MCP for AP and AR automation: what it can and can't do
MCP accounting automation connects an AI assistant to the systems that hold your bills, invoices and payments: QuickBooks, Xero, NetSuite and Stripe. Each step is a single tool call. Approval chains, segregation of duties, duplicate protection, three-way match and scheduled dunning still sit outside MCP.
By Zuny Fester, Head of Operations and MarketingPart of the accounts payable and invoice processing guide.
| MCP servers that write AP and AR records | QuickBooks Online (Intuit), Xero (XeroAPI GitHub organization), NetSuite (Oracle's AI Connector Service), Stripe (hosted at mcp.stripe.com) |
|---|---|
| Vendor bills in Xero | Created with create-invoice and type ACCPAY; sales invoices use ACCREC |
| Approval step before a write | None on the accounting servers. Stripe asks a person to confirm certain writes, such as refunds and outbound payments. |
| Duplicate protection on retries | Stripe's API accepts idempotency keys. Intuit's README describes no duplicate check before a create_ call. |
| Three-way match | No tool on these four servers compares a bill with a purchase order and a receipt |
| Scheduled dunning | Not in the protocol. MCP runs when someone asks. Stripe's Smart Retries and reminder emails are Dashboard settings, outside MCP. |
| NetSuite MCP call log | 21 days in production, 7 in sandbox |
Key points
- The AP and AR tools exist today. Intuit, Xero, Oracle NetSuite and Stripe each publish an MCP server that can create bills, invoices or payments.
- Each tool is one step, not a process. Bill intake, coding, approval and payment are separate calls, generated at runtime.
- Approval is the biggest gap. None of the accounting servers asks anyone before a write. Stripe confirms some writes, but the requester can be the approver.
- Retries can post twice. Only Stripe documents idempotency keys. Bills and payments elsewhere rely on whoever makes the call.
- For anything that moves money or posts to the ledger, keep the controls in a workflow, not in a prompt.
Which MCP servers cover AP and AR today?
Four vendor-published servers cover the AP and AR steps: Intuit's QuickBooks Online server, Xero's server, Oracle's NetSuite AI Connector Service and Stripe's MCP server. The first three hold bills, invoices and payments in the books. Stripe holds customer invoices, charges and refunds on the payments side of AR.
| Server | Published by | AP records | AR records |
|---|---|---|---|
| QuickBooks Online MCP server | Intuit, runs locally | Bills, bill payments, vendors, purchase orders, vendor credits | Invoices, payments, customers, credit memos |
| Xero MCP server | Xero (XeroAPI GitHub organization), runs locally | Bills, as ACCPAY invoices; payments | Invoices, credit notes, payments, contacts |
| NetSuite AI Connector Service + MCP Standard Tools | Oracle NetSuite, inside NetSuite | Any record the role can reach through REST | Any record the role can reach through REST |
| Stripe MCP server | Stripe, hosted at https://mcp.stripe.com | Outbound payments through Treasury tools (public preview) | Invoices, customers, payment links, refunds, disputes, credit notes |
Sage Intacct also offers an MCP server through its AI Gateway, which Sage describes as read-only. For a full list of finance servers, including hosted options from Zapier, Pipedream and Composio, see the finance MCP servers roundup. This page follows the work itself, step by step.
What can MCP do at each AP and AR step?
AI finance automation through MCP covers most single AP and AR steps as one tool call each: create a bill, record a payment, draft an invoice, pull an aging report. The table maps each process step to the tools each vendor documents. Tool names come from the Intuit README, the Xero README, Oracle's Available Tools page and Stripe's MCP docs.
