Read-Only vs Write MCP for Accounting AI Agents

By Jude Lee · · Custom

Two accountants reviewing draft journal entries on a laptop in a CPA firm office

The shift the announcements are signaling

MCP — the Model Context Protocol — is an open standard for giving an AI assistant governed access to your data and tools. For the past stretch, nearly every accounting MCP story has been about reading: connect Claude or another assistant to QuickBooks Online or Xero, let it pull reports, ask it questions. We covered the mechanics of that in connecting an AI assistant to QuickBooks or Xero via MCP.

Two recent vendor moves point the other direction. Digits announced what it calls a “Write MCP,” positioned as a safer way for AI agents to perform accounting actions rather than just read data — this is a vendor press release carried on Business Insider’s markets wire (accessed November 2026), not independent reporting. Separately, Gusto announced a redesigned Gusto Pro with a multi-client MCP aimed at accountants, also a vendor press release, distributed via Morningstar and dated 7 October 2026 (accessed November 2026). Wire distribution is not editorial verification. Read the actual product documentation before you assume what either one permits — vendor framing and shipped scopes rarely match exactly, and both are new as of late 2026.

The pattern matters more than either product. Write-capable MCP is becoming a normal thing for accounting platforms to offer. Your firm now has to have a position on it.

What automation in accounting actually means now

Automation in accounting has historically meant deterministic rules: bank rules that code recurring vendors, recurring journal entries, scheduled imports, an Excel-based system with macros. Same input, same output, every time. That’s still the right tool for a large share of firm work.

Agentic automation is different in kind. An AI agent reads context, decides a sequence of steps, and calls tools. It handles messy inputs that rules choke on — a vendor name that changes every month, a bank memo that needs interpretation, a PBC follow-up that depends on what the client already sent. The tradeoff is that it is probabilistic. It will be right most of the time and confidently wrong some of the time, and you cannot predict in advance which.

Write access doesn’t make an agent smarter. It removes the step where a human catches it being wrong.

Three access tiers, compared

Think of any MCP connection to accounting data as falling into one of three tiers. Most firms should run all three simultaneously for different jobs.

Tier 1 — Read-only. The agent can query but never change anything. Trial balance pulls, flux analysis, “which clients have unreconciled items over 30 days,” draft financial statement narrative. Risk is confined to bad analysis, which a reviewer catches.

Tier 2 — Draft / propose. The agent writes into a staging layer: a draft journal entry awaiting approval, an uncategorized-transaction suggestion queue, a proposed bill coding. Nothing hits the GL until a human approves it inside the accounting system’s own approval workflow. Our view is that this tier is where most firm value sits, for a structural reason rather than a measured one: a draft-tier error is cheap to undo, so the expected cost of being wrong stays low even as volume scales.

Tier 3 — Full write. The agent posts directly. Entries land. Payments schedule. Clients get emailed.

Draft / propose tier
Agent creates a draft JE or categorization suggestion; reviewer approves in-app. Errors are caught before they touch the ledger. Audit trail shows who approved what. Slower per item, but review is fast when the agent is usually right. Fits month-end close, transaction coding, AP coding, reconciliation prep.
Full write tier
Agent posts directly to the GL or sends client-facing output. Fastest throughput. Appropriate only for narrow, low-variance, reversible actions with strong detective controls behind them — and only after you’ve measured the agent’s error rate on your own data. Errors propagate into client financials and client inboxes.

Where write access earns its keep — and where it breaks

Good candidates, in our view: transaction categorization into a review queue, creating draft journal entries from a documented accrual schedule, opening and updating workflow tasks in practice management, writing memo fields and attaching source documents, logging client communications. These are high-volume, low-judgment, and easy to inspect in bulk.

Bad candidates: anything touching a closed period, anything that changes the chart of accounts, revenue recognition judgments, materiality calls, anything that initiates a payment, and anything that sends client-facing communication without a human reading it. Also bad: workflows where the agent’s input is a scanned document of unknown quality and nobody downstream will ever look at the source.

The failure mode we’d flag hardest is quiet drift. An agent coding transactions at high accuracy still creates a slow accumulation of plausible-but-wrong classifications that nobody notices until a tax preparer or an auditor hits it. Drift is detectable if you build the detection, and two checks are concrete enough to actually run:

That’s why we’ve argued for building review gates rather than autopilot, and why you should test any agent against your own labeled sample before trusting it.

