Digits and Puzzle chose read-only MCP to protect the ledger. We built write tools with rules instead. Here’s the difference.
Spend an afternoon on accounting software websites and “AI” appears on every one of them. Look at what it actually does and the picture is more mixed. In some products it suggests a category and a person clicks accept. In others it does a good share of the bookkeeping by itself. In a few, Claude or ChatGPT can now be connected to ask questions about the numbers.
What almost none of them allow is handing the work to a company’s own agent. That gap is why we built AgenticBooks. This post walks through the market as we see it, including the places where competitors are ahead of us.
How the market breaks down
The easiest way to sort AI accounting products is to ignore the marketing and ask what the AI is allowed to do. QuickBooks and Xero are still the default for most small businesses. They’ve had twenty years to deal with payroll, sales tax and every odd edge case, and most accountants already know them. The AI they’ve added is useful, but it’s assistive. It suggests, and a person clicks.
Next are tools like Booke AI that sit on top of QuickBooks or Xero and automate the grind inside them: categorisation, reconciliation queues, chasing clients for missing receipts. Real work gets done, but the ledger underneath is the same one.
Then there’s a more ambitious group that owns its own ledger. Pilot’s AI Accountant, Digits and Puzzle all run large parts of the bookkeeping themselves, with continuous categorisation, accrual schedules, close automation and live burn and runway.
AgenticBooks sits one step further along the spectrum, and the step is about who does the work. We built the ledger to be run by agents the business chooses and controls, over MCP, with tools to act as well as to read.
There’s also a small open-source scene building ledgers that an agent runs locally. The downside is that the business takes on every bank integration, every FX and revenue recognition rule, accounting expertise and the maintenance.
| Category | Examples | Who does the work | What an AI can do to the ledger |
|---|---|---|---|
| Traditional software with AI features | QuickBooks, Xero | A person, in the vendor’s app | Suggest. A person posts. |
| AI layer on an existing ledger | Booke AI | The vendor’s automation | Work inside the vendor’s product |
| Autonomous bookkeeping | Pilot AI Accountant, Digits, Puzzle | The vendor’s own agents | Vendor agents write. Outside agents can only read. |
| Agent-native infrastructure | AgenticBooks | The business’s own agents, over MCP | Approve, reclassify, confirm transfers, attach evidence, close, with approval gates on high-impact actions and an audit trail |
| Local open-source ledger | Various | The business’s own agents, on its own machines | Anything, but the business owns the integrations and the correctness |
This year everyone shipped MCP. Read the fine print.
In April, Digits launched an MCP server that connects its ledger to Claude, ChatGPT and the tools accounting firms use. Puzzle offers MCP alongside its developer API. At first glance, it looks like the gap has closed: an outside agent can plug into their ledgers too.
Then comes the documentation. Both are read-only. Digits says access is “read-only by design, preserving ledger integrity.” Puzzle says third-party LLMs get read-only access and cannot modify accounting data, and explains that its own deterministic agents handle writes while outside models stick to analysis.
We don’t think that’s a bad decision. Nobody wants a language model posting journals into a general ledger unsupervised, and anyone who has been through an audit can picture how that conversation goes.
But it does cap what the agent can do. It can report the burn rate but it can’t approve a classification it’s confident about, confirm that a sweep from Mercury checking into Treasury is one transfer rather than income plus an expense, fix a miscoded entry, attach an invoice to the charge it belongs to, or close the month. All of that goes back to a person clicking through the vendor’s app, or waits for the vendor’s automation to get to it. The agent can watch the books. It can’t help keep them.
How we handle the agent’s actions
We take ledger integrity seriously. We just dealt with it in the design of the write tools rather than by leaving them out. Five rules do most of the work:
- Agents can’t change what happened, and the books can’t move money. A transaction’s amount, currency and date come from the bank or billing provider, and no agent-facing tool can edit them. An agent can change how a transaction is classified, never what it was. The bank connections themselves use read-only keys, so nothing an agent does in AgenticBooks can send a payment.
- Agents act through named accounting actions, not a ledger editor. The agent’s write tools are a fixed list: approve a classification, reclassify an entry, confirm or reject a suggested transfer, attach a receipt, manage the chart of accounts and counterparty rules, connect or disconnect a bank, re-import history, and close a period. Each one means one thing in accounting terms. People can post manual journal entries in the web app, where they go through the same period controls and audit trail. No agent-facing tool can post one.
