DeepLedgerA QuickBooks MCP server is in read-only mode when the server itself refuses every create, update, void and send, whatever the AI client asks. A prompt that says "don't change anything" is not read-only mode. In DeepLedger, read-only is an access level: an owner or admin sets a member to Read-only for a company, and DeepLedger's MCP server refuses that member's QuickBooks writes there from every AI client.
What read-only means for an AI connection
There are three places a write can be stopped. Only the server permission follows the sign-in to every client.
| Control | Where it lives | Holds if the AI ignores your instruction? |
|---|---|---|
| "Do not change anything" in the prompt | The conversation | No |
A client tool filter, such as xAI's allowed_tools | One AI client's configuration | Only for that configuration. The same credential can still write elsewhere. |
| A read-only permission on the server | The MCP server | Yes, for every client that uses that sign-in |
Reports, transaction lookups, the chart of accounts and customer or vendor lists all stay open. What it refuses is anything that changes the books or reaches the company's customers.
How DeepLedger's Read-only access works
DeepLedger sets access per member, per company. The same bookkeeper can be Read-write in one client's company and Read-only in another.
- Who sets it. Owners and admins, in Settings → Team.
- Who it applies to. Members with the Senior accountant, Bookkeeper or Client contact role. Owners and admins are always Read-write and cannot be set otherwise. The Client contact role is not read-only on its own; the Access setting is what makes it so.
- Where it is enforced. On DeepLedger's MCP server, on every tool call, before the tool runs. It applies to Claude, ChatGPT, Grok or any other client the member signs in to as themselves.
- When it takes effect. Usually on the member's next request, and at most about 10 seconds later. One exception: if the member had already started a QuickBooks attachment upload before the change, that one upload can still finish within its five-minute window. New upload requests are refused.
A Read-only member can:
- Run QuickBooks reports and look up transactions
- Read the chart of accounts, customers, vendors and items
- Read the company profile and switch between the companies assigned to them
- Read the bank feed, the document library, saved reports, AI memory and the month-end close
- Run saved reports
- List, create and comment on tasks, which is how they ask someone with Read-write access to record something
A Read-only member cannot record, change or void any QuickBooks transaction. They also cannot create or change accounts, customers, vendors or items, email a customer, record or exclude bank feed items, start a document upload, complete or dismiss tasks, change AI memory, or save and edit saved reports. A tool DeepLedger adds later is refused to Read-only members until it is deliberately allowed.
When the AI tries a write, it gets this message back from DeepLedger, with the company name filled in:
Read-only access: you can view Alpha LLC but can't make changes in QuickBooks. To change your access, ask an owner or admin in your DeepLedger workspace.
The write tools can still appear in the AI client's tool list. The refusal happens when the call reaches the server. The member also sees a Read-only badge on that company in the DeepLedger portal.
Set a member to Read-only
- In DeepLedger, open Settings → Team. To add someone, choose Invite member and pick a role other than Admin.
- In the member's row, select the Companies cell (Assign companies, or a count such as "2 of 5"). Tick the companies they should see and choose Save.
- Open the same dialog again. Under each assigned company, set Access to Read-only. The change saves on selection, and the portal confirms it, for example "Sam now has read-only access to Alpha LLC".
- For several companies at once, use Set all companies to and Apply.
The dialog repeats the rule in plain words: "Read-only members can view this company, run reports and ask the AI questions. They can't make changes in QuickBooks."
The member then connects their AI client by signing in to DeepLedger as themselves. To check the setting, have them run a report, then ask for a small write in a test company. They should get the refusal above. Do not test a refusal by attempting a write in a real company's books.
Make only some tools read-only
Sometimes the right answer is "Read-write, except journal entries." For a Read-write member, the same dialog has a Tools panel under each company. Each group can be set to Read-write or Read-only:
| Group | What becomes read-only |
|---|---|
| Sales and purchases | Bills, expenses, invoices, estimates, payments, sales receipts, deposits, transfers, credits and recurring transactions |
| Journal entries | Recording and changing journal entries |
| Voids | Voiding transactions |
| Emails to customers | Sending invoices and other sales forms from QuickBooks |
| Accounts and lists | Creating or changing accounts, vendors, customers, items, projects and custom fields |
| Bank feed | Recording, excluding and restoring bank feed items |
| Documents | Saving files to the library and attaching them in QuickBooks |
| Month-end close | Starting, updating and signing off a close |
| Completing tasks | Completing and dismissing tasks |
| AI memory | Changing what the AI agent remembers about this company |
| Saved reports | Saving, changing and deleting saved reports |
Viewing and reports stay open in every group. A refused call names the tool, for example: "Journal entries isn't turned on for you in Alpha LLC."
Where DeepLedger's read-only setting stops
- A new personal API key can write. Only owners and admins can create personal keys under Settings → API keys, and they are always Read-write. A personal key acts as the person who created it and follows that person's current access, so a headless agent that uses a new key has write access. A client tool filter narrows what the model sees but is not a permission.
- Your own sign-in as an owner or admin is Read-write. For an enforced read-only AI connection, the connection has to sign in as a member whose access is Read-only.
- It does not change QuickBooks. It is a DeepLedger permission. QuickBooks user roles are separate; see read-only access in QuickBooks Online.
When a write is appropriate, the AI write-access checklist covers what to review before approving one.
Other read-only QuickBooks MCP options
Each vendor describes its own controls differently. This table reflects their documentation as of November 2, 2026.
| Option | QuickBooks product | How read-only is set | What to know |
|---|---|---|---|
| Intuit's QuickBooks Online MCP server | Online | QUICKBOOKS_DISABLE_WRITE, QUICKBOOKS_DISABLE_UPDATE and QUICKBOOKS_DISABLE_DELETE set to "true" stop those tool categories from being registered. Read tools are always available. | Runs locally over stdio. You register your own Intuit developer app. |
| CData QuickBooks Online MCP server | Online | Described as read-only. Its tools list tables and columns and run SQL SELECT queries. | Local stdio. Needs CData's JDBC driver, a license or trial, and Java. CData sells separate products for full read and write. |
| Windsor.ai | Online | Windsor says its QuickBooks connector is read-only. | Built for analysis. Listed in Claude's connector directory. |
| Meridian | Online | Choose read-only or read-write for each connected company. | A service of Pilot. |
| Conductor | Desktop | Use the https://mcp.conductor.is/read-only URL. | Conductor calls it "a guardrail, not a security boundary": anyone with the Conductor key can still write through its API. QuickBooks Desktop and the Web Connector must be running. |
| DeepLedger | Online and Intuit Enterprise Suite | Read-only access per member, per company, set by an owner or admin. | Hosted, works with remote MCP clients. Owners and admins are always Read-write; personal API keys follow their creator's access. |
The useful question for any of them is the same: if the model sends a write call anyway, what refuses it? A setting that removes write tools from one local install protects that install. A server-side permission protects every client that uses the same sign-in.
Frequently asked questions
Does DeepLedger have a read-only mode for its QuickBooks MCP server?
Yes. An owner or admin can set a member's access to a company to Read-only under Settings, Team. DeepLedger's MCP server then refuses QuickBooks changes from that member in that company, whichever AI client they use. One exception: an attachment upload that was already started before the change can finish within five minutes. Owners and admins are always Read-write.
Is telling the AI not to change anything the same as read-only?
No. A prompt is an instruction the model can misread or ignore. Read-only mode is a rule on the server that refuses the write when the call arrives.
Can a DeepLedger API key be read-only?
Not when it is created. A personal key acts as the person who created it, and DeepLedger re-checks that person's access on every request. Only owners and admins can create keys under Settings, API keys, and they are always Read-write, so a new key can write. If the creator later moves to another role and is set to Read-only, the key follows. For read-only access from the start, use a Read-only member's own sign-in.
Can I make only some tools read-only?
Yes. For a Read-write member, an owner or admin can make individual tool groups Read-only in one company, for example Journal entries and Voids, while bills and invoices stay open.