Accounts payable
| AP step | QuickBooks Online | Xero | NetSuite | What MCP leaves to you |
|---|---|---|---|---|
| Vendor bill intake | create_bill, create_vendor, create_attachable (attach the PDF) | create-invoice with type ACCPAY, create-contact | ns_createRecord, ns_attachFile | Reading the invoice. The AI client extracts the fields; the server only receives them. Xero's tool list has no attachment tool. |
| Coding | Account and class set on the bill lines; create_class, create_department | accountCode and tracking on each line item; list-accounts, list-tracking-categories | ns_getRecordTypeMetadata, ns_runCustomSuiteQL to look up accounts | Coding happens inside the create call, at runtime. Nothing checks it against your coding rules. |
| Approval | No approval tool | No bill approval tool (the only approve tool is for payroll timesheets) | ns_executeRecordAction runs whatever actions the record and role expose | An approval chain, a named approver and limits by amount. |
| Payment | create_bill_payment, search_bill_payments | create-payment against an invoice in AUTHORISED status | ns_createRecord, ns_transformRecord (check ns_getRecordTransformMetadata) | These record a payment in the books; their documentation does not describe sending funds. Who releases the payment is up to you. |
Accounts receivable
| AR step | QuickBooks Online | Xero | NetSuite | Stripe | What MCP leaves to you |
|---|---|---|---|---|---|
| Invoicing | create_invoice, get_invoice_pdf | create-invoice with type ACCREC; update-invoice works on drafts only | ns_createRecord, ns_transformRecord (for example, sales order to invoice) | Create, update, finalize and void invoices through stripe_api_write | Which contract terms the invoice must follow, and who checks it before it goes out. |
| Cash application | create_payment, search_payments, search_invoices | create-payment (invoice ID, account ID, amount), list-payments | ns_createRecord, ns_runCustomSuiteQL | List payments for an invoice, balance transactions, customer cash balance | The match itself. Deciding which invoices a remittance pays is a generated guess, not a rule. |
| Dunning | No reminder or send tool in the README | No reminder or send tool in the README | No email tool in the standard tool list | Mark an invoice uncollectible; Smart Retries and reminder emails are Dashboard settings | The schedule, the tone, the escalation path, and running it on the due date without being asked. |
| Aging | get_aged_receivables, get_aged_receivables_detail, get_aged_payables | list-aged-receivables-by-contact, list-aged-payables-by-contact | ns_runReport, ns_runSavedSearch | List invoices by status; stripe_analytics (preview) | Tying the answer back to the system's own aging report. |
Where this earns its keep: questions and drafts. "Which vendors are we paying late?" maps to one aging tool. "Draft invoices for these three customers" maps to three create calls you can review. "Show overdue Stripe invoices" is a single read. Read-only, against a sandbox, this is low-risk and useful.
What can't MCP accounting automation do for AP and AR?
MCP gives an AI client access to AP and AR records. It does not run an approval chain, separate duties, stop a duplicate payment, perform a three-way match, keep an audit trail of why, or run dunning on a schedule. These gaps sit in the protocol, so they apply to every server above.
1. No approval chains. The accounting servers run a tool as soon as the client calls it. The MCP specification says clients should present confirmation prompts, but that is a client setting, and the person confirming is the person asking. Stripe goes further: it requires human confirmation for certain writes, such as refunds and outbound payments, and the approval link expires after 24 hours (Stripe). That is still one click from one person, not a chain routed by amount, vendor or entity.
2. No segregation of duties. The tools inherit one user's access. If that user can create a vendor bill and pay it, so can the AI client. In QuickBooks the write switches are whole categories: QUICKBOOKS_DISABLE_WRITE turns off every create_ tool, so you cannot allow create_bill and block create_bill_payment on the same server. Your preparer and approver separation has to live somewhere else.
3. No duplicate payment protection or safe retries. Intuit's README describes no duplicate check before a create_ call, so a retried step can post the same bill or payment twice. QuickBooks bills also have no DocNumber upsert, so a blind retry after a timeout creates a second bill (connecting QuickBooks vendor bills). Stripe's API accepts idempotency keys for safe retries, but Stripe's MCP page does not say how stripe_api_write uses them. If a three-step run fails on step three, steps one and two stay in the books.
4. No three-way match. None of the four servers has a tool that compares a bill with its purchase order and receipt. QuickBooks exposes purchase orders and bills as separate records. The comparison, the price tolerance and the choice between a 2-way or 3-way match are left to whatever the model generates.
5. No audit trail of why. QuickBooks' audit log records the change and the user. NetSuite's MCP execution log records each call's time, status, user and URL path, kept for 21 days in production (Oracle). Neither records the prompt, the coding reason or an approver. An auditor asking "who approved this payment?" gets no answer from the log.
6. No scheduled dunning runs. MCP is request-driven. Nothing sends a scheduled reminder unless a person asks for it that day. Stripe's Smart Retries and customer emails run on their own, but you configure them in the Stripe Dashboard, not through MCP, and they cover only invoices that live in Stripe.
How do you set up MCP for AP and AR safely?
Setup follows one pattern for AP and AR: separate roles for each side, read-only first, writes turned on one step at a time, and payments kept out of the chat. System-specific steps live in the QuickBooks and NetSuite guides.
- Map each step to its system. Write down where bills, invoices and payments live (for example, bills in NetSuite, customer invoices in Stripe) and connect only those servers.
- Create a dedicated role for each side. One for AP, one for AR, neither an administrator. NetSuite blocks the Administrator role and full-access roles from its MCP server (Oracle).
- Start with reads. Aging reports, bill searches and invoice lists. In QuickBooks, set all three
QUICKBOOKS_DISABLE_*flags totrue. In NetSuite, leave the REST Web Services permission off the role. - Scope Stripe tightly. Use OAuth in an interactive client, or an agent API key "with only the permissions the client needs," and test in a sandbox (Stripe). Turn on your client's tool-approval setting, as Stripe recommends.
