FINALTab / Loading
Route state is being checked before the page appears.
Safety stateSettlement and proof state stay hidden until the request resolves.
Developers / MCP v2.0
FINALTab exposes deterministic money math and a production user-wallet settlement path. Models propose; integer arithmetic reconciles; wallets approve; KeeperHub executes; an independent RPC proves the result. The server never holds arbitrary users' keys.
01 / Execute
Nine scoped tools. Read and prepare operations remain separate from the one value-moving submission tool.
Streamable HTTP / authenticated
https://finaltab.vercel.app/api/mcp
Allocate
Reconcile every receipt line to the cent.
Freeze V2
Bind chain, contract, token, ledger, every debit, and every payout.
Wallet-sign
Each debtor signs USDC pull + FINALTab full-plan consent.
Simulate
KeeperHub proves the exact call will not revert.
Human approve
A reviewed EIP-191 artifact binds principal, plan, ID, and expiry.
Submit
Journal first; new work broadcasts once. Accepted retries only replay the durable result.
Prove
KeeperHub receipt + independent RPC + exact V2 plan binding, or UNPROVEN.
Production manifest
split_equalCent-perfect equal split with deterministic largest remainder.
tabs:readsplit_weightedCent-perfect weighted split with stable tie-breaking.
tabs:readnet_debtsCollapse an arbitrary debt graph into at most n−1 transfers.
tabs:readallocate_receiptAllocate caller-supplied items, tax, service, and tip across arbitrary participants.
settlements:prepareprepare_receipt_settlementFreeze the V2 plan and return both typed-data payloads each debtor signs in their own wallet.
settlements:preparesimulate_signed_settlementValidate the externally signed V2 payload and simulate the exact KeeperHub call. No broadcast.
settlements:preparecreate_broadcast_approval_challengeCreate a short-lived EIP-191 approval message bound to the principal and exact plan; retries are valid until expiry.
settlements:preparesubmit_signed_settlementJournal new work before one idempotent KeeperHub call; accepted retries skip simulation and execution.
settlements:submitsettlement_statusCombine KeeperHub proof with an independent Base Sepolia receipt and exact V2 settlementId + ledgerHash check.
settlements:read02 / Authorize
Identity, intent, and execution are separate proofs. A boolean cannot stand in for consent.
Production requests need a Supabase session/JWT or a scoped bearer token. A same-origin product session may submit only with the additional exact-plan debtor-wallet ceremony; bearer clients always need an explicit settlements:submit scope. Static tokens are compared by SHA-256 digest; plaintext tokens are never stored in server configuration. JSON-RPC batches must satisfy every scope they invoke.
confirm: true is not accepted. A value-moving call needs every debtor's two V2 signatures and a 60–900 second EIP-191 artifact signed after human review. It binds the authenticated principal, contract, ledger, plan, unique approval ID, and expiry. The artifact may be retried until expiry; deterministic KeeperHub idempotency and V2 settlement state prevent duplicate settlement.
Safe local token bootstrap
pnpm mcp:bootstrap-token
The script writes the raw ft_ token only to the gitignored proof-output/finaltab-mcp-token.local.json. stdout contains only its SHA-256 digest and config metadata. The default token cannot broadcast; add -- --allow-settlement-submit only for an MCP client that needs the value-moving tool.
03 / Connect
Use the same authenticated endpoint from Codex, ChatGPT, Claude Desktop, or raw JSON-RPC.
Codex + ChatGPT desktop / ~/.codex/config.toml
Set FINALTAB_MCP_TOKEN in the environment that launches the client. ChatGPT desktop, Codex CLI, and the Codex IDE extension share this configuration.
[mcp_servers.finaltab] url = "https://finaltab.vercel.app/api/mcp" bearer_token_env_var = "FINALTAB_MCP_TOKEN" required = true tool_timeout_sec = 60 enabled_tools = [ "split_equal", "split_weighted", "net_debts", "allocate_receipt", "prepare_receipt_settlement", "simulate_signed_settlement", "create_broadcast_approval_challenge", "submit_signed_settlement", "settlement_status" ] default_tools_approval_mode = "writes" [mcp_servers.finaltab.tools.submit_signed_settlement] approval_mode = "prompt"OpenAI MCP configuration reference ↗
ChatGPT web / plugin developer mode
ChatGPT web does not read local Codex configuration. In a workspace that permits developer plugins, open Plugins, select +, and connect the HTTPS endpoint above. Review the discovered tools and keep write actions approval-gated. Workspace policy and authentication support determine availability.
Claude Desktop / claude_desktop_config.json
This uses the open-source mcp-remote bridge. The header form below avoids the Windows argument-space issue documented by that project.
{
"mcpServers": {
"finaltab": {
"command": "npx",
"args": [
"-y", "mcp-remote",
"https://finaltab.vercel.app/api/mcp",
"--header", "Authorization:${FINALTAB_AUTH_HEADER}"
],
"env": {
"FINALTAB_AUTH_HEADER": "Bearer <your ft_ token>"
}
}
}
}Raw JSON-RPC / curl
curl -N https://finaltab.vercel.app/api/mcp \
-H "Authorization: Bearer ${FINALTAB_MCP_TOKEN}" \
-H "Accept: application/json, text/event-stream" \
-H "Content-Type: application/json" \
--data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"split_equal","arguments":{"total":"54.01","people":["alex","blair","casey"]}}}'Expected shares: 18.01, 18.00, 18.00. The sum remains exactly 54.01.
04 / Integrate
Bounded JSON endpoints share the same fail-closed provider and settlement boundaries.
POST /api/vision/extractReceipt image → structured lines; authenticated, size-bounded, Zod-validated, arithmetic-checked.
POST /api/vision/allocateNatural-language proposal → deterministic reconciliation. The model never decides the final cents.
POST /api/voice/tokenSupabase user session/JWT only; receipts:write, atomic 180-second reservation, 8/min, 1-user/4-project concurrency.
POST /api/voice/speakSupabase user session/JWT only; tabs:read, atomic 1-600-character reservation, 20/min, 2,048-byte body cap.
POST /api/settle/simulateServer-side KeeperHub simulation of a caller-signed V2 payload.
POST /api/settle/approvalCreate the principal + exact-plan EIP-191 challenge a debtor wallet must sign.
POST /api/settle/executeUse the shared durable journal; new work simulates and submits once, while accepted retries never execute again.
GET /api/settle/status/:idFail-closed status with KeeperHub and independent Base Sepolia verification.
POST /api/mcpAuthenticated MCP Streamable HTTP endpoint (JSON-RPC over HTTPS).
Provider secrets stay server-side. Missing providers and missing V2 configuration fail closed; they never synthesize success.
05 / Voice
The shipped boundary is not a claim that either paid provider is enabled in production.
When AssemblyAI is configured on the server, FINALTab mints a short-lived redemption credential and returns constrained EU streaming settings for at most 180 seconds of transcription. The permanent provider key never enters the browser, OpenAPI response, or repository.
When ElevenLabs is configured on the server, FINALTab returns a short uncached MP3 confirmation that the current browser client buffers before playback. This interactive readback is distinct from the product-video narration: the prerecorded video voiceover uses ElevenLabs only, not AssemblyAI.
06 / Verify
Success requires KeeperHub state, an independent Base Sepolia receipt, and exact V2 plan hashes.
Open a real KeeperHub execution ID together with its frozen settlementId and ledgerHash in the Settlement Capsule. FINALTab does not render a prewritten success state: it fetches KeeperHub, re-fetches Base Sepolia independently, and requires the successful V2 SettlementExecuted event from the configured contract with both indexed plan hashes matching.