---
name: quickbooks
description: "QuickBooks Online connector — operator-owned Intuit app, OAuth consent relay, then agent-driven read/write over the QBO REST API."
tools:
  - name: quickbooks-credentials-set
    publicAllowlist: false
    adminAllowlist: true
    riskClass: write_local
  - name: quickbooks-authorize-url
    publicAllowlist: false
    adminAllowlist: true
    riskClass: read
  - name: quickbooks-connections
    publicAllowlist: false
    adminAllowlist: true
    riskClass: read
  - name: quickbooks-token-audit
    publicAllowlist: false
    adminAllowlist: true
    riskClass: read
  - name: quickbooks-disconnect
    publicAllowlist: false
    adminAllowlist: true
    riskClass: external
  - name: quickbooks-query
    publicAllowlist: false
    adminAllowlist: false
    riskClass: read
  - name: quickbooks-report
    publicAllowlist: false
    adminAllowlist: false
    riskClass: read
  - name: quickbooks-invoice-create
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
  - name: quickbooks-invoice-update
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
  - name: quickbooks-customer-create
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
  - name: quickbooks-customer-update
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
  - name: quickbooks-bill-create
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
  - name: quickbooks-payment-create
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
  - name: quickbooks-entity-create
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
  - name: quickbooks-entity-update
    publicAllowlist: false
    adminAllowlist: false
    riskClass: external
skills:
  - skills/quickbooks/SKILL.md
metadata: {"platform":{"optional":true,"pluginKey":"quickbooks"}}
mcp:
  command: node
  args:
    - ${PLATFORM_ROOT}/lib/mcp-spawn-tee/dist/index.js
    - ${PLATFORM_ROOT}/plugins/quickbooks/mcp/dist/index.js
  env:
    MCP_SPAWN_TEE_NAME: quickbooks
    LOG_DIR: ${LOG_DIR}
    PLATFORM_ROOT: ${PLATFORM_ROOT}
    ACCOUNT_ID: ${ACCOUNT_ID}
    SESSION_ID: ${SESSION_ID}
mcp-manifest: auto
---

# QuickBooks Online

Connects to QuickBooks **Online** — the cloud accounting product (REST/JSON, OAuth 2.0). There is no local company file; the books live in Intuit's cloud, so every call proves app identity plus per-company consent.

Real Agent ships installs and walks away, so Real Agent is **never** the OAuth app owner. The operator registers their **own** Intuit app; its client ID/secret is a per-brand secret like the Cloudflare token. Two steps are irreducibly human and are relayed, never auto-clicked: registering the app at developer.intuit.com, and clicking the consent link for each company. Everything after — code→token exchange, access-token refresh, every REST call — is agent-driven.

## Capabilities

- **quickbooks-credentials-set** — store the operator's Intuit app client ID + secret (sandbox or production).
- **quickbooks-authorize-url** — mint a consent URL for a human to click; one company per click.
- **quickbooks-connections** — list connected companies and the age of each refresh token.
- **quickbooks-token-audit** — probe each refresh token; surfaces a dead connection before a customer-facing call hits it.
- **quickbooks-disconnect** — drop one company's stored token.
- **quickbooks-query** — read any entity via the QBO query language (invoices, customers, bills, …).
- **quickbooks-report** — fetch a named report (ProfitAndLoss, BalanceSheet, …).
- **quickbooks-invoice-create / -update**, **quickbooks-customer-create / -update**, **quickbooks-bill-create**, **quickbooks-payment-create** — entity-specific writes.
- **quickbooks-entity-create / -update** — generic write for any other entity (Vendor, Item, Estimate, …).

## Setup

Connecting QuickBooks runs through the `quickbooks` skill (`skills/quickbooks/SKILL.md`): register the Intuit app, paste the credentials, then relay the consent link. The skill is the operator-facing procedure; load it and follow its instructions.

## Credentials and isolation

Credentials and per-company refresh tokens live only in this account's secrets directory (`secrets/quickbooks.json`, mode `0600`), inside the brand-isolated install. No Intuit app identity is shared across brands. Token refresh is automatic until a refresh token expires (~100 days of inactivity) or is revoked.