A raw MCP server hands your model a pen. Nothing hands it a reviewer.
Connecting an assistant to QuickBooks is a solved problem. Intuit publishes an official MCP server, and there are several community ones. They are good at what they do. What none of them do is stand between a confident model and a live general ledger.
The official server is not a bad piece of software.
It is a careful, complete map of the QuickBooks Online v3 API into MCP tools, about 144 of them across 29 entity types, plus reports. If you are a developer exploring a sandbox realm, use it. The problem is not quality. The problem is that an API bridge faithfully inherits the API’s core assumption: that whoever is calling it already knows what they are doing, and meant it.
A language model calling that API is confident in exactly the same tone whether it is right or wrong. On a sandbox realm that is a debugging story. On a client’s books in month eleven of a fiscal year, it is something else.
The QuickBooks column describes Intuit’s open-source QuickBooks Online MCP server as published. Community servers vary; most are thinner. If any of this is out of date, tell us and we will fix it.
Four rules the tools enforce.
These are not settings. They are properties of the tool surface, which means no prompt, however cleverly written or insistent, can talk its way past them.
- 01Reads never gate
Asking questions of the ledger is safe, so it is unrestricted. The friction belongs on writes, not on curiosity.
- 02Plans write nothing
Preparing work produces a plan and a verdict. No plan has ever changed a ledger.
- 03Approval relays a human’s words
The AI cannot approve on a person’s behalf, summarise an approval, or infer one from context.
- 04Apply refuses drift
Approval is pinned to a fingerprint of the exact batch. If anything changed after review, apply refuses rather than guessing.
Common questions.
Is there an official QuickBooks MCP server?
Yes. Intuit publishes an open-source Model Context Protocol server for QuickBooks Online with roughly 144 tools across 29 entity types plus financial reports. It is a well-built reference implementation of the API surface.
So why would I use anything else?
Because a faithful API bridge inherits the API’s assumption that the caller knows what it is doing. Create, update and delete are enabled by default, there is no approval step, no duplicate check, no memory of how this client codes anything, and no reversal path. That is fine for a developer exploring their own sandbox. It is a different proposition on a client’s live ledger.
Can I run both?
Yes. Some people use a read-only raw server for exploration and Zeno for anything that writes. If you followed a “connect Claude to QuickBooks” tutorial this year, check whether writes are still enabled.
Can any MCP server work the QuickBooks bank feed?
No. The banking “For Review” queue has no public API, so neither the official server nor any community bridge can read or act on it. Zeno side-steps the gap with its own feed: live bank connections (or imported statements) stage every line outside the ledger, the firm’s confirmed rules code what they recognize on arrival, lines the ledger already holds link instead of double-posting, and what remains posts as one human-approved batch with a reversal path.
Does Zeno work with Claude and ChatGPT?
Zeno exposes an MCP server over streamable HTTP behind OAuth 2.1 with dynamic client registration, so supported assistants connect to it the way they connect to any remote MCP server. You bring the assistant; Zeno supplies the context and the controls.
What does Zeno actually expose?
Reads and reports that never gate, the plan → review → approve → apply → reverse loop, the QuickBooks list-write surface, firm memory (rules, knowledge, playbooks, work log), a document inbox, and a governed bank feed with rule coding, duplicate matching, and transfer detection. Reads are open because reads are safe. Writes are the part that has to earn permission.