PeaBrainQuickBooks Desktop and MCP
What MCP is
MCP stands for Model Context Protocol. It is an open standard for connecting an AI assistant to a data source through a defined set of tools, rather than by pasting exports into a chat window.
An MCP server exposes a fixed list of operations. The assistant can call those operations and nothing else. That matters here: the boundary of what the assistant can do is the tool list, and the tool list is written by the server author, not by the assistant and not by the person using it.
PeaBrain is an MCP server that exposes read-only QuickBooks Desktop queries.
Why QuickBooks Desktop needs a middle layer
QuickBooks Desktop is Windows software that keeps its data in a company file on a specific machine. It is not a cloud service and has no public API that an outside application can call.
The supported way in is the QuickBooks Web Connector, which ships with every Desktop edition. The important detail for anyone assessing risk: the Web Connector polls outward. It runs on the QuickBooks machine, reaches out to fetch work, and returns results. Nothing connects inward to the QuickBooks machine, so there are no inbound ports to open, no VPN, and no firewall changes.
PeaBrain uses Conductor as the middleware between the Web Connector and the MCP server. Conductor handles the QuickBooks protocol layer and exposes a REST API.
The path a question takes
- The business owner asks a question in Claude.
- Claude selects one or more PeaBrain tools and calls them.
- PeaBrain's MCP server sends the matching read request to Conductor over HTTPS.
- The Web Connector on the QuickBooks machine picks up the request on its next poll.
- QuickBooks Desktop computes the answer. It processes requests one at a time.
- The result returns along the same path.
PeaBrain's server stores nothing. It holds no database and no copy of the company file.
How read-only is enforced
Read-only here is not a setting or a promise. It is enforced twice in code, and the reason for two layers is that credentials at the middleware level are write-capable. Conductor does not issue read-only keys, so the restriction has to come from PeaBrain's software.
Layer one: enforcement by absence. The server registers 57 tools. Every one of them reads. There is no tool that creates, edits, or deletes anything, so there is no operation for an assistant to invoke even if it tried.
Layer two: an allow-list at the client. Every call into the QuickBooks SDK passes through a wrapper that permits only named read methods: list, retrieve, and the report methods that ask QuickBooks to compute a report. Anything else, including create, update, and delete, throws an error before any network request is made. This is covered by an automated test that asserts writes are refused and that no request leaves the process.
What this does not cover, stated plainly: the underlying Conductor credential could perform writes if it were used outside PeaBrain's software. Protecting that credential is part of the service, and it is why each client gets a separate Conductor project rather than a shared one.
Isolation between clients
One Conductor project per client, one running service per client, one secret URL per client. A credential issued for one client's project cannot address another client's company file; the request fails the same way an invented identifier would.
Access can be revoked three ways: rotate the service's path token, stop the service, or revoke that client's Conductor key.
Where the data goes, and for how long
- The company file stays on the client's machine. It is never copied or uploaded.
- Conductor holds API request logs, which include the data in those requests, for 15 days in a SOC 2 logging system, then deletes them permanently.
- PeaBrain's server retains nothing between requests.
- Claude keeps the conversation, like any chat history. PeaBrain provisions the account used for this and configures it to opt out of model improvement.
Everything in transit is encrypted. Data is processed in readable form at each hop, which is what any system that answers questions about your books has to do.
What it needs from the QuickBooks machine
- QuickBooks Desktop on Windows. Any edition. Enterprise is not required.
- The machine on, awake, and connected, with QuickBooks open, at the times answers are needed.
- The Web Connector, which is already installed with QuickBooks.
- A dedicated QuickBooks user for the connection.
Not supported: QuickBooks Online and QuickBooks for Mac. Neither has the Web Connector.
Two notes from experience. The company file should sit in the standard shared location, and QuickBooks should be opened by ordinary double-click, never "Run as administrator." An elevated QuickBooks cannot exchange data with a non-elevated Web Connector, and the failure is unhelpful: the connector appears to be running while every request fails.
What this page is not
PeaBrain's MCP server is not a product you can download, install, or self-host. There is no public repository and no trial. It is the software behind a service that includes the setup, the checking of answers against QuickBooks reports, and ongoing support.
If you are evaluating whether to build something similar yourself, the honest summary is that the MCP part is the easy half. The work is in knowing which QuickBooks fields mean what they appear to mean, and which ones quietly do not.
Questions about the connection, the credentials, or anything else on this page: hello@askpeabrain.com