QuickBooks connector exposes Sales/CRM/Catalog/Payroll tools no user can authorize; 403 insufficient_scope renders as a futile "reconnect with appropriate access" instruction

## Summary

On the first-party Intuit QuickBooks connector (`ai-inc.quickbooks.intuit.com/v1/mcp`, provider tag `Claude_QB_MCP`), OAuth completes and all Accounting/report tools return live data — but **all 16 read tools in the Sales, Customer (CRM), Catalog, and Payroll families fail** with the byte-identical error:

> This connector requires additional permissions. The user needs to reconnect it with the appropriate access.

Reconnecting provably cannot fix this: there is no per-scope consent UI, and Claude clients do not perform the MCP step-up authorization flow on 403 `insufficient_scope` (anthropics/claude-code#44652), so the error directs users into a loop that cannot succeed. The failing families also align exactly with capabilities Intuit documents as **not yet available** on this connector — which suggests they are pre-GA tools exposed in `tools/list` that **no user can currently authorize**.

I reported this privately to Anthropic support **twice** (June 2 and June 10, Conversation ID **215474549208142**). The Fin AI agent agreed the evidence "strongly suggests an OAuth scope configuration issue at the connector level" and escalated at my request; there has been **no human response in 10 days**. Filing publicly so it's visibly tracked.

## Environment

- First-party Intuit QuickBooks connector in Claude (`ai-inc.quickbooks.intuit.com/v1/mcp`; responses tagged `3p_provider: Claude_QB_MCP`, `cid=claude.ai-QBApp`)
- Connected QBO account is the company's **Primary Admin** with an **active QuickBooks Payroll subscription**
- Reproduced 2026-06-02, 2026-06-10, and 2026-06-12 (full matrix below from 06-12)

## Observed facts

### 1. Full read-tool matrix (33 tools tested 2026-06-12)

| Family | Tools tested | Result |
|---|---|---|
| Company / Accounting reports | `company_info`, balance sheet, P&L, A/R aging (summary + detail), A/P aging (summary + detail), sales by customer, sales by product, product/service list | ✅ all return live data |
| Cash flow | `cash_flow_quickbooks_account` | ✅ works (one transient server error; identical retry succeeded) |
| Benchmarking | `benchmarking_quickbooks_account`, `benchmarking_against_industry` | ✅ |
| Lending | `qbo_lending_get_peer_offers` | ✅ |
| **Sales** | `get_invoices`, `get_estimates`, `get_payment_links`, `get_settings`, `get_transaction_document` | ❌ identical error ×5 |
| **CRM** | `qbo_contact_search_customer` | ❌ |
| **Catalog** | `qbo_catalog_search_products` | ❌ |
| **Payroll** | all 9 read tools (company info, employees, search employee, payslips, payslip details, pay types, deductions/contributions, last payroll run, time-off) | ❌ identical error ×9 |

All 16 failures return the byte-identical string. All are **reads** — this is not a read/write permission boundary.

### 2. Control tests rule out QBO roles and subscription tiers

- The sales-by-customer **report** returns the full customer list, while `qbo_contact_search_customer` is blocked for those same customers.
- The product/service **report** returns the full catalog, while `qbo_catalog_search_products` is blocked for those same items.
- The connected user is **Primary Admin** with **active Payroll** — yet every payroll read is refused.

No QBO role or plan can split access to the *same objects* by tool family. The gate is per-tool-family authorization at the connector/server layer. Note also that Intuit's public scope model cannot produce this split either — `com.intuit.quickbooks.accounting` covers Customer/Item/Invoice/Estimate entities — so this is not one missing public OAuth scope; it behaves like server-internal tool-family gating.

### 3. Reconnect provably cannot help

- The connect flow is a single all-or-nothing Intuit consent — no scope picker exists.
- Disconnect/reconnect and full remove + re-add were performed repeatedly between May 28 and June 12; the outcome never changes.
- Claude clients do not implement the MCP step-up authorization flow on 403 `insufficient_scope` — see anthropics/claude-code#44652 (open; predecessor anthropics/claude-code#28258 was closed as fixed but the behavior persists). The reconnect UI re-grants the same base scopes.
- The error string is Claude's **generic** rendering of MCP 403 `insufficient_scope`: the identical message and identical futile-reconnect dead end occur on the unrelated Intercom managed connector (see the 2026-05-05 comment on #44652).

