quickbooks-online-mcp-server
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions require cloning the server source code from Intuit's official GitHub repository (github.com/intuit/quickbooks-online-mcp-server.git).
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the QuickBooks Online API, which serves as a potential surface for indirect prompt injection.
- Ingestion points: Data is ingested into the agent context through tools that retrieve QuickBooks entities (e.g., Customers, Invoices, Vendors) and financial reports.
- Boundary markers: The skill does not provide specific delimiters or instructions for the agent to distinguish between its own system instructions and natural language content found within QuickBooks data fields.
- Capability inventory: The skill exposes 144 tools, including significant write and delete permissions such as
create_invoice,delete_invoice, andupdate_customer, which could be abused if an injection occurs. - Sanitization: There is no evidence of data sanitization or validation routines to filter malicious instructions embedded in the financial data returned by the API.
Audit Metadata