Is intuit/quickbooks-online-mcp-server safe?
https://github.com/intuit/quickbooks-online-mcp-server
This is the official Intuit-published QuickBooks Online MCP server, written by the QuickBooks team with comprehensive unit tests and security-conscious implementation (atomic token writes, symlink-aware env persistence, CSRF-resistant OAuth state validation). The SKILL.md is empty so no prompt injection is attempted, the clone contacted only GitHub, and all canary honeypot files remained unmodified. The primary operational risk is the breadth of irreversible financial operations exposed (20+ delete tools across all QuickBooks entity types) which could cause significant damage if the agent is manipulated via a co-loaded malicious skill. Users should load this server only in environments where all co-loaded skills are trusted.
Category Scores
Findings (5)
MEDIUM 20+ irreversible delete operations across all QuickBooks financial entity types -22 ▶
The MCP server exposes delete tools for every major QuickBooks entity with no confirmation step at the tool layer. An agent operating under a manipulated system prompt (e.g., from a malicious co-loaded skill) could delete invoices, customer records, journal entries, and bill payments in a single reasoning pass with no undo capability in QuickBooks. Users should ensure this skill is never loaded alongside untrusted skills.
LOW npm prepare lifecycle script runs TypeScript compiler at git/local install time -10 ▶
The prepare script executes automatically on npm install from a git URL or local path. The script is benign (tsc + chmod), has no remote fetching, and ships pre-built from the registry. No preinstall/postinstall hooks, no git hooks, no submodules, no symlinks outside the repo.
LOW OAuth refresh tokens persisted to filesystem .env with symlink-follow capability -7 ▶
The client atomically writes rotated QuickBooks OAuth tokens back to a .env file on disk (mode 0o600). Symlink following is implemented deliberately for containerised deployments where the .env may be a symlink to a persistent volume. The path is configurable via QUICKBOOKS_TOKEN_STORE_PATH. This is expected behaviour for an OAuth-based integration but means refresh tokens persist on the local filesystem.
INFO Pre-clone canary file reads originate from audit framework, not the skill 0 ▶
Inotifywait recorded reads of .env, id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP creds at 10:12:35 — several seconds before the git clone started. These accesses are from the audit harness establishing its monitoring baseline. The skill was never executed. All canary files remain byte-identical.
INFO Clean clone: single GitHub HTTPS connection, no new listeners, no unexpected processes 0 ▶
Network monitoring shows only the expected github.com TLS connection. The post-install socket state is identical to pre-install. No background processes, no DNS lookups to non-GitHub hosts, and no new open ports.