcpServers block with command, args and env fields. The README gives no Claude Desktop setup steps, so Claude Desktop users have no README steps to follow beyond its note on where .env is found.

Who Should Skip the QuickBooks MCP Server

The QuickBooks MCP server is a poor fit for a team that cannot run Node, manage a local process and maintain developer credentials. For automation that does not involve running this server, see bookkeeping automation.

Skip the server if you need a hosted endpoint, work only in QuickBooks Desktop or cannot keep up token maintenance. The README describes a local server for QuickBooks Online. It does not describe a hosted endpoint and does not mention QuickBooks Desktop. A team that fits none of those cases can run the sandbox first, as the README recommends, and decide on production later.

Four changes would alter this advice:

• A hosted MCP endpoint from Intuit that removes the need to run Node locally.
• Native support within the codebase for QuickBooks Desktop.
• A README change that removes the public HTTPS callback requirement for production.
• A license that reads the same in the README and on GitHub (today the README says MIT and the GitHub sidebar says Apache-2.0).

Starting Safely with the QuickBooks MCP Server

The license is unresolved in the sources. The README text and badge say MIT, and the GitHub sidebar says Apache-2.0. The sources do not reconcile the two, and the LICENSE file in the repository is the place to check.

Anyone who can run Node and maintain an Intuit developer app can start in a sandbox company, which the README recommends for first runs. Moving to production adds the public HTTPS callback and refresh-token upkeep described above.

The README says QUICKBOOKS_DISABLE_WRITE alone leaves update and delete tools active. Set all three disable flags before connecting an assistant, and widen access only after checking what the assistant returns.