Wave Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Wave Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Wave accounting — 6 tools, 52 operations covering the full Wave GraphQL API.
Built with FastMCP and httpx. Mirrors the architecture of quickbooks-mcp.
# Install dependencies
uv sync
# Configure credentials
cp .env.example .env
# Edit .env — add your WAVE_ACCESS_TOKEN from Wave > Settings > API Applications
# Discover your business ID
uv run python auth_flow.py
# Run (STDIO for Claude Desktop / MCP clients)
uv run python server.py
# Run (SSE on port 3076)
uv run python server.py sse| Variable | Description |
|---|---|
WAVE_ACCESS_TOKEN | Full Access token from Wave app settings |
WAVE_BUSINESS_ID | Set automatically by auth_flow.py, or manually |
account — Chart of Accounts| Operation | Description |
|---|---|
list | List accounts with optional type/subtype filters, pagination |
get | Get account by ID |
create | Create account (name, subtype, currency, description) |
update | Update account fields |
archive | Archive an account |
search | Client-side name search |
party — Customers & Vendors| Operation | Customer | Vendor |
|---|---|---|
list | Yes | Yes |
get | Yes | Yes |
create | Yes | Read-only |
update | Yes | Read-only |
delete | Yes | Read-only |
search | Yes | Yes |
transaction — Invoices & Money TransactionsInvoice operations: list, get, create, update, delete, clone, send, approve, mark_sent, create_payment, search
Money transaction operations: create, bulk_create (BETA)
item — Products & Serviceslist, get, create, update, archive, search
reference — Lookup Data & Settingslist_businesses, get_business, get_user, list_currencies, list_countries, list_account_types, list_account_subtypes, list_sales_taxes, get_sales_tax, create_sales_tax, update_sales_tax, archive_sales_tax, list_estimates, get_estimate
report — Synthesized Summaries| Operation | Description |
|---|---|
business_summary | Business info + accounts grouped by type with counts |
account_balances | All accounts with name, type, balance, balanceInBusinessCurrency |
customer_balances | All customers with outstanding and overdue amounts |
{
"mcpServers": {
"wave": {
"command": "uv",
"args": ["run", "--directory", "/path/to/wave-mcp", "python", "server.py"]
}
}
}{
"mcpServers": {
"wave": {
"url": "http://localhost:3076/sse"
}
}
}| Wave | QuickBooks | |
|---|---|---|
| API | GraphQL | REST |
| Auth | Static Bearer token | OAuth 2.0 + token refresh |
| IDs | Base64 strings | Integers |
| Pagination | Page-based (page/pageSize) | Offset-based (start_position) |
| Search | Client-side name filtering | Server-side WHERE queries |
| Vendors | Read-only | Full CRUD |
| Reports | Synthesized from account data | Native report API |
| Money Transactions | Create-only (BETA) | N/A |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.