Finance MCP servers: what exists and how to choose one
Finance MCP servers let an AI client such as Claude or ChatGPT read, and if allowed write, finance systems through the Model Context Protocol. NetSuite, QuickBooks, Dynamics 365, Xero, Sage Intacct and Stripe publish their own. Zapier, Pipedream, Composio and CData cover the rest. They differ in who runs them and what they write. Only Stripe's server requires a person to confirm certain writes.
By Zuny Fester, Head of Operations and MarketingPart of the finance integrations guide.
| Two meanings of "finance MCP" | Finance-operations servers (ERP, accounting, payments) and market-data servers (prices, fundamentals) |
|---|---|
| Vendor-built finance-operations servers (checked October 29, 2026) | Oracle NetSuite, Intuit QuickBooks Online, Microsoft Dynamics 365 Finance and Supply Chain Management, Dynamics 365 Business Central, Xero (XeroAPI GitHub organization), Sage Intacct, Stripe |
| Connector platforms with finance MCP tools | Zapier, Pipedream, Composio, CData |
| Write access by default | Varies: Business Central and CData's servers are read-only; Intuit's QuickBooks server writes by default; NetSuite, Dynamics 365 and Stripe follow the role or key permissions |
| Built-in human confirmation on writes | Stripe, for certain writes such as refunds and outbound payments. None of the ERP or accounting servers. |
| Approval step in the protocol | None. The MCP specification says clients should let a person confirm or deny tool calls. |
Key points
- "Finance MCP server" means two things. Most searches mean servers for finance operations (ERP, accounting, payments). A smaller group serves market data.
- Most finance-operations servers are now vendor-built. Oracle, Intuit, Microsoft, Xero, Sage and Stripe each publish one.
- Connector platforms fill the gaps. Zapier, Pipedream and Composio host MCP tools for many apps at once. CData's open-source servers are read-only.
- There is no single best server. The right choice depends on your systems, the write scope you can accept, and where the controls sit.
- No finance MCP server is a control layer. Approvals, fixed run sequences and audit evidence for ledger writes still sit outside the protocol.
What does "finance MCP server" mean?
A finance MCP server is a program that exposes a financial system or data source as tools an AI client can call through the Model Context Protocol. The phrase covers two different groups, and they carry very different risk.
| Group | What the tools do | Examples on this page | Risk to the books |
|---|---|---|---|
| Finance-operations servers | Read and write records in an ERP, accounting system or payment platform | NetSuite, QuickBooks Online, Dynamics 365, Xero, Sage Intacct, Stripe, connector platforms | High if writes are on: tools can create invoices, bills, journals, refunds |
| Market-data servers | Read prices, fundamentals and economic data from a data provider | Alpha Vantage, Massive | Low: they read a provider's data and do not touch your ledger |
The protocol is the same for both. MCP defines how a client discovers and calls tools, and "does not dictate how AI applications use LLMs" (MCP architecture). Most of this page covers finance operations, because that is where a finance team's controls are at stake.
What finance MCP servers exist today?
As of October 29, 2026, seven finance-operations systems have an MCP server published by their own vendor, SAP data is reachable through AWS and SAP Joule Studio, and four connector platforms cover many more systems. The tables below list each one by who maintains it, how it connects, and what it reads and writes.
