# QuickBooks Online (npm · @mindstone/mcp-server-quickbooks)

QuickBooks Online MCP server: invoices, bills, customers, vendors, employees, and accounts

- Trust score: 71/100 (medium)
- Change this week: +66
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@mindstone/mcp-server-quickbooks`: 71/100 (this document), [markdown](https://verifymcp.io/servers/mindstone-mcp-server-quickbooks/mindstone-mcp-server-quickbooks.md), [page](https://verifymcp.io/servers/mindstone-mcp-server-quickbooks/mindstone-mcp-server-quickbooks)

## Channel facts

- Registry: `npm`
- Package: `@mindstone/mcp-server-quickbooks`
- Version: `0.3.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (FSL-1.1-MIT) isn't a recognized OSI-approved license.
  - Actively maintained (last published 80 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1742 tokens (~134/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 37/100
  - Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add mindstone-mcp-server-quickbooks -- npx -y @mindstone/mcp-server-quickbooks
```

### Codex

```bash
codex mcp add mindstone-mcp-server-quickbooks -- npx -y @mindstone/mcp-server-quickbooks
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mindstone-mcp-server-quickbooks": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mindstone/mcp-server-quickbooks"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mindstone-mcp-server-quickbooks --command npx --arg -y --arg @mindstone/mcp-server-quickbooks
```

### Hermes

```yaml
mcp_servers:
  mindstone-mcp-server-quickbooks:
    command: "npx"
    args: ["-y", "@mindstone/mcp-server-quickbooks"]
```

### Other

```json
{
  "mcpServers": {
    "mindstone-mcp-server-quickbooks": {
      "command": "npx",
      "args": [
        "-y",
        "@mindstone/mcp-server-quickbooks"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-07 (score 71, +4)

- [security improvement] Known CVEs: partial → pass
- [functional] Dependency health: partial → 0.85

### 2026-08-06 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-05 (score 66, +1)

- [security improvement] CVE-2026-69207 no longer affects this package
- [security improvement] Known CVEs: fail → partial

### 2026-08-04 (score 65, +3)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 62, +42)

- [security regression] Provenance: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] License: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: FSL-1.1-MIT

### 2026-08-01 (score 20, +15)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −39)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

## MCP tools (13)

### `configure_quickbooks` (~253 tokens)

Configure QuickBooks Online credentials. Call this when the user provides their Intuit Developer app credentials.

WORKFLOW:
1\. Go to https://developer.intuit.com/ and create an app (or use existing)
2\. Get the Client ID and Client Secret from the app's Keys & credentials page
3\. Add http://localhost:8000/callback as a Redirect URI
4\. Use the OAuth Playground or your app's auth flow to obtain a Refresh Token
5\. Find your Company ID (Realm ID) in the URL when logged into QuickBooks Online

COMMON MISTAKES:
\- Refresh tokens expire after 100 days of inactivity — re-authenticate if you get auth errors
\- The Realm ID is NOT the same as the Client ID — it's your company identifier
\- Sandbox and Production use different credentials

Input parameters:

- `clientId` (string, required): Intuit Developer app Client ID
- `clientSecret` (string, required): Intuit Developer app Client Secret
- `environment` (string): "sandbox" or "production" (default: production)
- `realmId` (string, required): QuickBooks company ID (Realm ID)
- `refreshToken` (string, required): OAuth2 refresh token from the authorization flow

### `query_quickbooks` (~205 tokens)

Run a QuickBooks query using the QuickBooks Query Language.

Returns matching entities. QuickBooks uses a SQL-like query language.

Example: { "query": "SELECT * FROM Invoice WHERE Balance > '0' ORDERBY DueDate" }
Example: { "query": "SELECT * FROM Customer WHERE Active = true" }

WORKFLOW:
1\. Use this for flexible searches across any entity type
2\. Entity names are PascalCase: Invoice, Customer, Vendor, Bill, Employee, etc.
3\. String values use single quotes, dates use 'YYYY-MM-DD' format

COMMON MISTAKES:
\- Entity names are case-sensitive PascalCase (Invoice, not invoice)
\- Use single quotes for string/date values, not double quotes
\- LIKE operator uses % wildcard: DisplayName LIKE '%Smith%'

Input parameters:

- `limit` (number): Max results (default: 100, max: 1000)
- `query` (string, required): QuickBooks Query Language statement

### `get_quickbooks_entity` (~92 tokens)

Get a single QuickBooks entity by type and ID.

Example: { "entityType": "Invoice", "entityId": "123" }

Supported entity types: Account, Bill, BillPayment, Customer, Employee, Estimate, Invoice, Item, JournalEntry, Purchase, Vendor

Input parameters:

- `entityId` (string, required): Entity ID
- `entityType` (string, required): Entity type (PascalCase)

### `list_quickbooks_invoices` (~159 tokens)

List invoices from QuickBooks Online.

Returns: Id, DocNumber, TxnDate, DueDate, Balance, TotalAmt, CustomerRef, Line items.

Example: {}
Example: { "status": "unpaid" }
Example: { "customerId": "123" }

WORKFLOW:
1\. Call with no args to see recent invoices
2\. Filter by status (unpaid/paid/overdue) or customer
3\. Use get_quickbooks_entity for full invoice details

Input parameters:

- `customerId` (string): Filter by customer ID
- `limit` (number): Max results (default: 50)
- `status` (string): Filter: "unpaid", "paid", or "overdue"

### `create_quickbooks_invoice` (~178 tokens)

Create a new invoice in QuickBooks Online.

