PolyAccounts · Scenario
Books for a company operated by AI agents
A ledger built for agents to write to safely: self-serve sandbox, remote OAuth MCP, idempotency keys, row revisions, durable receipts, exact decimal reads, and administrator-revocable credentials.
Direct answer
If an agent is going to keep the books, the accounting system has to be designed for an unreliable caller: one that times out, retries, runs in parallel and sometimes misreads a record. PolyAccounts gives every write a required idempotency key with a durable receipt, so a retry returns the original result instead of posting twice. Every edit and soft delete must carry the current PostgreSQL row revision, so a stale agent cannot overwrite a newer change.
Reads return exact decimal strings, not floating point. Ledger evidence is paginated with cursors bound to the company and filters. An interrupted write is reported as uncertain and is never redispatched automatically. Administrators see recent agent activity and can revoke a credential immediately.
Start without a human in the loop
An agent can create its own synthetic sandbox company with one POST, or by calling the create_sandbox tool in the stdio connector when no credential is configured. The response includes a company, a starter chart of accounts, two months of invented activity, a seven-day agent credential and a browser sign-in so a person can watch the same books.
For a real company, an administrator approves the connection once. Directory-listed clients use the remote MCP endpoint with OAuth 2.1 (PKCE, dynamic client registration, refresh tokens). Local clients use the stdio connector with a token file. Both paths issue the same company-scoped credential and pass through the same accounting validation.
npx -y polyaccounts-mcp # then, in the client: call create_sandbox, then accounting_context
What an agent can and cannot do
Can: read context, trial balances and ledger evidence; discover record tables and their editable fields; create, update and soft-delete records; run 82 billing, payment, trust, reconciliation, period, budget, forecast, approval and operations workflows; inspect operation receipts.
Cannot: move money at a bank, send email, invite users, issue other credentials, run raw SQL, cross into another company, reverse a Stripe payment without a verified provider refund, or modify a closed period outside the period workflow. Agent credentials do not grant platform administration.
| Control | Behavior |
|---|---|
| Idempotency | Required key per write; replay returns original result with Idempotency-Replayed header |
| Concurrency | Edits require current row revision; conflict returns 409 |
| Uncertainty | Interrupted dispatch reported; reconcile before proceeding |
| Precision | Core reads return exact decimals as strings |
| Revocation | Immediate from Settings; also on admin removal, role change, password reset |
| Reads | Not metered; fair-use limits published |
Boundaries
Durable receipts give at-most-once dispatch, not a distributed transaction. Workflow amounts use application precision (generally cents) while core reads preserve exact decimals. Early access is for supervised evaluation with synthetic data. The release does not certify live customer books or statutory accounting.