ERP and accounting servers
| Server | Maintained by | How it connects | Reads | Writes |
|---|---|---|---|---|
| NetSuite AI Connector Service + MCP Standard Tools | Oracle | Hosted in NetSuite at an account-specific URL, OAuth 2.0, dedicated non-administrator role | SuiteQL (read-only), reports, saved searches, records | Create, update and transform records, if the role allows. No delete tool in the standard list. |
| QuickBooks Online MCP server | Intuit (open-source repo) | Runs locally as a stdio process, OAuth 2.0 through your own Intuit developer app | Records, searches, 11 reports | On by default. Three flags switch create, update and delete off. |
| Dynamics 365 ERP MCP server | Microsoft | Built into the Finance and Supply Chain Management environment, approved clients only | Data entities, forms | Create, update and delete through data entities, and form and action tools, all scoped by security role |
| Business Central MCP server | Microsoft | One hosted endpoint, Microsoft Entra ID sign-in | API pages the user can access | Read-only by default. Admins allow create, modify, delete and actions per API page. |
| Xero MCP server | XeroAPI GitHub organization | Runs locally, started with npx, custom connection or bearer token | Accounts, contacts, invoices, payments, bank transactions, journals, reports | Create and update tools for invoices, payments, bank transactions, manual journals, contacts and more |
| Sage Intacct MCP server | Sage, in the Sage Intacct AI Gateway | Hosted by Sage | Data the user's roles and permissions allow | Sage describes a governed, auditable endpoint. Check Sage's documentation for current write scope. |
| AWS for SAP MCP Server | AWS | Deployed in your AWS account on Amazon Bedrock AgentCore | SAP S/4HANA and ECC OData services | Create, update and delete only when the operator enables them |
| Joule Studio-generated servers | SAP | SAP managed runtime, generated from existing OData or REST APIs | Whatever the source API exposes | Whatever the source API allows |
For system-by-system detail, see what the QuickBooks MCP server can and can't do, what the NetSuite MCP server can and can't do, and how ERP MCP servers compare with ERP integrations.
Payments servers
| Server | Maintained by | How it connects | Reads | Writes |
|---|---|---|---|---|
| Stripe MCP server | Stripe | Hosted at https://mcp.stripe.com, OAuth or an agent API key | Any Stripe API GET method through stripe_api_read, plus account info and analytics tools | Any POST, PATCH, PUT or DELETE method through stripe_api_write. Certain writes, such as refunds and outbound payments, need human confirmation. |
Stripe goes further than the accounting servers on write control. Stripe "requires human confirmation before it takes certain stripe_api_write actions, such as refunds and outbound payments," and an unapproved request expires after 24 hours (Stripe). Administrators can turn MCP access on or off for the whole team, separately for live mode and sandboxes. Stripe also tells users to turn on their client's tool-approval setting. Its Treasury tools, including send_money, are in public preview.
Connector platforms
| Platform | Maintained by | How it connects | Reads | Writes |
|---|---|---|---|---|
| Zapier MCP | Zapier | Hosted. App credentials stay in Zapier's managed connection layer. | Finder actions, for example Find Customer in QuickBooks Online and find records via saved search in NetSuite | Zapier actions, for example Create Invoice and Void Invoice in QuickBooks Online, create, update and upsert in NetSuite |
| Pipedream MCP | Pipedream | Hosted at mcp.pipedream.com, powered by Pipedream Connect | Depends on the actions you enable | Depends on the actions you enable |
| Composio | Composio | Hosted, a single MCP URL, managed OAuth or your own app | Records, lists, queries per toolkit (NetSuite, QuickBooks) | Create, update and delete, including invoices and journal entries in NetSuite |
| CData MCP servers | CData (open source) | Runs locally through a CData JDBC driver | SQL queries over QuickBooks, NetSuite, Workday, SAP Business One and other sources | None. The open-source servers are read-only. |
Two features stand out among the platforms. Composio says you can "require your approval for some" actions and that "every action is recorded" (Composio). Zapier lets you "review every MCP action in History and remove access at any time" (Zapier). In both cases the approval or review sits in the platform, not in the finance system, and the person approving can be the person asking. Check who maintains any server before you give it production credentials.
Market-data servers
Market-data providers also publish MCP servers, and they read only the provider's data. They are useful for research and analysis, not for finance operations.
| Server | Maintained by | How it connects | Data |
|---|---|---|---|
| Alpha Vantage MCP server | Alpha Vantage (alphavantage GitHub organization) | Hosted at https://mcp.alphavantage.co/mcp with OAuth, or locally with an API key | Stocks, options, forex, crypto, commodities, fundamentals, economic and technical indicators |
| Massive MCP server | Massive (massive-com GitHub organization) | Runs locally (stdio by default) with a Massive API key | Stock, options, forex, crypto and futures aggregates, trades, quotes, snapshots, fundamentals and news. The README labels the project experimental. |
What can finance MCP servers actually do?
