Puzzle API and MCP vs QuickBooks Online API + MCP

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

QuickBooks Online API + MCP 38

OAuth 2.0 with OpenID Connect, one-hour access tokens and rotating refresh tokens of about 101 days. The accounting scope is a single grant over the whole ledger, with no read-only scope (22). No read-only mode in the API. The official MCP can drop create, update and delete tools by flag (8). Returns the company's records with customer and vendor text and no injection guidance (3). No API audit view found. QuickBooks' own audit log wasn't checked (0, unchecked). security.intuit.com returns only a loading message and www.intuit.com/.well-known/security.txt answers 400, so we couldn't confirm a disclosure policy, bounty or certifications (5, unchecked).

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

QuickBooks Online API + MCP 38

No OpenAPI spec found. Intuit's Java SDK repository publishes the V3 payload schemas as XSD, about 20,000 lines with some 200 complex types and about 110 simple types, many of them enums. They type every entity but don't describe endpoints, so part credit (10 of 25). No llms.txt or Markdown docs; the developer docs pages returned a loading message to a plain fetch on 1 October (0). The official MCP server's descriptions are one line, such as "Create an invoice in QuickBooks Online." (6). The XSDs carry enums such as TaxExcluded, TaxInclusive and NotApplicable, the MCP's Zod schemas use min and positive, and the Java, .NET and PHP SDKs are typed (12). The OAuth client documents its error codes. The API's own error and example pages couldn't be read (5). Minor versions (the Java SDK targets 75). The dated change posts credited earlier were on Intuit's medium.com blog, now struck (robots.txt disallows ClaudeBot), and the portal's release notes are unread, so versioning alone (5). 10 + 0 + 6 + 12 + 5 + 5 = 38.

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

QuickBooks Online API + MCP 40

Statuspage at status.developer.intuit.com with separate QuickBooks Online API, sandbox, OAuth, webhooks and Payments components (20, per the 1 October check, not re-read on 4 November). Incident line 0 held. The 8 July and 26 July majors have left the 90-day window from 6 August, and the window up to 1 October holds API timeouts with OAuth and sandbox failures for about 7.75 hours on 1 September, TaxCode and TaxRate 4001 errors for about 9.75 hours on 22 and 23 September, sandbox creation failing from 5 September and the sandbox view down on 30 September. 2 October to 4 November is unread, because Intuit's platform terms bar scraping and the status page sits on intuit.com, and a partly unread window earns no credit for the unread part (0). The limits page is inside a JavaScript portal, so we couldn't read the numbers (0, unchecked). The official Node OAuth client's README retries 408, 429 and 5xx with backoff. Intuit's 31 August blog post on Retry-After and RequestId sat on medium.com, whose robots.txt now disallows ClaudeBot, so that reading is struck and backoff guidance alone remains (10). No SLA found (0). GA (10). 20 + 0 + 0 + 10 + 0 + 10 = 40.

Puzzle API and MCP 15

No x402, MPP or L402 (0). Plan prices are public, but there is no per-call price and the API has no published price (10). "Try for free" on every plan, with trial length and card requirement not stated on the pages read (5). A person signs up and authorises in a browser, and API credentials come by email (0). 0 + 10 + 5 + 0 = 15.

QuickBooks Online API + MCP 30

No x402, MPP or L402 (0). QuickBooks Online plans are priced publicly in local currency on quickbooks.intuit.com. Intuit's partner tiers (the status page names Builder partners and partner tier subscriptions on 10 July 2026) and any metering of API calls are inside the portal, so we scored plan-only (10). Free sandbox companies with a developer account, no card per the 30 September check (20). Browser signup, app registration and an OAuth consent in a browser (0).

Puzzle API and MCP 56

MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.

QuickBooks Online API + MCP 68

The query endpoint takes where clauses with STARTPOSITION and MAXRESULTS, so reads can be cut down server-side. The official MCP loads 145 tools, with DISABLE_WRITE, DISABLE_UPDATE and DISABLE_DELETE flags to drop whole groups (15). Query filtering and paging on every entity, plus reports with date parameters (18). Fault responses carry numbered codes such as 4001, though the catalogue sits in the unreadable portal (10). The Java and .NET SDKs send a requestid with each call. Intuit's description of RequestId as the idempotency mechanism was on its medium.com blog, now struck, so the earlier partial is kept on the SDK evidence and flagged. The MCP sets no readOnlyHint or destructiveHint (10). Official SDKs for Java, .NET and PHP and OAuth clients for Node and Python (15). 15 + 18 + 10 + 10 + 15 = 68.

Puzzle API and MCP 53

The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.

QuickBooks Online API + MCP 65

PHP SDK v6.4.1 was tagged on 21 October 2026, 14 days before the check. It raises the PHP floor to 8.2 and the Guzzle floor and changes the JSON serializer, so it isn't dependency-only (30). In the 90 days from 6 August, .NET SDK V14.7.1.6 (17 September) and PHP SDK v6.4.1 (21 October), two dated releases. Java SDK v6.6.3 (3 August) falls before the window, and the dated API posts on Intuit's medium.com blog are struck (0). The official MCP repository merged community pull requests on 10 August and 15 September; Intuit's portal release notes and forum couldn't be read (12, the earlier partial, flagged). Official SDKs in Java, .NET and PHP and OAuth clients for Node and Python. The MCP isn't in the official registry (15). The MCP's CI builds, lints and tests on Ubuntu and Windows, with a dependency audit workflow (8). 30 + 0 + 12 + 15 + 8 = 65.