Skip to content
PreviewThe Windows download and the public source are in preparation. Request early access.
Analytical Ledger
9200Your agent

Your agent in your pocket

Ask your agent about cash, the close or a bill from your phone. Hosted is connect-once; a local install needs a tunnel.

Preview6 min readChecked October 26, 2026

Preview, with one unverified step

Phone access is Preview (analytical-ledger#365). Ledger's own end-to-end flow on the iOS and Android custom-connector screens, and every plan's rollout, have not been verified. If the connector does not appear on your phone, use the web client. Enabling a tunnel cannot add a mobile feature your plan does not have.

How it reaches your phone

There is no Analytical Ledger phone app. Your agent's own app is the phone app. You connect Ledger to Claude or ChatGPT once on the web, and the same account carries that connection to the mobile app.

The connection runs from the vendor's cloud to your instance's /api/mcp over HTTPS. That is why the instance must be reachable from the internet, and why a local install needs a tunnel first.

Posting still happens in Ledger, after a person reviews the draft.

Hosted: connect once

A hosted instance is already on HTTPS, so there is nothing to publish.

  1. Sign in to your instance as an owner and open Settings → Agents. Connect the card for your client, starting with Read.
  2. On the web, add Ledger as a custom connector and complete owner consent. Follow the Claude or ChatGPT steps in Connect your agent.
  3. On your phone, sign in to the same account or workspace.
  4. For Claude, enable the web connector in the mobile conversation's tools menu. For ChatGPT, select the installed Ledger plugin in mobile Chat or Work when your account offers it. OpenAI documents mobile support for plugins other than desktop-only ones.
  5. Ask for the current context first, then ask your question.

The hosted instance has to stay online, which is the operator's job. A managed hosted instance describes what you get.

Local install: publish it first

The easiest durable option is a hosted instance. To keep the ledger on your PC, an HTTPS tunnel can forward cloud clients to its loopback listener.

A tunnel is not owner authentication

A tunnel publishes a network entry point to your financial application. Keep AUTH_ENABLED=1, limit owner accounts, grant the fewest scopes and entities you can, and revoke connections you no longer use. Never publish the database port, debug routes, file storage or an unauthenticated development server.

Before you connect any cloud client:

  1. Confirm the local app requires sign-in and that its listener stays on loopback.
  2. Start the HTTPS tunnel with one of the options below and note its public origin.
  3. Set the running app's AUTH_URL to that public HTTPS origin and restart it. Keep LEDGER_DEPLOYMENT=local and authentication on. If you use Google or Microsoft sign-in, register the new origin's /api/auth/callback/google or /api/auth/callback/microsoft-entra-id URL with that provider.
  4. Use the same origin for browser sign-in, the issuer, the metadata and /api/mcp. An instance has one canonical issuer, so do not leave AUTH_URL on loopback while advertising a tunnel URL.
  5. Reconnect. Tokens issued for the old origin stop working, so disconnect, reconnect and authorize again.

A local PC must stay powered on, awake and connected to its tunnel for the connector to work.

Tailscale Funnel

Install and sign in to Tailscale on the PC, and enable MagicDNS, HTTPS and Funnel in your tailnet policy as Tailscale's Funnel guide describes. For an app on port 3000:

PowerShell
tailscale funnel 3000

Use the printed *.ts.net HTTPS origin in the steps above.

Funnel is reachable by the public internet, including clients outside your tailnet. It is different from private Tailscale Serve. Serve can suit browsing from your phone over your tailnet, but a cloud connector cannot reach a tailnet-only service. Stop Funnel when you no longer need it.

Cloudflare Tunnel

For regular use, create a named tunnel with a hostname on your own domain, following Cloudflare's setup guide. Route that hostname to http://127.0.0.1:3000 and use its HTTPS origin in the steps above. Keep tunnel credentials in your secret store, never in chat or source control.

For a one-off test only, with cloudflared installed:

PowerShell
cloudflared tunnel --url http://127.0.0.1:3000
Quick Tunnel caveats

The generated hostname changes on every restart, so each restart needs a new AUTH_URL and a new authorization. Quick Tunnels have no uptime guarantee and no SSE support. This server answers in JSON and needs no SSE stream, but client interoperability still needs testing. A Cloudflare Access or email interstitial can block the non-browser MCP back channel, so do not add one on the assumption that cloud clients can sign in through it.

Check it from outside

Test from a network that is not your home network, before you trust the connection.

  • Sign-in is required to reach the app.
  • The metadata at /.well-known/oauth-authorization-server advertises only the public origin.
  • An unauthenticated MCP call returns 401.

Then connect the client with Read access first, and add draft access only if you need it.

No tunnel was created and no live client round trip was run when this path was written, so treat the first connection as a test.

Your agent in your pocket | Analytical Ledger