A finance MCP server turns the system's operations into tools: query data, run reports, create and update records, and run business actions. The exact tool names come from each vendor's documentation.
| Task | Example tools | Typical request |
|---|---|---|
| Query data | NetSuite ns_runCustomSuiteQL, Business Central bc_data_query (preview), Stripe stripe_api_read | "Which customers are more than 60 days past due?" |
| Run reports | QuickBooks get_aged_receivables, Xero list-trial-balance, NetSuite ns_runReport | "Pull last month's trial balance." |
| Create and update records | QuickBooks create_bill, Xero create-manual-journal, NetSuite ns_createRecord, Dynamics 365 data_create_entities | "Draft an invoice for this customer." |
| Move money | Stripe stripe_api_write (refunds), Stripe send_money (Treasury, public preview) | "Refund this charge." |
| Run business logic | NetSuite ns_transformRecord, Dynamics 365 api_invoke_action | "Turn this sales order into an invoice." |
What this is good for: asking questions of your books and payment data in plain language. Read-only, against a sandbox or a scoped role, it is low-risk and useful. The MCP for accounting guide maps these tools to day-to-day accounting tasks.
What can't finance MCP servers do?
A finance MCP server gives a model access to a financial system. It does not decide who may approve a write, fix the order of steps, or keep evidence of why a change happened. These gaps sit in the protocol, so they apply to every server above.
- No approval step in the protocol. The MCP specification says clients should let a person confirm or deny tool calls, but that is a client behavior. Oracle warns that an agent "may run powerful MCP tool functions - such as making payments or granting approvals - without the user's explicit intent" (Oracle). Stripe's confirmation step is the exception, and it covers only certain writes.
- No fixed run. The model selects and orders tool calls at runtime, so the same request can produce a different sequence on a different day.
- Logs show the call, not the reason. NetSuite keeps 21 days of MCP request logs in production (Oracle). QuickBooks' audit log records the change. Neither records the prompt or an approver.
- No safe multi-step runs. Each tool is one operation. If a task fails on step three, the first two writes stay in the books.
- No schedule. MCP is request-driven. Nothing runs on the first business day unless someone builds that elsewhere.
- Segregation of duties is only as good as the role. If one role can create and pay a vendor bill, so can the AI client.
How do you choose the best MCP server for finance?
There is no single best finance MCP server. The best one for your team is the one whose maintainer, sign-in, write scope and logs you can defend to an auditor. Use the criteria below rather than a ranking.
| Criterion | What to check | Where the servers differ |
|---|---|---|
| Who maintains it | Vendor, connector platform or community | Vendor servers track the system's own API. Platforms cover many systems through one connection. |
| Where it runs | Local process or hosted service | Intuit, Xero, CData and Massive run locally. Oracle, Microsoft, Sage, Stripe, Zapier, Pipedream and Composio are hosted. |
| How it signs in | OAuth as a dedicated user, a scoped key, or shared credentials | NetSuite blocks administrator roles. Stripe offers agent API keys with only the permissions the client needs. |
| Write defaults | Read-only first, or writes on | Business Central and CData start read-only. Intuit's QuickBooks server starts with writes on. |
| Write granularity | Per category, per tool, per record type, per amount | Intuit's flags switch whole categories. Business Central allows writes per API page. None limits by amount. |
| Confirmation on writes | Does anything ask a person before a high-impact write? | Stripe, for certain writes. Composio, if you set it. Otherwise, only the client's own prompt. |
| Logs and retention | Where calls are logged and for how long | NetSuite keeps 21 days in production. Zapier shows History. Keep your own copy if you need more. |
| Coverage | One system, or all the systems a process touches | A close or cash process often touches an ERP, a payment platform and a CRM. |
A practical pattern: use the vendor's own server for the system you query most, read-only and under a dedicated identity. Use a connector platform only for systems without a vendor server. Keep anything that posts to the ledger out of the chat entirely.
How to set one up safely
Setup differs by server, but the safe sequence is the same everywhere.
- Pick the server using the criteria above.
- Create a dedicated, least-privilege identity. Never connect as an administrator.
