C

QuickBooks Online MCP Server

Community QuickBooks Online MCP server with full CRUD for invoices, bills, customers, vendors, and accounting

Overall Score55/100

Score Breakdown

Server Info

Package
@qboapi/qbo-mcp-server
Registry
npm
Maintainer
IntuitVendor
Category
Finance & Payments
Tags
accountinginvoicesquickbooks
Last Scanned
7 Apr 2026

Findings

8 issues

Authentication & Identity

HIGHNo per-request auth - requires instance-per-user

OAuth 2.0 via intuit-oauth SDK. If refresh token is not provided, initiates a local browser-based OAuth flow on localhost:8000. Tokens are persisted to the .env file on disk (security concern: writes secrets to filesystem). Stdio transport only. For multi-tenant deployment, the platform must spawn a separate server instance per user.

Remediation

Add HTTP/SSE transport to accept per-request Authorization headers, or implement the MCP OAuth spec.

Tool Schema Quality

HIGHRequired fields missing on 1 write operations

Write tools without required field declarations: delete_customer.

Remediation

Add required arrays to all write/delete tool schemas.

MEDIUMOnly 10 of 50 schemas have parameter constraints

Most schemas lack maxLength, enum, or pattern constraints on string parameters.

Remediation

Add constraints to string parameters, especially on write operations.

CRITICALDangerous execution surface: delete_customer uses z.any() for idOrEntity parameter

Tool allows raw code/query execution which could be exploited via prompt injection.

Remediation

Use parameterized queries or validated command sets.

LLM Safety

MEDIUM5 tool descriptions are too vague

Short or generic descriptions make tool selection unreliable.

Remediation

Expand descriptions with specific actions, data types, and side effects.

Data Exposure

LOWNo field selection on responses

Responses return full records rather than projected fields.

Remediation

Implement field selection to return only relevant fields.

Maintenance & Trust

LOWCommunity-maintained by qboapi (community)

No official vendor backing.

Remediation

Seek vendor verification.

HIGH18 dependency vulnerabilities (3 critical, 9 high)

npm audit found 3 critical and 9 high severity CVEs.

Remediation

Run `npm audit fix` and update vulnerable dependencies.

Tools

50 total
NameDescriptionRisk
create_accountCreate a chart-of-accounts entry in QuickBooks Online.write
create_bill_paymentCreate a bill payment in QuickBooks Online.write
create-billCreate a bill in QuickBooks Online.write
create_customerCreate a customer in QuickBooks Online.write
create_employeeCreate an employee in QuickBooks Online.write
create_estimateCreate an estimate in QuickBooks Online.write
create_invoiceCreate an invoice in QuickBooks Online.write
create_itemCreate an item in QuickBooks Online.write
create_journal_entryCreate a journal entry in QuickBooks Online.write
create_purchaseCreate a purchase in QuickBooks Online.write
create-vendorCreate a vendor in QuickBooks Online.write
delete_bill_paymentDelete (make inactive) a bill payment in QuickBooks Online.admin
delete-billDelete a bill in QuickBooks Online.admin
delete_customerDelete (make inactive) a customer in QuickBooks Online.admin
delete_estimateDelete (void) an estimate in QuickBooks Online.admin
delete_journal_entryDelete (make inactive) a journal entry in QuickBooks Online.admin
delete_purchaseDelete (make inactive) a purchase in QuickBooks Online.admin
delete-vendorDelete a vendor in QuickBooks Online.admin
get_bill_paymentGet a bill payment by Id from QuickBooks Online.read
get-billGet a bill by ID from QuickBooks Online.read
get_customerGet a customer by Id from QuickBooks Online.read
get_employeeGet an employee by Id from QuickBooks Online.read
get_estimateGet an estimate by Id from QuickBooks Online.read
get_journal_entryGet a journal entry by Id from QuickBooks Online.read
get_purchaseGet a purchase by Id from QuickBooks Online.read
get-vendorGet a vendor by ID from QuickBooks Online.read
read_invoiceRead a single invoice from QuickBooks Online by its ID.read
read_itemRead a single item in QuickBooks Online by its ID.read
search_accountsSearch chart-of-accounts entries using criteria.read
search_bill_paymentsSearch bill payments in QuickBooks Online that match given criteria.read
search_billsSearch bills in QuickBooks Online that match given criteria.read
search_customersSearch customers in QuickBooks Online that match given criteria.read
search_employeesSearch employees in QuickBooks Online that match given criteria.read
search_estimatesSearch estimates in QuickBooks Online that match given criteria.read
search_invoicesSearch invoices in QuickBooks Online using criteria (maps to node-quickbooks findInvoices).read
search_itemsSearch items in QuickBooks Online using criteria (maps to node-quickbooks findItems).read
search_journal_entriesSearch journal entries in QuickBooks Online that match given criteria.read
search_purchasesSearch purchases in QuickBooks Online that match given criteria.read
search_vendorsSearch vendors in QuickBooks Online that match given criteria.read
update_accountUpdate an existing chart-of-accounts entry in Quickbooks.write
update_bill_paymentUpdate a bill payment in QuickBooks Online.write
update-billUpdate a bill in QuickBooks Online.write
update_customerUpdate an existing customer in QuickBooks Online.write
update_employeeUpdate an employee in QuickBooks Online.write
update_estimateUpdate an estimate in QuickBooks Online.write
update_invoiceUpdate an existing invoice in Quickbooks by ID (sparse update).write
update_itemUpdate an existing item in Quickbooks by ID (sparse update).write
update_journal_entryUpdate a journal entry in QuickBooks Online.write
update_purchaseUpdate a purchase in QuickBooks Online.write
update-vendorUpdate a vendor in QuickBooks Online.write

Deploy QuickBooks Online MCP Server securely

CompleteFlow adds per-user authentication, permission scoping, and audit logging to any MCP server out of the box.

Deploy on CompleteFlow