Guardrails to require before you turn on writes

  1. Scope credentials to least privilege, per client

    The agent’s token should grant exactly the operations you intend — not “full access” because that’s the default scope offered. If you serve many clients, isolate credentials per client so a prompt about Client A can never touch Client B’s books. See our comparison of multi-client MCP approaches.

  2. Route every write through an approval state

    Prefer the accounting platform’s native draft/approval object over a write that posts immediately. If the platform has no draft state for an action, that action probably shouldn’t be agent-writable yet.

  3. Log the full action chain, not just the outcome

    You want: which agent, which prompt or skill triggered it, which tool call, which parameters, which record changed, at what time. If you can’t reconstruct a posted entry’s origin six months later, you have an audit problem, not a technology problem.

  4. Set rate and value limits

    Cap how many writes an agent can make per run and what dollar magnitude it can touch unattended. A runaway loop should hit a ceiling, not the end of the GL.

  5. Check it against your data-security obligations

    If taxpayer data is in scope, your written information security plan obligations under the FTC Safeguards Rule — summarized for tax professionals in IRS Publication 4557, Safeguarding Taxpayer Data — apply to agent access exactly as they do to staff access. Confirm specifics with your firm’s security advisor and the primary source.

  6. Measure before you widen

    Run the agent in draft mode for a defined period, then sample deliberately rather than drawing flat random items. Stratify two ways: by dollar magnitude (separate buckets for immaterial, mid-range, and large items, sampling the large bucket far more heavily) and by account, so high-volume accounts don’t crowd out the rare ones where errors hide. Record error rate and error type per stratum. Promote to broader write scope only on evidence from your own books.

Vendor write MCP or your own MCP server

If a platform you already use ships a governed write MCP that covers the actions you need, use it. You get the vendor’s permission model, their audit log, and their maintenance burden. That’s a real advantage, and “build it ourselves” is often the worse call.

A custom MCP server over your own stack makes sense when the job spans systems no single vendor covers — GL plus practice management plus document storage plus your internal client database — or when you need to enforce firm-specific rules that no vendor exposes (e.g., “never create an entry above X without a partner token”). The cost is that you now own the security review, the logging, and the upgrade path forever.

What this means for the people signing the work

The question people type — whether CPAs get replaced by AI — misses what write access actually changes. Licensure, professional standards, and the signature on an engagement are human obligations; the AICPA’s professional standards are written for practitioners, not software. An agent that posts entries doesn’t assume responsibility for them. Someone at your firm still does.

What shifts is the shape of the work: less keystroke production, more specification and review. Defining what “correct” looks like for an agent — what we’d call a skill, a reusable packaged instruction that gets the job done the same way every time — becomes a billable-grade competency. The practical risk to staff isn’t replacement; it’s firms building agent workflows nobody on staff understands well enough to review.

On the perennial questions about what the largest firms run and what the single best automation software is: the largest firms operate publicly described proprietary audit platforms layered over enterprise ERP, which is a different problem from a 12-person firm’s. There is no single best accounting automation tool, and anyone ranking one is ranking for a use case that may not be yours. Pick based on which of your workflows is actually expensive — our breakdown of the agentic month-end close is a reasonable place to start.

Modeling the value honestly

Don’t take anyone’s hour-savings headline, including ours. Model it. The three lines below are inputs for you to fill in from your own books — they are not figures we measured, observed, or are reporting from anywhere.

volume × minutes saved
Gross time recovered per month
Worked example — use your own transaction counts
× blended hourly cost
Convert recovered hours to dollars
Your firm's realization-adjusted rate
− review time added
Subtract the approval step you just created
Measure during your pilot

The line firms forget is the subtraction. A draft-tier agent adds a review step. If reviewing its output takes nearly as long as doing the work, you’ve bought nothing — and that’s a legitimate finding, not a failure to adopt. The payoff case is when review is genuinely fast because the agent is reliably close, and the recovered hours get reallocated to advisory or additional clients rather than evaporating into slack capacity.

Write-capable MCP is a real step forward. Treat it as an internal-controls design exercise with a technology component — and before you grant any write scope that touches a closed period, a filed return, or a client-facing communication, have that specific decision reviewed by a qualified tax or assurance professional at your firm.

Not sure where to start?

Get a free automation audit: we map your bookkeeping, month-end close, client onboarding, document collection, and AP/AR — and show you what's worth automating before you spend a dollar.

Get a free automation audit

Related guides