- Start read-only, in a sandbox or test company. Set Intuit's
QUICKBOOKS_DISABLE_*flags totrue, leave Business Central's edit tools blocked, or use a Stripe sandbox. - Connect the AI client and sign in with that identity.
- Reconcile the first answers against the system's own reports.
- Find the log and decide how long you need to keep it.
- Turn on writes one at a time, with an approval recorded outside the chat.
Where do finance MCP servers leave a controls gap, and how does Loopfour close it?
MCP is a connection layer, not a control layer. It answers "can the model reach the system?" Finance controls answer "should this change post, who approved it, and can we prove it a year from now?" Auditors ask the second question.
An AI agent decides what to do at runtime. Loopfour does only what was approved.
Loopfour, the deterministic finance workflow automation platform, works as the control layer on top of these systems. It connects to NetSuite, QuickBooks, Stripe and Salesforce through its own integrations, with scoped OAuth access, and runs finance work as versioned, approved workflows. AI handles the steps that need interpretation (reading an invoice PDF, matching a remittance). Every step that touches the ledger runs the same way each time. Loopfour is a managed service: we build the workflow, run it, and maintain it.
| Control finance needs | Finance MCP server on its own | Loopfour workflow |
|---|---|---|
| Who decides the sequence | The model, at runtime | A versioned workflow, approved before it runs |
| Approval before a write | A client prompt to the person chatting, or Stripe's confirmation for certain writes | An approval step routed to a named approver, for example interactive Slack approval |
| Segregation of duties | Inherits one user's role | Preparer and approver kept separate (segregation of duties in AP) |
| Audit evidence | The system's log of the call or change | Every run logged and versioned (governance) |
| Triggers | A person's request | A schedule, an event, a person or an API call |
A typical flow: Stripe payout lands → payouts matched to invoices (reconciling Stripe payouts) → exceptions sent to Slack for approval → entries posted to NetSuite or QuickBooks → run record kept. The model never holds a write-enabled credential. The workflow does, and it runs only the steps that were approved.
The two can sit side by side. Analysts can ask questions through a read-only MCP connection while anything that posts runs through an approved workflow.
Loopfour does not ship an MCP server today, and it is not one of the servers listed above. Native MCP support for Loopfour workflows is coming soon.
Go deeper
For how MCP fits a full finance stack (hosts, clients, servers, MCP vs API vs iPaaS, and where approvals belong), read how financial workflow MCP connects AI to ERP and accounting systems with approvals and an audit trail. For single systems, see the guides to the QuickBooks MCP server, the NetSuite MCP server, ERP MCP servers and MCP for accounting.
Next step
Map the finance workflow with the most exposure and prove the automation path.
Bring the invoice, contract, payment reconciliation, or customer finance workflow you have to defend at audit. Loopfour can map the trigger, controls, integrations, and approval loop.
Checklist
How to choose a finance MCP server
- Who maintains it: the system's vendor, a connector platform, or a community developer. Read the source of anything else.
- Where it runs: locally on one machine, or hosted by the vendor or platform.
- How it signs in: OAuth as a dedicated user, a scoped agent key, or a shared credential.
- What it can write by default, and whether writes can be switched off per category, per tool or per record type.
- Whether it asks a person to confirm high-impact writes, and who that person is.
- Where tool calls are logged and how long the log is kept.
- How many companies, entities or accounts one connection covers.
- Whether it is labeled preview or experimental.
- For anything that posts to the ledger, who approves it outside the chat, and where that approval is recorded.
