README

The ledger for AI-native money movement


  The system of record for fintech wallets, payouts, marketplaces and billing —
  with spending limits that keep AI agents in check and an audit trail you can prove.



  
  
  
  
  



  Website ·
  Docs ·
  Cloud ·
  Changelog ·
  Roadmap



  Open-source core (Apache 2.0) ·
  Managed with LedgerForge Cloud ·
  Enterprise


LedgerForge is an open-source double-entry ledger. It records wallet transfers,
payouts, billing activity, reservations and refunds in exact integer units,
backs that history with a verifiable audit chain, and enforces spending
policies on every API key, including the keys your AI agents use. Use it
through an HTTP API, a Go library or a local MCP server.

PostgreSQL stores the financial records and Redis runs queues and background
workers; search and observability services are optional. LedgerForge records
money movement. Connecting payment rails and defining your accounting model
remain application responsibilities.

 Use cases

- Wallets and stored value: a balance per customer or account, inflight
  holds that reduce spendable funds, bounded overdrafts and linked refunds.
- Payouts and disbursements: reserve funds while a payout is in flight,
  commit or void the reservation when the rail reports back, and reconcile
  against external records.
- Marketplaces: split one payment across seller, fee and platform balances
  with deterministic allocation, so the legs always sum to the total.
- Usage-based billing: record metered charges in exact units, queue or
  schedule them, and retry safely with idempotent references.
- AI agents moving money: give each agent its own API key with currency
  limits, allowlists, daily budgets and approval holds that the server
  enforces, and connect agents through the MCP server.

 Why LedgerForge

- Exact money: integer postings, explicit precision and deterministic
  splits; see the accounting guarantees.
- A verifiable ledger: read-only ledgerforge verify replays accounting
  evidence. Versioned audit chains and exportable checkpoints support
  audit verify --anchor against independently retained roots. See the
  verification guide for coverage and legacy limits.
- Agent guardrails: per-key currency and precision limits, balance and
  ledger allowlists, durable daily reservations and approval holds, enforced by
  the server rather than the client. Delegated keys inherit restrictions and
  share ancestor budgets. Bind MCP to an API key and keep independent approver
  credentials outside the agent's authority. See
  agent safety and the
  executable policy example.
- A hardened API: owner-bound key management, constrained delegation,
  authoritative revocation checks, bounded input and sanitized backend errors.
  Dedicated webhook signing secrets and destination controls protect outbound
  integrations. See security operations.
- Tested invariants: exact-amount and allocation fuzz targets, generated
  PostgreSQL operation sequences, balance conser

Top issues

Latest release

The first LedgerForge release: a double-entry ledger with exact integer money
handling, durable transaction lifecycles, read-only replay verification and a
versioned audit chain, server-enforced spending policies and approval holds for
API keys and AI agents, and a hardened HTTP API. Upgrades are supported from
fresh installs and from the previous main schema; see the upgrade notes.

 Added

- ledgerforge version and --version report the release version, commit and
  build date stamped into release binaries and container images.

- model.ParseAmount and checked exact amount conversion, raw dec