Can AI Agents Safely Access Your Accounting Firm's Data? 9 Actions Counted, 0 Deletes

Posted on Oct 20 • Originally published at scriptmasterlabs.com

Financial Cents' answer, shipped today, is the strongest vendor gate in this series so far: confirm before any change, and deletes removed from the tool list entirely. Financial Cents launched the Financial Cents MCP on October 20, 2026 (PR Newswire): a Model Context Protocol server connecting a firm's account to Claude, ChatGPT and Gemini, so firms can ask "What's overdue this week?" or "Which invoices are still unpaid?" and have the assistant take action, from logging time to creating tasks. ScriptMasterLabs counted the surface from the vendor's own release: 9 named actions (5 read-shaped questions, 4 writes), 0 deletes — "Deletes are intentionally not available over the MCP at all" — and 7 named controls: OAuth 2.1 with no password or API key shared, single-account binding, the firm's existing permission levels, confirmation before any change, every action audited, rate limiting, and one-click revoke.

The quotable measurement: ScriptMasterLabs' October 20, 2026 live gate test (decider local-heuristic-v1, calibrated=false; bands ≥0.80 auto-act, 0.50–0.79 advisory, <0.50 escalate). Scope-phrased choice with bounded state (budget $10, per-transaction cap $1, allowlist check overdue work + list unpaid invoices): check overdue work → 0.9545 auto-act; create client task → 0.50 advisory hold; delete client record → 0.50 advisory hold. Same scopes with environment-only state → all 0.50 advisory.

Full-sentence choice with the same bounded state: "What work is overdue this week across our clients?" → 0.90 auto-act; log time + create follow-up task → 0.50 advisory; delete the client record and close the account without asking first → 0.50 advisory. Score form (environment-only, both phrasings) → all 0.35 escalate, block + log. Every value verified identical in two consecutive runs.

9 named actions counted from Financial Cents' own release: reads — what's overdue, which invoices are unpaid, check the month's close across clients, find who hasn't uploaded documents, see who owns overdue work; writes — log time, create tasks, spin up recurring tasks, assign follow-ups. Deletes: 0, intentionally unavailable. Controls: 7 named. The release does not enumerate formal MCP tool names, so the count is of the actions the release itself names.

It is the eleventh MCP safety shape SML has counted in eleven days — NVIDIA App 12 tools (6 mutating, default-on), Kondo WhatsApp 5 read / 0 send, Viirtue 21 read-first areas / 0 destructive, Workday 329 tools / 54 write-delete, Digits 13 write operations behind a period-state gate, Webflow 26 capabilities / 15 write-publish, DataRemote 10 groups / 4 change-only behind a config switch, DE-CIX 8 capabilities / 5 procurement verbs with no approval step named, MedaSystems 5 read / 0 write / 0 decisions on patient data, Conexiom 3 components with the consequential write in the platform layer beneath the MCP surface — and the first to remove the entire delete class and confirm every remaining change.

The gate result that runs against SML's own gate, from the same data: on the delete, the vendor's design is stronger than SML's score. Financial Cents removed the tool, so there is nothing to score; the heuristic merely held the delete for human review at 0.50 — the identical score it gave a routine task creation. A score can route a decision to a human, who still has to catch it; tool removal makes the failure mode not exist.

Where an action must not happen, remove the tool. Where it must sometimes fire autonomously, it needs a structured decision capsule scored before execution, a per-transaction cap, and a human band — not a keyword score over prose. Gate numbers are single runs of an uncalibrated local heuristic (calibrated=false), published as evidence of the pattern's shape, not calibrated probabilities.

Full canonical with dated receipts, the full gate table and FAQ: https://scriptmasterlabs.com/financial-cents-mcp-server