Frequently Asked Questions
Sources
- Model Context Protocol, Architecture overview (opens in a new tab)
- Model Context Protocol specification, Tools (2025-06-18) (opens in a new tab)
- Oracle NetSuite Help Center, MCP Standard Tools SuiteApp (opens in a new tab)
- Oracle NetSuite Help Center, Connect to the NetSuite AI Connector Service (opens in a new tab)
- Oracle NetSuite Help Center, Associated Risks, Controls, and Mitigation Strategies (opens in a new tab)
- Intuit, QuickBooks Online MCP Server (GitHub) (opens in a new tab)
- QuickBooks, Use the audit log in QuickBooks Online (opens in a new tab)
- Microsoft Learn, Use Model Context Protocol for finance and operations apps (opens in a new tab)
- Microsoft Learn, Business Central MCP Server overview and setup (opens in a new tab)
- Xero, Xero MCP Server (GitHub) (opens in a new tab)
- Sage, Sage Intacct AI Gateway (opens in a new tab)
- AWS, What is the AWS for SAP MCP Server? (opens in a new tab)
- SAP Architecture Center, Joule Studio (opens in a new tab)
- Stripe Docs, Model Context Protocol (MCP) (opens in a new tab)
- Zapier, Zapier MCP (opens in a new tab)
- Zapier, QuickBooks Online MCP (opens in a new tab)
- Zapier, NetSuite MCP (opens in a new tab)
- Pipedream, QuickBooks MCP server (opens in a new tab)
- Composio, home page (approvals and action records) (opens in a new tab)
- Composio, QuickBooks toolkit (opens in a new tab)
- Composio, NetSuite toolkit (opens in a new tab)
- CData Software (GitHub organization, read-only MCP servers) (opens in a new tab)
- Alpha Vantage, Alpha Vantage MCP Server (GitHub) (opens in a new tab)
- Massive, Massive MCP Server (GitHub) (opens in a new tab)
Related
Topic
Integrations
Every finance automation vendor publishes an integrations page: a grid of logos, a claim of "seamless" connectivity, and not much else. That page answers a marketing question — does this vendor touch…
Read moreHow-to
How do I connect Stripe invoices for AR collections?
Loopfour's Stripe integration creates and manages invoices end to end — createCustomer, createInvoice, finalizeInvoice, sendInvoice, and voidInvoice — making Stripe the only integration in this matrix that actually issues and collects AR invoices rather than just supplying payment data. Connecting it means creating the customer in Stripe first; invoices can't be created without one.
Read moreHow-to
How do I reconcile Stripe payouts independent of which ERP I use?
Every Stripe payout is backed by BalanceTransaction records — one per charge, fee, refund, or adjustment that makes up the net payout amount. Reconciling a payout means listing its BalanceTransactions by payout ID and summing them by type, a mechanic that's identical regardless of which ERP or accounting system receives the result.
Read moreHow-to
How do I set up interactive Slack approval buttons for invoice approval?
Post the invoice as a message with an interactive button block, then respond to the click by opening a modal with the trigger_id Slack sends in the interaction payload — within three seconds, before any lookup or validation. Loopfour's Slack integration supports this through sendMessage (with blocks) and openModal, but the modal call has to happen first, not last.
Read moreHow-to
How do I maintain segregation of duties in an automated AP approval workflow?
Keep three roles distinct in the workflow itself: who can create or edit a vendor record, who can enter or submit a bill, and who can approve it for payment. Institutional guidance is explicit that authorizing a payment and the person who executes it shouldn't be the same individual — automation makes it easy to collapse these into one click, which is exactly the risk to design against.
Read moreIntegration
ERP MCP server: what exists and how it compares to APIs
An ERP MCP server lets an AI client such as Claude read, and if allowed write, ERP data through the Model Context Protocol. NetSuite, QuickBooks, Dynamics 365, Xero and Sage Intacct now offer one, and SAP data is reachable through AWS and Joule Studio. MCP connects a model to the ERP. Approvals and audit evidence still sit outside it.
Read moreDefinition
MCP for accounting: what accountants can do with it, and what it can't
MCP for accounting connects an AI assistant such as Claude or ChatGPT to your accounting system through a Model Context Protocol server. QuickBooks, Xero, NetSuite and Sage Intacct each have a vendor-published server. They are good at reading reports and ledgers. Writes, approvals, close sign-off and audit evidence still need controls outside the model.
Read moreIntegration
MCP for AP and AR automation: what it can and can't do
MCP accounting automation connects an AI assistant to the systems that hold your bills, invoices and payments: QuickBooks, Xero, NetSuite and Stripe. Each step is a single tool call. Approval chains, segregation of duties, duplicate protection, three-way match and scheduled dunning still sit outside MCP.
Read more