MCP for Accountants — What It Is and Who Has One

There is a new line item quietly appearing in accounting software, and almost nobody is advertising it.

The Model Context Protocol — MCP — is an open standard that lets an AI assistant use an application’s tools directly. Not a chatbot bolted onto a sidebar, and not another integration you configure field by field. You connect the application once, and the assistant can then read your firm’s data and do work in it, the same way it already reads your files or your calendar.

For a firm owner, the practical difference is this: instead of exporting a report and pasting it into a chat window, you ask “which clients had no time logged this month?” and the assistant goes and looks.

That is worth understanding before your next renewal conversation, because the vendors who have built one mostly have not told you. We spent a morning checking, endpoint by endpoint, rather than reading marketing pages. What we found is a category that has shipped a significant capability and forgotten to document it.

What an MCP server actually does inside a practice

Strip away the protocol talk and an MCP server is a list of things an assistant is allowed to do, published in a format the assistant can read for itself. That last part is the whole trick. With a normal API, a developer reads the documentation and writes code for your firm. With MCP, the assistant reads the tool list and figures out the call.

So the useful question is not “does it have MCP” but “what is on the list”.

A practice-management MCP server typically exposes tools in a few families:

• Reading the firm — clients, tasks, projects, time entries, notes. This is the bulk of the value for most firms, and the least frightening.
• Doing work — completing a task, logging time, adding a comment, applying a workflow to a client.
• Money — drafting or sending an invoice, reading a contract, checking a budget. This is where the sharp edges live.
• Reporting — margins, utilisation, unbilled work, whatever your system already computes.

Uku’s own server, for example, exposes 85 tools across 16 areas of a firm’s work. The split is worth quoting precisely because it is not the flattering one: 42 of those tools read and 43 write. When we first shipped the page describing it, we had written “most of them read-only”, which was false in the direction that suited us, so we replaced the sentence with a count generated from the server’s own registry. You can read the full list on the Uku MCP server page — every tool, named.

That is the level of detail you should expect to find before you connect anything to client records. In practice, you mostly cannot.

Which accounting vendors have one today

We checked on 3 September 2026 by sending an unauthenticated request to each vendor’s MCP endpoint and reading what came back. A live server answers with a 401 and an authentication challenge. A vendor with nothing there answers with a 404, or nothing at all.

Two things are worth saying plainly about that table.

The first is that Karbon shipping an MCP server with both read and write scopes is a real piece of engineering, and it is ahead of most of the category. Their developer llms.txt is genuinely good — it explains their architecture, their PermaKey model, their API’s plan restrictions. A firm’s IT person handed that file has what they need.

The second is that a firm owner will never find it. There is no page on the marketing site describing what the MCP server does, which tools it exposes, or what an assistant connected to it is permitted to change in your clients’ records. The one public reference is a URL in a file written for developers and their coding agents.

Client Hub is further along the same road: a live server, 401ing away, with no discoverable documentation of any kind.

On the ledger side

The general-ledger vendors have been more open about it. Xero publishes its MCP server as an open-source repository, XeroAPI/xero-mcp-server, covering contacts, chart of accounts and invoice management, alongside an AI developer hub. Intuit does the same for QuickBooks Online at intuit/quickbooks-online-mcp-server. In both cases you can read the code before you decide.

This is the shape most firms will end up in, and it is worth planning for: an MCP client can hold several servers at once. The ledger’s server for the books, the practice system’s server for the tasks, the time, the deadlines and the margins.

What firms actually want from this

When we surveyed accounting firms for our 2026 AI report, the answers were more grounded than the sales pitches around them.

The single most requested job for an autonomous AI agent was not analysis or forecasting. Nearly 7 in 10 firms said the first thing they would hand over is chasing clients for missing documents — the dull recurring chore that eats a junior’s week and never quite finishes.

And the number that should shape every buying decision in this category: 0% of firms said they already fully trust AI to act on its own. Not one respondent. Almost all of them want a person to approve before anything is sent or filed.

That is not a vote against AI. It is a specification. Firms will hand over the work the moment they keep the final say — which means the interesting question about any MCP server is not how many tools it has, but which of them stop and ask.

Seven questions to ask before you connect one

Take these to your vendor. The answers are more revealing than the feature list.

1. Whose permissions does the assistant act with? The right answer is “the person who connected it, exactly”. If an assistant can open a client that the person who connected it cannot open in the software, connecting an AI has just widened someone’s access, and your access-control model is now fiction.

2. Which actions wait for an explicit confirmation? Money, bulk changes and deletions should preview precisely what they are about to do and wait for a yes. In Uku’s server 38 of the 43 write tools are gated this way. Ask for the number, not the reassurance.