- Turn on drafts before posting. Xero's
update-invoiceonly edits drafts, which makes draft invoices a safe first write. Review every draft before it is sent or approved. - Keep payment writes off. If a server cannot separate bill creation from bill payment (QuickBooks cannot), keep payments on a different path with its own approver.
- Reconcile against the system's own reports. Compare the first aging answer with the aging report you already trust.
- Keep your own log. Record prompts and tool calls if you need more than the vendor's log (21 days in NetSuite production).
Where does MCP leave an AP and AR controls gap, and how does Loopfour close it?
MCP is a connection layer, not a control layer. It answers "can the model reach the bill?" AP and AR controls answer "should this payment go out, who approved it, and can we prove it a year from now?"
An AI agent decides what to do at runtime. Loopfour does only what was approved.
Loopfour, the deterministic finance workflow automation platform, connects to Salesforce, NetSuite, QuickBooks and Stripe through its own integrations, with scoped OAuth access and an audit trail on every write, and runs AP and AR as versioned, approved workflows. AI handles the steps that need interpretation, such as reading a vendor invoice or parsing a messy remittance. Every step that touches the ledger or moves money runs the same way each time. Loopfour is a managed service: we build the workflow, run it and maintain it.
- Cash Application. Payments are matched to open invoices by defined rules, a payment covering several invoices is split across them, and low-confidence matches go to a person instead of being force-matched. See how to automate applying incoming payments to open invoices.
- AR & Dunning. You set the reminder schedule, the tone and the escalation path. The workflow handles the timing and keeps the record, so reminders go out on schedule without anyone asking. See how to prioritize which overdue invoices to chase first.
- Contract-to-Cash. The steps between a signed contract and applied cash run as one workflow: invoice from the contract terms, collect, apply, and sync to the ERP. QuickBooks invoices use rerun-safe upserts keyed on DocNumber (idempotent invoice sync).
- AP approvals. A write waits at an approval step until a named approver acts in Slack (Slack approval buttons). The run records who decided and when.
| Control AP and AR need | MCP server on its own | Loopfour workflow |
|---|---|---|
| Approval before a write or payment | Optional prompt to the person asking | An approval step routed to a named approver |
| Segregation of duties | One user's access | Preparer and approver kept separate |
| Retries | No duplicate check described (except Stripe's API keys) | Rerun-safe steps, keyed on the source record |
| Audit evidence | The system's change log, without the reason | Every run logged and versioned (governance) |
| Dunning and collections | Only when someone asks | Runs on a schedule or an event, with your escalation rules |
| Cash application | A generated guess per payment | Defined matching rules, exceptions to a person |
The two can sit side by side. Many teams will let AP and AR staff ask questions through a read-only MCP connection while anything that posts or pays runs through an approved workflow.
Loopfour does not ship an MCP server today. Native MCP support for Loopfour workflows is coming soon.
Go deeper
For how MCP fits a full finance stack, including hosts, clients and servers, MCP compared with APIs and iPaaS, and where approvals belong, read how financial workflow MCP connects AI to ERP and accounting systems with approvals and an audit trail. For system-by-system detail, see what the QuickBooks MCP server can and can't do, what the NetSuite MCP server can and can't do, what accountants can do with MCP, and the roundup of finance MCP servers.
Next step
Map the finance workflow with the most exposure and prove the automation path.
Bring the invoice, contract, payment reconciliation, or customer finance workflow you have to defend at audit. Loopfour can map the trigger, controls, integrations, and approval loop.
Worked example
One vendor invoice, two ways: through an MCP chat and through an approved workflow
The same vendor invoice shows where the gaps land.
A vendor invoice arrives, and the invoice total is higher than the PO total. The AP clerk asks an AI assistant, connected to QuickBooks through the Intuit server with writes on, to "enter and pay this bill."
| Step | Through an MCP chat | Through an approved workflow |
|---|---|---|
| 1. Intake | The assistant reads the PDF and calls create_bill for the invoice total. | The invoice is read, the fields extracted, and the PDF kept with the run. |
| 2. Coding | The expense account is generated at runtime, inside the same call. | Lines are coded by defined rules; anything unmatched goes to a person. |
| 3. Match | Nothing compares the invoice total with the PO total. | The difference between the invoice total and the PO total is flagged as an exception before approval. |
| 4. Approval | The clerk confirms the tool call in the chat. The requester is the approver. | A named approver gets the request in Slack and approves or rejects it. |
| 5. Payment | The assistant calls create_bill_payment. A timeout and retry can record it twice. | The payment step checks the source bill's identity before it runs again. |
| 6. Evidence | QuickBooks' audit log shows the change and the clerk's user. | The run record shows the inputs, the exception, the approver and the time. |
The MCP path is faster to set up. The workflow path is the one your auditor can follow next year.
