Skip to content

Add QuickBooks third-party MCP plugin - #323

Draft
SamSokolin wants to merge 1 commit into
mainfrom
cursor/quickbooks-plugin-a20d
Draft

Add QuickBooks third-party MCP plugin#323
SamSokolin wants to merge 1 commit into
mainfrom
cursor/quickbooks-plugin-a20d

Conversation

@SamSokolin

Copy link
Copy Markdown
Collaborator

Summary

Adds third_party/quickbooks, a marketplace plugin for Intuit's official QuickBooks Online MCP server (intuit/quickbooks-online-mcp-server), mirroring the layout of third_party/xero and third_party/gmail. Registers it in .cursor-plugin/marketplace.json and the root README.md table.

How the official server is installed

Intuit's official server is local stdio only and is not published to npm (its package.json name @qboapi/qbo-mcp-server does not exist on the registry, and the repo has no releases). Intuit's docs describe cloning and building it. The plugin therefore runs it with

npx -y github:intuit/quickbooks-online-mcp-server

which clones, builds (preparetsc), and launches the bin. Verified end to end on this branch: the exact mcp.json command with all five ${VAR} placeholders populated starts the server over stdio and answers initialize + tools/list with 142 tools; warm launches reuse the npx cache (~2s) and the server's rotated-token .env survives between runs.

A hosted endpoint does exist (https://mcp.quickbooks.intuit.com/mcp, documented in IntuitDeveloper/intuit-3p-ai-pilot), but it is an invitation-only App Partner pilot requiring IP allowlisting and restricted MCP scopes provisioned by an Intuit Solution Engineer, so it is not usable for a general marketplace plugin. The README explains this and points to it.

Variables (no secrets shipped)

All user-supplied via Dashboard → Plugins → Configure; the plugin contains only ${VAR} placeholders:

Variable Notes
QUICKBOOKS_CLIENT_ID / QUICKBOOKS_CLIENT_SECRET From the user's own Intuit Developer app
QUICKBOOKS_REFRESH_TOKEN / QUICKBOOKS_REALM_ID Sandbox: from Intuit's OAuth 2.0 Playground. Production: via the one-time handshake documented upstream (Intuit rejects localhost redirects in production)
QUICKBOOKS_ENVIRONMENT enum: [sandbox, production], default sandbox

The refresh token is required rather than relying on the server's built-in browser OAuth flow because that flow console.logs the authorize URL to stdout, which would corrupt the MCP stdio stream, and it cannot work at all in production.

All variables are marked required, matching every existing plugin in the repo (the behavior of unset optional variables is undocumented).

Logo

assets/logo.svg is the QuickBooks "qb" mark on the brand green (#2CA01C), taken from the Intuit-owned IntuitDeveloper GitHub organization (SampleApp-Webhooks-Java-Cloudevents/src/main/resources/static/quickbooks-1.svg).

Validation

  • node scripts/validate-plugins.mjsAll plugins validated successfully.
Open in Web Open in Cursor 

Intuit publishes no generally available hosted MCP endpoint (the one at mcp.quickbooks.intuit.com is an invitation-only partner pilot gated by IP allowlisting and restricted scopes), and its official `intuit/quickbooks-online-mcp-server` is a local stdio server that is not on npm. The plugin therefore installs it from GitHub with `npx` and passes the user's own Intuit app client ID/secret, refresh token, realm ID, and environment; no credentials ship with the plugin.

Co-authored-by: Sam Sokolin <SamSokolin@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants