|
EXPLAINER |
AI FOR ACCOUNTANTS · PART 3 OF 16
What an MCP server is and why accounting vendors are shipping one
It is the plumbing that lets an AI assistant act inside your software - and the permissions are yours to set, not the vendor's.
Model Context Protocol (MCP) is a standard that lets an AI assistant call functions inside a piece of software the way a human would use a menu or a button. When a vendor ships an MCP server, they are publishing a list of things the assistant is allowed to do - pull a transaction, post a journal entry, open a client file - and the assistant calls those functions without you writing any code. Think of it as the API of the agent era: structured, permissioned, and designed to be read by a model rather than a developer.
The mechanism works in three parts. The MCP server lives on the vendor's side (or self-hosted) and exposes a catalogue of tools - named functions with typed inputs and outputs. The assistant, running in your chat interface or workflow tool, reads that catalogue and decides which function to call based on your instruction. The server executes the call against the actual application data and returns a structured result. Nothing about that loop is magic; it is a round-trip between the model and a defined endpoint, the same way a formula calls a named range.
In accounting work the concrete version looks like this: you are reconciling a bank feed in a mid-month close and you ask the assistant to flag transactions over a certain amount that have no matching bill. The assistant does not scrape a screen or guess at a CSV; it calls the vendor's MCP function for unmatched transactions, receives a structured list, and surfaces it directly in your conversation. The workpaper gets populated from a live query, not a copy-paste. That is useful. What is also true is that the same connection could post entries or approve payments if those functions are in the catalogue and the permissions allow it.
Permissions are the part practitioners need to think about before they rely on any MCP-connected assistant. Each tool in the catalogue can be scoped: read-only, write, approve. A well-configured MCP server for audit support might expose only read functions on a client ledger, leaving posting and period-close functions off the catalogue entirely. A poorly configured one might expose everything the API allows. Before you demo or deploy an MCP-connected assistant, ask the vendor to show you the tool list and what each function can write. If they cannot produce that list, treat it as a write-everything connection until proven otherwise.
One recent indicator of where this is heading: QuickBooks Early Fall 2026 Updates includes new integrations with ChatGPT and Claude that let businesses interact with financial data through conversational AI - payroll queries, cash-flow insights, sales quote-to-cash workflows. That pattern will repeat across accounting platforms. The practical response is not to wait for a single trusted standard to emerge, but to build a habit now: when any assistant touches live accounting data, know exactly which functions it can call, which it cannot, and who authorized the difference.
WORKED EXAMPLE
In practice
A staff accountant is preparing the accounts payable subledger reconciliation for the month just ended. The client file lives in a cloud accounting platform that has published an MCP server with read functions for open payables, bill status, and vendor balances.
What came back. The assistant called the unmatched-payables function and returned a structured list of vendors with discrepancies, including vendor name, both balances, and the difference for each. Most discrepancies traced to timing differences on bills entered after the period cut-off. One vendor showed a duplicate bill posted twice - a real error the assistant flagged correctly but labeled as a 'timing difference' in its summary, which was wrong.
How it was checked. The accountant pulled the vendor detail report directly from the platform for each flagged vendor and agreed the balances shown in the assistant's output to the report line by line before recording any adjustment.
A constructed example. The prompt is usable as written; the figures show the shape of a result, not a measured one.
WHEN TO USE IT
| WHEN NOT TO
|
WHAT TO TAKE FROM THIS
| Ask every vendor to produce the full MCP tool list before a demo or deployment. | |
| Scope permissions to read-only for any assistant touching a live client ledger. | |
| Write-capable MCP connections need the same approval chain as human posting access. |
SPONSORED
QUESTIONS THIS ANSWERS
Can an MCP-connected assistant post journal entries without my approval?
Yes, if the posting function is in the catalogue and permissions allow it. Scope the connection to read-only functions until you have reviewed the full tool list with the vendor.
Is MCP the same as a regular API integration?
It uses the same underlying API calls, but MCP wraps them in a catalogue a model can read and reason about. The difference is that the assistant can discover and chain functions on its own, rather than being hard-coded to one action.
Do I need a developer to set up an MCP server?
Not always. Vendors who ship a hosted MCP server handle the setup; you configure permissions through their settings or admin panel. Self-hosted MCP servers do require technical setup.
SOURCES
Where this comes from
What the accounting job market is actually asking for.
GO DEEPER
Go deeper
IN THIS SERIES
Previously: Why agents need approval gates
Next: How retrieval differs from training (coming)
An explainer, not a study: it carries no statistics on purpose. Examples are illustrative.
How accountants are using AI, automation and smarter workflows to close faster, audit cleaner, and free up time for real work.
Accounting Stack · Audit Friendly Data · Remote A&F Jobs
Audit Friendly · modernaccounting.ai