QuickBooks
6 reviewed Dtwo policies for QuickBooks MCP servers — egress + ingress controls for governing what AI agents can do with QuickBooks.
On this page
Reusable DTwo policies for Intuit QuickBooks Online (QBO) MCP servers — Intuit's first-party open-source server (intuit/quickbooks-online-mcp-server, ~144 tools), the Intuit-published Claude connector bundled in Claude for Small Business (tool names unverified — confirm via tools/list), the community LibreChat remote server, and the archived hvkshetry mega-tool server. The MCP surface is verb_entity reads (get_*/search_* across 29 entities plus 11 financial reports) and writes (create_*/update_*/delete_*). QBO is the general-ledger system of record: nearly every write is a books-of-record mutation, transaction deletes are hard deletes recoverable only from the audit log, journal entries restate the ledger directly, and money-movement tools trigger real payments and refunds. There are no send/email tools, so the blast radius is the ledger itself plus anything that syncs downstream (payroll, tax filings, lender feeds) — which is exactly why the SOX and PII exposure concentrates on writes, money movement, vendor banking data, and whole-ledger bulk reads.
Available policies
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| freeze-destructive-ops | ingress | Deny every destructive QBO call — delete_*/void_*/deactivate_* tools and the mega-tool operation ∈ {delete, void, deactivate} — since transaction deletes are unrecoverable hard deletes. |
sox, soc2 |
| gate-money-movement | ingress | Gate money-movement creators (create_payment, create_bill_payment, create_refund_receipt, create_transfer, create_deposit) behind a finance group and an amount ceiling. |
sox, soc2 |
| protect-closed-periods-journal-entries | ingress | Deny direct journal-entry writes (create_journal_entry/update_journal_entry) for every caller except the controller group. |
sox, soc2 |
| guard-vendor-banking | ingress | Deny create_vendor/update_vendor calls that carry bank-account, routing/ACH, or tax-ID (EIN/SSN) fields. |
sox |
| cap-bulk-export | ingress | Clamp the bulk-read levers on every search_* call — strip fetchAll and cap limit at 50 (transform-only). |
soc2, gdpr-ccpa |
| redact-pii-egress-employee | egress | Mask SSN, EIN, bank-account, and home-address PII in get_employee/search_employees/get_vendor/search_vendors responses for callers outside HR/finance. |
soc2, gdpr-ccpa |
Tool naming on the DTwo gateway
DTwo prefixes tool names with the MCP server name configured on the gateway, so a QBO server registered as quickbooks surfaces tools like quickbooks-create-invoice. These policies match on the suffix (_invoice, _payment, delete_, create_vendor, etc.), normalize separators (snake_case, camelCase, hyphen) for portability across the official, LibreChat, and connector servers, and — for the archived hvkshetry mega-tool shape — also inspect the operation/entity_type arguments. The Claude connector's exact tool names are unverified; confirm the live names your gateway sends with the dump-input debug technique before deploying exact-match rules.
Identity claims
The identity-gated policies (gate-money-movement, protect-closed-periods-journal-entries, redact-pii-egress-employee, and the vendor-banking guard where applicable) read input.subject.claims.groups with placeholder group names (e.g. finance, controller, hr). Replace these with your own IdP group names at import time. Missing claims fail closed for grants (no group → not exempt).
Contributing
To add a QuickBooks policy:
- Create
apps/quickbooks/<policy-slug>/withpolicy.mdand atests.yamltest file. - Add a row to the table above.
- Declare
apps: ["quickbooks"]in the policy frontmatter, plus any industry / bundle slugs that apply. - If the policy fits a bundle (e.g.
bundles/sox), link to it from the matching landing page. - Run
pnpm manifestfrom the repo root.
See CONTRIBUTING.md for the full process.