Headless · MCP-native · self-hostable # The ledger of record your agents may write to — and your auditors can verify. Ledgerbook AI is the headless, MCP-native accounting data layer: one immutable, bitemporal book of record for every system you run — deployed in your own infrastructure, correctable only by provable, attributable entries. - chain-hashed by default - verify offline - air-gap installable - fiat, exact-decimal money Phase legend: ✓ PH-1 shipped now · ◇ Roadmap arrives with PH-2. Labels are always present — colour is never the only signal. ## Proof primitives OCEL 2.1 audit-export format, schema-validated in CI · FR-905 T0/T1 materiality tiers evaluated server-side · FR-217 ISO-4217 fiat only; integer minor units, no floats anywhere · FR-107 0 models in the posting path — agents interact via MCP · NG-4 ## The intelligence layer is arriving faster than the data layer can support it. Three conditions every finance stack shares, and no closed application fixes from the inside. ### Truth is fragmented Balances live across ERPs, banks, billers and spreadsheets. Each system answers a different question in a different vocabulary, and the consolidation sink is a spreadsheet. ### Provisional numbers have nowhere to live Teams either post early or report late. Either way the evidence of what was believed, and when, is destroyed before anyone asks. ### Agent writes are ungoverned Agents are being handed write access with no per-action provenance, no materiality gate and no content-bound approval. That is a control failure waiting for an audit. ## One record you can prove. Writes you can govern. A ledger you can own. ✓ PH-1 ### One record you can prove Every Final entry is chain-hashed, and the chain is on by default. Corrections are typed reversing, adjusting or restating entries — never edits. Every read answers as-of: the balance at a date, and the balance as we believed at a past instant. ◐ PH-1 · T0/T1 ### Writes you can govern Agents propose; they cannot approve, finalize or correct — enforced at the credential, not the prompt. Approvals are content-hash-bound, and any edit voids a pending approval. Every mutation is a provenanced event. ✓ PH-1 ### A ledger you can own Self-hosted and air-gapped is a first-class deployment: one process on a VM or a bare-metal HA cluster, an offline bundle with zero egress. No proprietary formats — OCEL 2.1 and open interfaces. Planning consumption ◇ Roadmap arrives in PH-2. ## One object, one identity — never an edit Provisional and Final are the public lifecycle terms. Corrections are new, typed entries; the original stays exactly where it was. - **Provisional** T0 · entry.created Every material edit appends an immutable revision — actor, timestamp, content hash — to the same entry object. Nothing is overwritten. - **Final** one-way · entry.finalized Finalization seals that same object: postings become immutable, the entry id never changes, and the chain hash is on by default. - **Correction** entry.reversed · entry.corrected Later economic changes arrive as typed reversing, adjusting or restating entries, linked to the original. The mistake and the fix both stay visible. - **Period states & T2/T3 tiers** ◇ Roadmap Period states, close gates and the higher approval tiers are ledger-native by design and arrive with PH-2. ## Read the ledger the way your agents will MCP is a first-class surface with the same semantics and error taxonomy as HTTP — and it works air-gapped with your own local model. Balances come back with their chain position attached. `# JSON-RPC 2.0 tool call — effective time and knowledge time on every read → tools/call get_balance { "ledger": "grp-eu", "book": "group_ifrs", "scenario": "actual", "account": "1000", "as_of": "2026-08-31", # effective time "as_believed": "2026-09-19T09:41:07Z" # knowledge time } ← 200 { "balance_minor": 18425000, "currency": "EUR", "status": "final", "ledger_seq": 841223 }` [Verify a chain yourself](/immutable-ledger#verify) ## Pick your entry point Six ways into the same ledger. Each one starts from the job, not the feature list. ### Embed a real ledger — per tenant, without becoming an accounting company Invariants below you: double-entry, immutability and governance as an API and an MCP server. Per-tenant isolation, validate-before-commit, and test-class credentials that can never write to production. Per-tenant isolation FR-126 · validate-before-commit FR-116 · test credentials FR-807 · PH-1 ### Zero-day truth without weakening the audit trail Provisional numbers today, provable numbers forever. One verifiable book of record across the estate, with as-of answers, typed corrections and a data-quality envelope on every disclosure. Provisional bridge FR-230/232 · data-quality envelope FR-230 · PH-1 ### Your agents propose. Your policy approves. The chain proves it. Read and propose against one ledger with scenario and status filters; never posting rights, always attribution. Proposals run the materiality gate server-side, and every call appends a provenance event. Proposal-only credentials FR-220 · hash-bound approvals FR-215 · PH-1; full MCP tool surface Roadmap ### Plan on the same ledger as actuals ◇ Roadmap Give your planning module one real ledger: scenario-tagged postings and as-of reads for actual, provisional and planned — no ETL, no copied actuals. Scenario registry and filters are consumable today; delta inheritance and variance runs arrive in PH-2. Scenario registry FR-301/304 · filters FR-342 · PH-1; delta ops FR-310–334 Roadmap Two more families to walk: - [Reconciliation by relationship — billing, terminals, channels and bank: one verified number](/reconciliation) - [FP&A on one ledger — plan against numbers you can verify](/fp-and-a) ## Comparisons, on the record Verifiable facts only. Every table is dated, every claim links its source, and “where they win” is mandatory — because an honest table is the only one worth citing. | Comparison | Axis | Status | Page | |---|---|---|---| | Ledgerbook vs Formance | Hash-chained bi-temporal log, MIT-licensed open-source core, self-host proportions | 2026-09-19 | [Compare →](/compare/formance) | | Ledgerbook vs Blnk | OSS Go fintech ledger; chain off by default, balances mutate in place | 2026-09-19 | [Compare →](/compare/blnk) | | Build vs buy | What the free option costs when audit evidence is the requirement | in preparation | — | [All comparisons →](/compare) ## What Ledgerbook is not - Not an ERP, and not a replacement for one — it is the ledger beneath them (NG-2). - No UI, no close workflows, no AP/AR: your application renders it; the ledger proves it (NG-1). - No money movement — payment systems are ingestion sources (NG-3). - No model in the core; agents reach it over MCP (NG-4). Fiat ISO-4217 money only (FR-107). ## Get early access The design-partner programme is open. Named partners only — we publish no placeholder logos. Design-partner programme open — consented names appear here at launch. Pre-launch, this wall stays empty by policy: no invented logos, no implied endorsements.