# QuickBooks Online

**Status:** Connect script implemented. Design: [design/mcp-integrations.md](../../design/mcp-integrations.md).

- **Agent path:** local QBO MCP on Docker network with Hermes.
- **Allow:** P&L/reports, invoice/bill/vendor/customer read, company info.
- **Deny:** payment/bill_payment tools; write/update/delete off for MVP.
- **Connect:** operator `scripts/connect/connect-quickbooks.sh`.

## Connect procedure

```bash
# Preview (default)
./scripts/connect.sh quickbooks --dry-run

# Execute (prompts for credentials)
./scripts/connect.sh quickbooks --apply
```

### What the script does

1. **Dry-run:** Shows MCP image, container name, Docker network, allowed/denied tools.
2. **Apply:**
   - Prompts for QBO Client ID, Client Secret, Access Token, Realm ID.
   - Stores credentials via `openshell provider set qbo-*`.
   - Registers MCP server type via `nemohermes config set`.
   - Applies tool allowlist (read-only) and denylist (payment/write tools).
   - Records status in `.local/capability_state.json`.
   - Provides guidance for starting the MCP container.

### Owner steps (browser only)

1. Create a QBO application at [developer.intuit.com](https://developer.intuit.com).
2. Complete OAuth flow to obtain Client ID, Client Secret, and Access Token.
3. Note the Realm ID (company ID).
4. Provide credentials to the operator.

### Tool filters

| Allowed (read) | Denied |
|----------------|--------|
| `get_report` | `create_payment` |
| `search_invoice` | `bill_payment` |
| `get_invoice` | `create_invoice` |
| `search_bill` | `update_invoice` |
| `get_bill` | `delete_invoice` |
| `search_vendor` | `create_bill` |
| `get_vendor` | `update_bill` |
| `search_customer` | `delete_bill` |
| `get_customer` | |
| `get_company_info` | |

### MCP container

The QBO MCP server runs as a Docker container on the same network as Hermes:

- **Image:** `ghcr.io/intuit/quickbooks-online-mcp-server:latest`
- **Container:** `lumina-qbo-mcp`
- **Network:** `lumina-network`