LedgerJob

• One list of 66 tools backs both the in-app chat and the MCP server. A new tool ships to both surfaces in the same deploy, with no duplicated code.
• Custom agent loop on the OpenAI Responses API, capped at 8 iterations per turn, with tool output truncated at 6,000 characters so a large listing can't blow up the context.
• Irreversible actions (sending email or SMS, spending money with third parties, deleting data) never run inside the loop. The agent creates a pending action, the UI shows a card, and only the user's click executes it. The outcome goes back into the history so the model can't claim something happened when it didn't. Over MCP, these tools carry an `IRREVERSIBLE` prefix plus `destructiveHint`/`readOnlyHint` annotations.
• Identity comes from the API key, never from the model. Keys are stored only as SHA-256 hashes and carry the tenant, user and role. The MCP server acts as that user, with the same permissions, rate limiting and plan checks.
• Business rules live in the service layer, not in routes, since the agent and MCP skip the HTTP validators. A real bug (the assistant could book a 6 pm to 5 pm appointment) moved the rule into the service, with a test.
• Built with Claude Code; I designed the backend, the agent and the MCP server.

• 66 agent tools, all also exposed over MCP; 16 require human confirmation.
• Backend with 46 domain modules and 87 Prisma models.
• 59 backend test files (Vitest) with 347 declared test cases.
• Integrates Stripe, QuickBooks Online, Twilio, Google Calendar, EagleView, Hover and CompanyCam.

Shows I can let an AI agent act on a real business's data with hard guardrails: human confirmation for anything irreversible and permissions inherited from the user.