MCP for accounting: what accountants can do with it, and what it can't

Key points

• The servers are real and mostly vendor-built. Intuit, Xero, Oracle NetSuite and Sage each publish one, and Stripe publishes one for the payments side of AR.
• Reading is the safe, useful part. Trial balances, P&L, aging reports and ledger queries map cleanly to MCP tools.
• Most of them can also write. QuickBooks, Xero and NetSuite servers create and update transactions. Sage Intacct's server is read-only.
• MCP has no concept of a close. No approvals, no fixed sequence, no sign-off, and no record of why an entry was made.
• For anything that posts to the books, keep the controls in a workflow, not in a prompt.

What accounting MCP servers exist today?

Five vendor-published servers cover most accounting MCP searches: Intuit's QuickBooks Online server, Xero's server, Oracle's NetSuite AI Connector Service, Sage's Sage Intacct MCP server and, for the payments side of AR, Stripe's MCP server. They differ in where they run, how they sign in, and whether they can write.

Third-party options also exist. Zapier, Pipedream, Composio and CData offer hosted or packaged servers for QuickBooks and NetSuite, each with its own sign-in model and tool set. The QuickBooks MCP server guide and NetSuite MCP server guide compare them system by system. Check who maintains any server before you give it access to a client's books.

What can accountants actually do with MCP?

Accountants can ask the books questions in plain language and get answers from live data. Each request maps to a specific tool on the server. The table below groups the tools by accounting task, using the tool names each vendor documents.

Sources: the Intuit README, the Xero README, and Oracle's Available Tools in the MCP Standard Tools SuiteApp.

Where this earns its keep for accountants:

• Flux review prep. "Compare this month's P&L to last month and list lines that moved more than 10%." The server returns the report; you set the threshold.
• Aging questions. "Which customers are more than 60 days past due, and what do they owe?" maps to one aging tool.
• Reconciliation research. "Show every bank transaction over 5,000 that isn't reconciled" turns a ledger search into a one-line request.
• Client questions at a firm. A bookkeeper can answer "what did we spend on software last quarter?" without exporting a report.

Run these against a sandbox or a read-only role first, and tie every number back to the system's own report before you rely on it.

What can't MCP do for accounting?

An MCP server gives a model access to the books. It does not approve entries, run a close, sign off a reconciliation or keep evidence of why an entry was made. These gaps apply to every server above.

1. No approval before a write. The accounting servers run a tool as soon as the client calls it. The MCP specification says clients should ask a person to confirm tool calls, but that is a client setting, and the person confirming is the person asking. Oracle warns that an agent may run powerful tools "without the user's explicit intent" (Oracle). Stripe is the exception: it requires human confirmation for certain writes, such as refunds and outbound payments (Stripe). Even there, the requester and the approver can be the same person.

2. No segregation of duties. The tools inherit one user's access. If that user can both create a vendor bill and pay it, so can the AI client. Your preparer and approver separation has to live somewhere else.

3. No record of why. QuickBooks' audit log records the change, the user and the date. NetSuite's MCP execution log records each call's time, status, user and URL path, and keeps it for 21 days in production (Oracle). Neither records the prompt, the reasoning or an approver. An auditor asking "why was this entry booked?" gets no answer from the log.

4. No close, only single calls. A close is a sequence: tie the subledgers to the GL, book accruals, review, sign off, lock the period. Each MCP tool is one operation. The order of calls is generated at runtime, so the same request can produce a different sequence next month. If step three fails, steps one and two stay in the books.

5. No sign-off and no schedule. MCP is request-driven. Nothing runs on business day one unless a person asks, and no tool records that a reviewer signed off a reconciliation.

6. One client company per connection. QuickBooks connects one company per configuration (one realm ID). A Xero custom connection covers one organisation; Xero's bearer-token mode supports several at runtime, but the client then handles sign-in (Xero README). Firms with many clients manage one connection, and one set of credentials, per client.

How do you set up an MCP server for accounting?

Setup follows the same pattern on every system: a dedicated user or role, a read-only first run, a client connection, then a test against a report you already trust. The system-specific steps live in each vendor's docs and in the QuickBooks and NetSuite guides.

1. Pick the server for the books you keep. Use the vendor's own server where one exists (table above).
2. Create a dedicated user or role. NetSuite requires one: the Administrator role and full-access roles cannot use the AI Connector Service (Oracle). Give the role only the records the use case needs.
3. Start read-only. In QuickBooks, set QUICKBOOKS_DISABLE_WRITE, QUICKBOOKS_DISABLE_UPDATE and QUICKBOOKS_DISABLE_DELETE to true. In NetSuite, leave the REST Web Services permission off the role. Sage Intacct's server is read-only already.
4. Register the app and credentials. QuickBooks needs an app on the Intuit Developer Portal. Xero uses a custom connection's client ID and secret (XERO_CLIENT_ID, XERO_CLIENT_SECRET), and the server starts with npx -y @xeroapi/xero-mcp-server@latest. Stripe and NetSuite sign in with OAuth at a hosted URL.
5. Connect the AI client. Add the server to Claude, ChatGPT or another MCP client, and sign in with the dedicated user.
6. Test against a known number. Pull last month's trial balance and compare it to the report you closed on.
7. Decide who may use writes, in writing. If you turn writes on, name the users, the entities and the transaction types, and start in a sandbox.

Where does MCP leave a controls gap in accounting, and how does Loopfour close it?

MCP is a connection layer, not a control layer. It answers "can the model reach the books?" Accounting controls answer "should this entry post, who approved it, and can we show it to the auditor next year?"

An AI agent decides what to do at runtime. Loopfour does only what was approved.

Loopfour, the deterministic finance workflow automation platform, connects to QuickBooks, Xero, NetSuite, Sage Intacct and Stripe through its own integrations and runs accounting work as versioned, approved workflows. AI handles the steps that need interpretation, such as reading a vendor invoice or matching a remittance. Every step that touches the ledger runs the same way each time. Loopfour is a managed service: we build the workflow, run it and maintain it.

A typical close step: bank transactions pulled from Xero → matched against open items (Xero bank transaction sync) → exceptions sent to Slack → reviewer signs off → adjusting entry posted → run record kept. The model never holds a write-enabled token to the books. The workflow does, and it only runs the steps that were approved.

The two can sit side by side. Many teams will let accountants ask questions through a read-only MCP connection while anything that posts to the ledger runs through an approved workflow.

Loopfour does not ship an MCP server today. Native MCP support for Loopfour workflows is coming soon.

Go deeper

For how MCP fits a full finance stack, including hosts, clients and servers, MCP compared with APIs and iPaaS, and where approvals belong, read how financial workflow MCP connects AI to ERP and accounting systems with approvals and an audit trail. For system-by-system detail, see what the QuickBooks MCP server can and can't do, what the NetSuite MCP server can and can't do, and how ERP MCP servers compare with ERP integrations.