Example: { "customerId": "123", "lines": [{ "description": "Consulting services", "amount": 1500 }] }

WORKFLOW:
1\. Use list_quickbooks_customers to find the customer ID
2\. Create with line items (description + amount required)
3\. Optionally set dueDate and memo

COMMON MISTAKES:
\- customerId is required (use list_quickbooks_customers to find it)
\- Each line needs at least description and amount
\- Dates use YYYY-MM-DD format

Input parameters:

- `customerId` (string, required): Customer ID (required)
- `dueDate` (string): Due date (YYYY-MM-DD)
- `lines` (array, required): Invoice line items
- `memo` (string): Customer memo / notes

### `list_quickbooks_customers` (~99 tokens)

List customers from QuickBooks Online.

Returns: Id, DisplayName, PrimaryEmailAddr, PrimaryPhone, Balance, Active.

Example: {}
Example: { "active": true }
Example: { "searchTerm": "Smith" }

Input parameters:

- `active` (boolean): Filter by active status
- `limit` (number): Max results (default: 50)
- `searchTerm` (string): Search by display name (partial match)

### `create_quickbooks_customer` (~111 tokens)

Create a new customer in QuickBooks Online.

Example: { "displayName": "Acme Corp" }
Example: { "displayName": "Jane Smith", "email": "jane@smith.com", "phone": "555-1234" }

Input parameters:

- `companyName` (string): Company name
- `displayName` (string, required): Customer display name (required, must be unique)
- `email` (string): Primary email address
- `phone` (string): Primary phone number

### `list_quickbooks_bills` (~85 tokens)

List bills (accounts payable) from QuickBooks Online.

Returns: Id, DocNumber, TxnDate, DueDate, Balance, TotalAmt, VendorRef.

Example: {}
Example: { "vendorId": "123" }

Input parameters:

- `limit` (number): Max results (default: 50)
- `vendorId` (string): Filter by vendor ID

### `create_quickbooks_bill` (~145 tokens)

Create a new bill (accounts payable) in QuickBooks Online.

Example: { "vendorId": "123", "lines": [{ "description": "Office supplies", "amount": 250, "accountId": "456" }] }

WORKFLOW:
1\. Use list_quickbooks_vendors to find the vendor ID
2\. Use list_quickbooks_accounts to find expense account IDs
3\. Create with line items

Input parameters:

- `dueDate` (string): Due date (YYYY-MM-DD)
- `lines` (array, required): Bill line items
- `memo` (string): Memo / notes
- `vendorId` (string, required): Vendor ID (required)

### `list_quickbooks_vendors` (~91 tokens)

List vendors from QuickBooks Online.

Returns: Id, DisplayName, PrimaryEmailAddr, PrimaryPhone, Balance, Active.

Example: {}
Example: { "searchTerm": "Office" }

Input parameters:

- `active` (boolean): Filter by active status
- `limit` (number): Max results (default: 50)
- `searchTerm` (string): Search by display name (partial match)

### `create_quickbooks_vendor` (~109 tokens)

Create a new vendor in QuickBooks Online.

Example: { "displayName": "Office Depot" }
Example: { "displayName": "AWS", "email": "billing@aws.amazon.com", "companyName": "Amazon Web Services" }

Input parameters:

- `companyName` (string): Company name
- `displayName` (string, required): Vendor display name (required, must be unique)
- `email` (string): Primary email address
- `phone` (string): Primary phone number

### `list_quickbooks_accounts` (~152 tokens)

List chart of accounts from QuickBooks Online.

Returns: Id, Name, AccountType, AccountSubType, CurrentBalance, Active.

Example: {}
Example: { "accountType": "Expense" }

Account types: Bank, Accounts Receivable, Other Current Asset, Fixed Asset, Other Asset, Accounts Payable, Credit Card, Other Current Liability, Long Term Liability, Equity, Income, Cost of Goods Sold, Expense, Other Income, Other Expense.

Input parameters:

- `accountType` (string): Filter by account type (e.g., "Expense", "Income", "Bank")
- `active` (boolean): Filter by active status
- `limit` (number): Max results (default: 100)

### `list_quickbooks_employees` (~63 tokens)

List employees from QuickBooks Online.

Returns: Id, DisplayName, PrimaryEmailAddr, PrimaryPhone, Active.

Example: {}

Input parameters:

- `active` (boolean): Filter by active status
- `limit` (number): Max results (default: 50)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mindstone-mcp-server-quickbooks/mindstone-mcp-server-quickbooks#diagnostics

## Score history

- 2026-08-07: 71
- 2026-08-06: 67
- 2026-08-05: 66
- 2026-08-04: 65
- 2026-08-03: 62
- 2026-08-02: 62
- 2026-08-01: 20
- 2026-07-31: 5
- 2026-07-30: 6
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@mindstone/mcp-server-quickbooks
- Socket report: https://socket.dev/npm/package/@mindstone/mcp-server-quickbooks
- Repository: https://github.com/mindstone/mcp-servers
- Changelog RSS feed: https://verifymcp.io/servers/mindstone-mcp-server-quickbooks/mindstone-mcp-server-quickbooks.xml
- Changelog JSON feed: https://verifymcp.io/servers/mindstone-mcp-server-quickbooks/mindstone-mcp-server-quickbooks.json
- HTML version of this page: https://verifymcp.io/servers/mindstone-mcp-server-quickbooks/mindstone-mcp-server-quickbooks