Connect your own AI assistant
On the Pro and Firm plans you can create a token in Settings and give it to an AI assistant you already run, so it can answer questions about a client book and work the findings queue without anyone opening the app. The token reads only, unless you deliberately mark it writable. You can revoke it at any time, and the accounting connection underneath stays read-only either way.
What can an assistant do with it?
Read the audit, and optionally act on it. Thirteen tools are available to a firm, nine of which only read: the subscriptions found in a book, the open findings, upcoming renewals, spend by category, a comparison against the previous audit, the audit history, and one vendor in full with its notes, tags, owner, and contract dates. Firm plans add the client list and a rollup across the whole book.
The other four change ShadowLedger’s own state and need a token you marked writable at the moment you created it. They snooze a finding for 30 days, dismiss one, reopen one, and edit what a person has recorded about a vendor. That is triage and curation, which is the part of the work that is genuinely repetitive.
What can it not reach?
The decisions that change what you are billed or change a figure your own client sees. No token permits recording a savings amount against a finding, adding or removing a client, running an audit, or sharing a report, whatever scope you gave it. Seat counts are readable and not editable over this connection, because they feed the recoverable figure in the report.
It also cannot reach your accounting system. ShadowLedger connects to QuickBooks Online and Xero read-only and the OAuth scopes requested do not permit writes, so there is no path from a token to your books. And it cannot tell you who used a tool: a ledger records what was paid, not who logged in, which is a limit of the data source rather than of this connection. See shadow IT for what a ledger does and does not show.
Is this an MCP server?
Yes. It speaks the Model Context Protocol at a single endpoint, /api/mcp, with the token presented as a bearer credential, so any MCP client can connect to it. The read tools are annotated read-only, which is what lets a host auto-approve them instead of prompting on every call. Calls are rate limited per token rather than per account, so several machines holding several tokens do not compete for one budget.
How is access controlled and revoked?
A token belongs to your account, and every lookup behind it is scoped to that account, so a token cannot name another firm’s client and reach its book. You name each token when you create it, and the list in Settings shows when each one was last used, which is how you tell whether anything still depends on a token before revoking it.
Anything an assistant changes is stamped as having come from an assistant, so a firm reviewing its triage queue can always separate those decisions from its own. Treat a token as a password to your audit data: use a separate one per machine, so revoking one does not mean re-authorizing everything else.
Where does the data go once it leaves?
An assistant you connect is yours, not ours. Once your token pulls data into it, that data travels on the terms of whoever makes that assistant rather than on ours, which is the trade you accept by connecting one. What ShadowLedger itself sends to a model provider is a separate and narrower question, answered in full on the security page, and the privacy policy covers what is logged about token use.
How do you connect one?
Open Settings on a Pro or Firm plan and create a token, naming it for the machine that will hold it and choosing read, or read and write. Settings shows the endpoint to pair it with. Put the two into your assistant’s MCP configuration as a URL and a bearer token, and it will list the tools it can see on that plan and scope.
Is this the in-app assistant?
No. ShadowLedger has its own Ask your ledger chat inside the app, and this is the same audit data reachable from outside it, in whichever assistant you already work in, under a credential you issue and revoke. The audit itself does not change either way. The engine matches vendors and detects findings the same deterministic way it always has, and every number in a report still comes from your transactions.