Ledgerly
Open the dashboard

SERV Hackathon · Robinhood Mainnet & MCP

The model proposes.
Code decides.

Ledgerly is a treasury agent on Robinhood Chain. One set of rules — spend caps, an allowlist, a human approval line — governs every way it moves money: buying, rebalancing, paying a freelancer, paying a bill. The model explains the decision. It never makes it.

Who it is for: small crypto teams that pay contributors and recurring bills onchain and want the treasury working, and individual investors who want disciplined DCA and rebalancing.

See how it decides
Every action ends one of three waysReal money
  1. 1
    Allowed

    Inside the per-transaction cap, the daily cap and the approval line. It is sent to Robinhood Chain and the ledger keeps the transaction hash.

    Allowed
  2. 2
    Held

    Above the approval line. It waits for you, and it is checked against the caps again when you approve.

    Held
  3. 3
    Denied

    Over a cap, or paid to an address that was never registered as a payee. Nothing is sent.

    Denied

What it does

Four jobs, one guarded path

Four different reasons to move money. Every one of them is just a request that has to clear the same gate below: the same caps, the same allowlist, the same approval line.

  1. 01

    Dollar-cost averaging

    Recurring buys of Robinhood stock tokens. SERV Reasoning reads the day's price range and decides whether to buy, skip, or scale the amount between half and one and a half times.

  2. 02

    Rebalancing

    Set target weights. Ledgerly sells what has grown too large and buys what has fallen behind, once an asset drifts past your threshold. The sizing is arithmetic, not a model's guess.

  3. 03

    Payroll

    Pay freelancers per milestone in USDG, only to addresses you registered first.

  4. 04

    Bills

    Pay recurring invoices the same way. Nothing goes out to a payee that is not on your list.

Terminal isn't a fifth job. It only reads — quotes, whether a pool exists, SERV's summary — so it never touches the gate below. Nothing there can move money.

How it decides

The model never touches the money

SERV Reasoning helps size and explain. The gate in the middle is ordinary code with fixed rules, so a confused or manipulated model still cannot overspend.

SERV Reasoning

Sizes DCA buys and writes the plain-English reason for each action. It advises; it does not approve.

  1. 1 · Request

    A job asks to act

    DCA, rebalance, payroll or a bill proposes a buy, a sell or a payment.

  2. 2 · Guardrails

    Plain code decides

    Spend caps, the payee allowlist and the approval threshold. The result is allow, hold for you, or deny.

  3. 3 · Execute

    Onchain

    Uniswap v3 swaps and USDG payments on Robinhood Chain mainnet, real funds only.

  4. 4 · Ledger

    Written down

    Every decision is kept with its reasoning, whether it ran, was held, or was refused.

Every path an action can take
How an action moves through Ledgerly A job asks to act and reaches the guardrails. Allowed actions are sent onchain. Denied actions are logged and nothing is sent. Held actions wait for you. If you approve, the caps are checked again and the action is sent. If you reject it is logged, and if nobody answers in 24 hours it expires and cannot be revived. Every branch is written to the ledger. allow hold deny approve reject no answer in 24 h A job asks buy, sell or pay SERV Reasoning sizes and explains Guardrails plain code Sent onchain Uniswap v3 ยท USDG Held for you waits in the dashboard You decide Caps re-checked then it runs Logged, nothing sent the refusal is recorded too Expired after 24 h cannot be revived Every branch is written to the ledger with the rule that decided it and the model's explanation.
Allowed Held Denied

Rules

What the model cannot argue with

These are the defaults, and they ship at their tightest. Loosening them is a deliberate change in configuration.

Per-transaction cap
$10
Daily cap
$25
Human approval above
$1
Approvals expire after
24 h
Payees
Allowlist only
New payee holds for
24 h
Actions a day before a hold
10
Slippage limit
0.5%

Trading only switches on with two separate settings (mainnet and an explicit yes), so a typo cannot start spending. When either is missing Ledgerly refuses to trade instead of pretending. Approved actions are checked against the caps again at the moment of approval. A newly added payee cannot be paid without approval for its first day, and a run of many small payments holds once the daily count is reached, so neither can slip under the caps.

Held actions can be approved two ways: the agent's own wallet sends them within your limits, or you connect a browser wallet and sign them yourself. The server checks that what your wallet sent matches what was prepared before it records anything.

Keys and limits

Who holds the keys, and the most that can go wrong

The first question about any money agent is who holds the private key. Ledgerly supports three answers, and you choose.

Self-hosted

You run it and hold everything. We never touch a key. Free, open source, and the most work.

Agent wallet, small float

The agent has its own wallet, funded to a small float. Your treasury stays in your own wallet. This is how the hosted dashboard runs.

Sign it yourself

The agent never has a key. Every action is prepared, and your own wallet signs it. Accounts work this way, with no server-side key at all.

The most it can lose, stated plainly. Through Ledgerly, the most it can move in a day is the daily cap, and never more than the wallet holds. If the agent wallet's key itself were stolen, the caps would not help, because a thief would not go through Ledgerly. So the loss is bounded by what the wallet holds. That is why it is funded to a float and not the treasury.

Before a trade

  • Every swap carries a minimum output. The default slippage limit is 0.5%, and a fill worse than that reverts instead of executing
  • A quote more than 3% away from Robinhood's own price is rejected as a broken pool
  • No pool with a sane quote means nothing is sent. Halted assets are skipped

Around approval

  • A held action is measured against the caps again at the moment it is approved
  • Held actions expire after 24 hours, and an expired one cannot be revived, only proposed again
  • A prepared action can be used once, and a signed transaction must match what was prepared and come from the connected wallet

Built on SERV Reasoning

Where it does real work

Multipath

Keeps the model's reply in the strict format the DCA logic parses, so a sizing decision is never a paragraph of prose.

Prompt Guard

Payee names and memos are typed by people and end up in prompts. Prompt Guard screens them first.

Shadow Agent

Validates each DCA decision and regenerates weak replies. If reasoning is unavailable, a run falls back to a plain scheduled buy, still behind the guardrails.

Live

Running on Robinhood Chain mainnet

Onchain

  • Swaps go through Uniswap v3 on Robinhood Chain (chain 4663), quoted onchain before every trade
  • Payments and cash are USDG, and tokenized stocks are bought and held in your own wallet
  • Every transaction links to the block explorer from the ledger
  • Connected wallets sign for themselves, and the server checks that what was sent matches what was prepared before it records anything

Reasoning

  • SERV Reasoning with Multipath, Prompt Guard and Shadow Agent decides each DCA run and explains every action
  • Plain code enforces spend caps, the payee allowlist and human approval, so the model can never move money on its own
  • Robinhood MCP is read-only

Run it

Run your own

Host your own copy on Robinhood Chain mainnet. Start with a small amount.

git clone https://github.com/firmino0/Ledgerly
cd Ledgerly
npm install
cp .env.example .env    # add your SERV_API_KEY, then LIVE_MAINNET=yes
npm run dashboard       # then open http://localhost:3000/app
View the code on GitHub