Connect your own AI assistant

What can an assistant do with it?

Read the audit, and optionally act on it. Thirteen tools are available to a firm, nine of which only read: the subscriptions found in a book, the open findings, upcoming renewals, spend by category, a comparison against the previous audit, the audit history, and one vendor in full with its notes, tags, owner, and contract dates. Firm plans add the client list and a rollup across the whole book.

The other four change ShadowLedger’s own state and need write access: something you approve on the consent screen when connecting, or grant a token by marking it writable when you mint it. They snooze a finding for 30 days, dismiss one, reopen one, and edit what a person has recorded about a vendor. That is triage and curation, the repetitive part of the work.

What can it not reach?

The decisions that change what you are billed or change a figure your own client sees. No token permits recording a savings amount against a finding, adding or removing a client, running an audit, or sharing a report, whatever scope you gave it. Ledger findings do not report seat usage.

It also cannot reach your accounting system. ShadowLedger only ever issues read and query calls to QuickBooks Online and Xero, and no tool on this connection calls either of them, so there is no path from a token to your books. And it cannot tell you who used a tool: a ledger records what was paid, not who logged in, which is a limit of the data source rather than of this connection. See shadow IT for what a ledger does and does not show.

Is this an MCP server?

Yes. It speaks the Model Context Protocol at a single endpoint, /api/mcp, and it authenticates the way the protocol expects: an OAuth sign-in for assistants like Claude and ChatGPT, or a bearer token for headless use, so MCP clients that support OAuth or bearer tokens can connect. The read tools are annotated read-only, which is what lets a host auto-approve them instead of prompting on every call. Calls are rate limited per credential rather than per account, so several connected machines do not compete for one budget.

How is access controlled and revoked?

A credential belongs to your account, and every lookup behind it is scoped to that account, so it cannot name another firm’s client and reach its book. An OAuth connection shows you exactly what it may do on the consent screen before it exists, and removing the connector inside the assistant ends its access on the next call. Tokens are named when you create them, and the list in Settings shows when each one was last used, which is how you tell whether anything still depends on one before revoking it.

Anything an assistant changes is stamped as having come from an assistant, so a firm reviewing its triage queue can always separate those decisions from its own. Treat a token as a password to your audit data: use a separate one per machine, so revoking one does not mean re-authorizing everything else.

Where does the data go once it leaves?

An assistant you connect is yours, not ours. Once it pulls data in, that data travels on the terms of whoever makes that assistant rather than on ours, which is the trade you accept by connecting one. What ShadowLedger itself sends to a model provider is a separate and narrower question, answered in full on the security page, and the privacy policy covers what is logged about each connection’s use.

How do you connect one?

In Claude: Settings, then Connectors, then Add custom connector, and paste https://www.getshadowledger.com/api/mcp. Sign in with your ShadowLedger account when the browser opens and approve what the assistant may do. ChatGPT takes the same URL as a custom connector with Developer mode on. The Settings page in the app has the same instructions next to a copy button, plus one-click setup for Cursor and VS Code, and tokens for scripts and anything that cannot sign in.

Is this the in-app assistant?

No. ShadowLedger has its own Ask your ledger chat inside the app, and this is the same audit data reachable from outside it, in whichever assistant you already work in, under a credential you issue and revoke. The audit itself does not change either way. The engine matches most vendors by rule, asks a language model only to name a descriptor the rules could not, and flags those matches for review. Every number in a report still comes from your transactions.