- The riskiest actions wait for a human click, and the code enforces it. When an agent tries something high-impact, such as a counterparty rule that would reclassify a large batch of past transactions, or a cross-currency transfer where the two sides differ by more than a few percent, AgenticBooks emails the human for approval. The action only runs when they click, and only on the exact numbers they saw. If anything moved in between, it refuses. A rolling guard also stops an agent from splitting one large change into lots of small ones to slip under the limit. For everything else, the tool instructions tell the agent to confirm with its human before posting and to pass along any warning word for word.
- Closed months stay closed. Reclassification only works in open periods, needs a stated reason, and takes the same lock as the period close, so a relabel can’t race a close. Once a month is closed, nothing booked in it can be edited or reclassified. A transaction that arrives late is booked on the first open day with its real date kept, so statements already issued never change. The close itself refuses future months, the current month and re-closes, and it can’t be undone.
- Every decision leaves a reason. Every source event is stored as it arrived, in a log the database won’t let anyone alter, and the audit trail is append-only in the same way. Classification, reclassification, rule and chart changes all require a reason, whether a person or an agent makes them. The audit trail also checks the acting user against the organisation, so an agent can’t record its work under someone else’s name.
Put together, that means an agent can be given a job like this:
Reconcile the Mercury account through August. Confirm the obvious transfers, flag anything that looks odd, ask me about anything you’re unsure of, and get the books ready to close.
The agent queries the ledger, works through the queues, takes the actions it’s allowed to take, stops when something really is ambiguous, and comes back with a short list for a person to decide on. Give the same instruction to an agent with a read-only connection and the result is a report.
Why we need agents to write to the accounting ledger
On a comparison chart, “write access over MCP” is one row. We think it’s closer to the whole point, for a few reasons.
AI-native companies already run agents for support, operations, engineering and sales. They choose the models, write the prompts and check the output. With a read-only ledger, finance is the one area those agents can’t operate. The vendor’s agents do that instead, in the vendor’s app, on the vendor’s schedule.
It also changes where review happens. In most products, review happens in a dashboard someone else designed. With AgenticBooks, the agent gathers what needs a decision, sorted by value with the options and reasons attached, and brings it to wherever the team already works: Slack, Claude, a weekly summary. Human attention goes to the close and the handful of cases that need it.
Additionally, nearly everything an agent does in a business ends up touching money. That makes the ledger the natural place to check what the agents have been up to. It can only do that job if the same agents keep it current as they go, with their decisions logged.
AgenticBooks is built for agentic businesses
What we do that nobody else does yet is let a business’s own agents run the ledger, under rules designed for it. Underneath is a double-entry system: continuous classification, multi-currency with FX revaluation at close, transfer matching across banks and currencies, receipts attached to ledger lines, and a general-ledger export with a base-currency mirror for the accountant. Any MCP-compatible agent can work with it, with approval gates on the highest-impact actions and a reason recorded for every classification decision.
We expect the rest of the market to head this way. Read-only MCP was a reasonable first step. As more companies run on agents, the question of whether a trusted agent can act on the books will come up again, and the answer won’t be “never”. It’ll be “under what rules”. We’ve been working on those rules since day one.
FAQ
Isn’t it risky to let an agent write to the ledger?
Without guardrails, yes. In AgenticBooks, agents can’t edit a transaction’s amount, currency or date, can’t post manual journal entries, and can’t move money. High-impact actions need a human to approve them by email, pinned to the numbers they saw. Closed periods are locked, and classification decisions carry a mandatory reason in an append-only audit trail.
Which accounting products have an MCP server?
Digits and Puzzle both offer read-only MCP, so outside AI tools can query the books. AgenticBooks offers MCP with read and write tools, so outside agents can do the bookkeeping, with human approval on the highest-impact actions.
What can an agent do in AgenticBooks?
Read the income statement, bank and provider balances, a financial summary, individual transactions and the review queue, documents, the audit log and books status. Act by approving classifications, reclassifying entries, confirming or rejecting suggested transfers, attaching receipts, managing the chart of accounts and counterparty rules, connecting Mercury or Meow, re-importing history, and closing the period.
Does this mean nobody looks at the books?
No. People review what the agent has put together instead of doing data entry, high-impact actions wait for their approval, and the month-end close is designed as the point where a person signs off.
When is QuickBooks, Digits or Puzzle the better choice?
When a person or an accounting firm runs the finance inside the vendor’s app, or when payroll, deep invoicing or firm tooling is needed today. AgenticBooks is for businesses that run their operations, finance included, through agents they control.
AgenticBooks is the accounting layer for AI-native businesses — a ledger AI agents can operate over MCP, with unified multi-bank balances, automatic transfer matching, and one-command month-end close.