Frequently Asked Questions
Sources
- Intuit, QuickBooks Online MCP Server, repository and README (opens in a new tab)
- Xero, Xero MCP Server, repository and README (opens in a new tab)
- Xero, create-invoice tool source (opens in a new tab)
- Xero, create-payment tool source (opens in a new tab)
- Oracle NetSuite Help Center, MCP Standard Tools SuiteApp (opens in a new tab)
- Oracle NetSuite Help Center, Available Tools in the MCP Standard Tools SuiteApp (opens in a new tab)
- Oracle NetSuite Help Center, Required Features and Permissions (opens in a new tab)
- Oracle NetSuite Help Center, Connect to the NetSuite AI Connector Service (execution log, retention) (opens in a new tab)
- Stripe Docs, Model Context Protocol (MCP) (opens in a new tab)
- Stripe Docs, Idempotent requests (opens in a new tab)
- Stripe Docs, Revenue recovery (Smart Retries, customer emails, configured in the Dashboard) (opens in a new tab)
- Sage, Sage Intacct AI Gateway (opens in a new tab)
- Model Context Protocol specification, Tools (2025-06-18) (opens in a new tab)
- QuickBooks, Use the audit log in QuickBooks Online (opens in a new tab)
Related
Topic
AR & Collections
Accounts receivable is the money customers owe a business for goods or services already delivered on credit — a current asset on the balance sheet until it's collected. AR and collections, as a practi…
Read moreRole guide
How do I prioritize which overdue invoices to chase first?
Weight by a combination of dollar amount, days overdue, and customer risk signals — a large balance moves the total AR number most, an old balance is hardest to collect the longer it ages, and a risk signal (payment history, a known dispute) can override both. A weighted score generates a daily worklist automatically; sorting a spreadsheet by eye doesn't scale.
Read moreHow-to
How do I automate applying incoming payments to open invoices?
Match on an exact amount plus invoice reference first, auto-applying with no human involved, then use fuzzy or confidence-scored matching for near-misses like a payment short by a fee. Route anything that can't be matched confidently to an exception queue rather than guessing, and require an invoice reference at the point of payment wherever possible to maximize the automatic-match rate.
Read moreHow-to
How do I connect QuickBooks vendor bills to a Loopfour workflow?
Loopfour's QuickBooks integration creates a bill with a single, unconditional API call — there's no upsert-by-document-number the way there is for invoices, so a blind retry after a timeout creates a second bill. Loopfour can also create the vendor first if it doesn't already exist; a bill doesn't require a pre-existing vendor record.
Read moreHow-to
How do I connect QuickBooks AR with idempotent invoice sync?
Loopfour's QuickBooks integration keys invoice sync off DocNumber, the same invoice number field QuickBooks itself exposes through Custom transaction numbers. Looking an invoice up by DocNumber before writing lets a rerun update the existing invoice instead of creating a duplicate — even if the workflow has lost track of QuickBooks' own internal invoice Id.
Read moreComparison
Do I need a 2-way or 3-way match for this purchase?
A 2-way match (PO against invoice) is enough for low-risk, non-physical purchases like software subscriptions or professional services, where there's no separate delivery step to verify. A 3-way match (PO, receipt, and invoice) is the standard for physical goods, where confirming something actually arrived — and in what quantity — is the whole point of the extra step.
Read moreHow-to
How do I maintain segregation of duties in an automated AP approval workflow?
Keep three roles distinct in the workflow itself: who can create or edit a vendor record, who can enter or submit a bill, and who can approve it for payment. Institutional guidance is explicit that authorizing a payment and the person who executes it shouldn't be the same individual — automation makes it easy to collapse these into one click, which is exactly the risk to design against.
Read moreIntegration
QuickBooks MCP server: what it does, what it can't, and how to set it up
Yes. Intuit publishes an official QuickBooks MCP server that lets Claude and other MCP clients read and write QuickBooks Online data over OAuth 2.0. It runs locally, covers 29 entity types and 11 reports, and leaves approvals, audit evidence and multi-step control to you.
Read moreDefinition
MCP for accounting: what accountants can do with it, and what it can't
MCP for accounting connects an AI assistant such as Claude or ChatGPT to your accounting system through a Model Context Protocol server. QuickBooks, Xero, NetSuite and Sage Intacct each have a vendor-published server. They are good at reading reports and ledgers. Writes, approvals, close sign-off and audit evidence still need controls outside the model.
Read moreComparison
Finance MCP servers: what exists and how to choose one
Finance MCP servers let an AI client such as Claude or ChatGPT read, and if allowed write, finance systems through the Model Context Protocol. NetSuite, QuickBooks, Dynamics 365, Xero, Sage Intacct and Stripe publish their own. Zapier, Pipedream, Composio and CData cover the rest. They differ in who runs them and what they write. Only Stripe's server requires a person to confirm certain writes.
Read more