3. Can the assistant widen its own reach? An MCP client requests the scope it wants when it connects. A well-built server discards that request and rebuilds the granted scope from its own rules — otherwise an assistant can simply ask for more and be given it.

4. Is financial access separate? Invoices, contracts, pay rates and budgets are a different category of exposure from tasks and deadlines. They should be their own consent, granted deliberately by someone who already administers the account, not folded into one general permission.

5. What is not exposed at all? Some things should be absent rather than gated. Inviting or removing members, changing roles, editing the subscription, deleting a client — these carry too much with them to hang on a chat confirmation. Ask what is off the list entirely, and be suspicious if the answer is “nothing”.

6. Does every action land in the audit trail, under a name? An assistant acting as you should be as visible as you clicking the button. If actions arrive attributed to a robot, or do not arrive at all, you have lost the thread you will need during a review.

7. Where is this written down? If the only answer is a URL in a developer file, that is worth pressing on. Ask for the tool list. A vendor who can hand you one has thought about the question; a vendor who cannot may not yet know what their own server permits.

How to check a vendor yourself

You do not need to wait for a sales call. Two checks take about a minute each.

Look for llms.txt on their developer domain — an emerging convention for machine-readable documentation, and increasingly where the honest technical detail lands first. Then try the conventional subdomain, mcp. in front of their domain. A live server answers an unauthenticated request with a 401 and an authentication challenge. A 404 means nothing is there.

Two cautions from doing this ourselves. A bot challenge — a Cloudflare interstitial, say — is not a “no”; it means you cannot see, and reporting it as an absence would be wrong. And searching a marketing page for the string “mcp” produces false positives: Karbon’s homepage contains nine of them, every one inside a base64 blob rather than a sentence.

Where this is going

The firms getting value from AI right now are not the ones with the most impressive demo. They are the ones whose systems let an assistant see real data and act on it under real constraints — which is exactly what MCP standardises.

The category will catch up quickly. What will separate vendors within a year is not who has a server, because most will, but who is willing to tell you in plain language what theirs is allowed to do to your clients’ records.

If you want to see what that looks like written out, our MCP server page lists all 85 tools by name, marks which ones write, and marks which ones stop and ask first. The AI agents page covers the API and CLI underneath it. Both are on the Elite plan, and the MCP server is in beta — we are adding firms one at a time so we can watch how it behaves on real data.

Frequently asked questions

What is MCP in accounting software?

MCP — the Model Context Protocol — is an open standard that lets an AI assistant use another application’s tools directly, instead of you copying data between them. In an accounting practice it means Claude or ChatGPT can read your task list, your time entries and your client records from your practice-management system and do work in them, under your own permissions, rather than you pasting a spreadsheet into a chat window.

Which accounting practice-management vendors have an MCP server?

Checked on 3 September 2026 by probing the endpoints directly: Karbon runs one at mcp.karbonhq.com with read and write scopes, Client Hub runs one at mcp.clienthub.app, and Uku runs one at app.getuku.com/mcp with 85 tools across 16 areas. TaxDome’s mcp subdomain resolves but sits behind a bot challenge, so it cannot be checked from outside either way. On the ledger side, Xero and Intuit both publish MCP servers as open-source repositories on GitHub.

Is an MCP server safe to connect to client data?

It depends entirely on how the server is built, which is why the questions matter more than the badge. Ask three things: does the assistant inherit your permissions or get its own broader set; do consequential writes — money, bulk changes, deletions — preview and wait for an explicit yes; and does every action land in the audit trail under a named person. A server that answers all three well is safer than a read-only one that answers none of them.

Can an AI assistant delete a client through MCP?

It should not be able to. Deleting a client carries its tasks, portal access, files and billing history with it, which is far too much to hang on a chat confirmation. In Uku’s MCP server that operation is not offered to an assistant at all, and account administration — inviting or removing members, changing roles, editing the subscription — is absent by design rather than merely gated.

Do I need an MCP server if my practice software already has an API?

They solve different problems. An API is for a developer building an integration once. An MCP server is what lets an assistant you already use discover the available tools by itself and call them in conversation, with no glue code written for your firm. Most firms will end up holding several at once — the ledger’s server for the books, the practice system’s for tasks, time and deadlines.

How can I check whether a vendor has an MCP server?

Ask them, and check two public places yourself. Try their developer site’s llms.txt file, which is where machine-readable documentation is increasingly published, and try the conventional subdomain — mcp.theirdomain.com. A live server answers an unauthenticated request with a 401 and an authentication challenge rather than a 404. If you find one that way and there is no page describing it, that gap is itself worth raising in the sales conversation.