### 4. The working/failing split exactly matches the documented product boundary

The [claude.com directory page for this connector](https://claude.com/connectors/intuit-quickbooks) advertises four capabilities: financial reports, industry benchmarking, business research, and transaction import. [Intuit's help article](https://quickbooks.intuit.com/learn-support/en-us/help-article/accounting-bookkeeping/use-quickbooks-connector-claude/L3YBlo6Ht_US_en_US) states the connector cannot create or edit invoices or record payments, and that "additional use cases are being developed." That boundary is precisely the working set above — suggesting the Sales/CRM/Catalog/Payroll tools are unreleased capabilities exposed in `tools/list` anyway. (Flagged as a hypothesis — only you can confirm; see Asks. Note the gated tools' own descriptions advertise invoice creation etc. with no caveat, which is how users end up here.)

### 5. The server cannot be inspected from outside

Every path on `ai-inc.quickbooks.intuit.com` — `/v1/mcp`, `/.well-known/oauth-protected-resource`, `/.well-known/oauth-authorization-server`, `/register`, even nonexistent paths — returns the same cached Akamai edge 403 for non-allowlisted clients, with no `WWW-Authenticate` header on the MCP endpoint. The scope configuration (`scopes_supported`, registration policy, step-up challenge) is verifiable only by Anthropic/Intuit. Side effect: the plugin variant of this connector, which attempts client-side OAuth from the user's machine, can never even reach metadata discovery.

### 6. Timeline

- **≤ May 28:** every tool failed with "Authentication failed" — matching #334 (start-auth skips OAuth, `isAuthless: true`, zero requests to Intuit domains).
- **By June 2:** OAuth completes and the partial pattern above appears — whatever fixed the #334 bootstrap did not make the gated families authorizable.
- **June 10 and June 12:** unchanged.

## Support history

Filed privately with Anthropic support on **June 2** with the full reproduction. Fin (AI agent) replied the same day agreeing the evidence "strongly suggests an OAuth scope configuration issue at the connector level," said it cannot view or modify connector scope configuration, and escalated to a human at my request (Conversation ID **215474549208142**). Bumped on **June 10** with fresh re-test results; received only another auto-acknowledgment and a Fin reply stating it has no access to status updates or engineering timelines. As of June 12: **two pings, zero human responses.**

## Related issues

- #334 — the earlier total-failure mode of this same connector (open, zero comments since May 21). Distinct from this report: there, OAuth never ran; here, OAuth succeeds and specific tool families 403.
- anthropics/claude-code#63632 — same error string, all tools failing on a non-Payroll QBO account (closed NOT_PLANNED as off-topic for that repo; filing here instead, per that close).
- anthropics/claude-code#44652 — missing step-up authorization on 403 `insufficient_scope` (the client-side half of this bug).
- anthropics/claude-code#59809 — QBO connector stuck in "Requested" status for Teams admins (adjacent connector-management issue).

## Asks

1. **Make the exposed tools authorizable, or stop exposing them**: implement MCP-spec step-up authorization so 403 `insufficient_scope` can actually be resolved — or filter unauthorized tool families out of `tools/list`.
2. **Fix the error copy**: "reconnect with the appropriate access" instructs an action that cannot succeed; it sends users (and their AI agents) into hours-long reconnect loops.
3. **Say which it is**: if Sales/CRM/Catalog/Payroll are pre-GA, document that on the connector page and in the tool descriptions; if they are supposed to work today, the token/scope configuration needs fixing.
4. A human response on support Conversation **215474549208142** would be appreciated.

## Appendix: minor unrelated defects noticed while testing (2026-06-12)

- `cash_flow_quickbooks_account` is flaky (transient "Something went wrong..." on first call; identical retry succeeded) and leaks an internal placeholder (`Company_US_OBI-LL1_20053912_4-12-2024`) in its `companyName` field instead of the company's actual name.
- `industry_recommendation` fails for every input — including its own documented example ("yoga studio").
- `qbo_accounting_get_sales_by_product_summary` `summary.totalSales` double-counts group subtotals (detail rows are correct and reconcile with the by-customer report).