QuickBooks Online

What it is

The cloud ledger many US small businesses and their bookkeepers use: invoices, bills, the bank feed, accounts and reports.

How an agent connects

1. Through the gateway (the default for client work). The owner presses "Connect QuickBooks Online" on their agents page and signs in with Intuit. We keep the sign-in in our vault; the agent gets a token that can do only what the owner ticked, and calls quickbooks.query, quickbooks.report, quickbooks.draft_invoice and quickbooks.draft_bill (below). One connection reaches one company.
2. Intuit's own MCP server. Intuit publishes a QuickBooks Online MCP server on GitHub. It covers create, read, update, delete and search for the common records and the main reports, with switches to turn off writes, updates and deletes. Use it only on a sandbox company, with those switches off; on a client's books, the gateway is the route.
3. Exports. Any report or list can be exported to a spreadsheet by the owner or bookkeeper. Many of our workflows start here.
4. n8n and Zapier both have QuickBooks Online connectors. n8n can run self-hosted, so ledger lines stay on the firm's machine.

What agents may do

agent_access: write-with-approval. An agent may look up invoices, bills, customers, vendors, items, accounts, payments and purchases, and read the profit and loss, balance sheet and aging reports. It may ask to create an invoice that is not sent, or to enter a bill that is not paid; each waits for the owner's approval. A person sends every invoice, records every payment, posts journal entries and changes every account. Deletes are never allowed.

Through the gateway

Action	What it does	Held?
quickbooks.query	Lists Invoice, Bill, Customer, Vendor, Item, Account, Payment or Purchase records, filtered on a fixed list of fields (up to 100 a page)	No (read, logged)
quickbooks.report	ProfitAndLoss, BalanceSheet, AgedReceivables or AgedPayables, flattened to rows	No (read, logged)
quickbooks.draft_invoice	Creates an invoice and never emails it	Always
quickbooks.draft_bill	Enters an open bill; nothing is paid	Always

The agent never sends a query string: it names the entity, the fields, the operators and the values, and the gateway builds the query. Reads are on when the owner connects; each write is off until the owner ticks it. Payments, refunds, voids, deletes, sending invoices, payroll, bank transfers and user changes are never automated: the gateway refuses them by name (403 never_automated). Examples are in docs/GATEWAY.md, "Business systems".

Watch out for

• Run the MCP server with writes, updates and deletes switched off unless the owner approved one write path.
• One OAuth grant reaches one company. An accounting firm must connect each client company separately and keep them apart.
• Client ledgers are confidential. Keep card and bank account numbers out of prompts and logs.
• Intuit allows 500 requests a minute per company. On a refusal, wait a minute instead of retrying fast; the gateway's own hourly limit is usually lower anyway.
• Community servers in the registry are not vetted. Do not point one at real books.