About
LedgerPDF is a desktop workpaper binder for tax and accounting professionals. You drop in PDFs, Excel files, scans, and photos, and it builds one ordered, bookmarked, marked-up PDF binder. It is built to be used alongside AI agents: a human and an agent can work in the same binder at the same time.
It is for preparers and reviewers who want a local tool an agent can also drive.
- One binder, one file. The binder PDF is the document. The editable session rides inside the PDF, so there is no sidecar to lose.
- Marks that export as real PDF annotations. Tick marks, stamps, shapes, and notes, verified against two independent render engines.
- Calculator tapes that show their addends. Whole-cent arithmetic, never floating point. If an input is ambiguous, the tape refuses instead of guessing.
- Spreadsheet cells become real text. A trial-balance figure from an Excel file is read exactly, not OCR’d.
- Ties, footing, and connectors. Link a figure to its supporting page, foot a column, and place clickable links between pages.
- A Review Center and send-out preflight. Open notes, source coverage, page statuses, agent-run history, and a flattened send-out copy.
Status, honestly: v0.3.1 is a public alpha. The macOS build is signed and notarized, Windows signing is next, and the source is public under GPL-3.0. I use it daily on my own engagements. I have not yet confirmed a user outside my practice.
Where it fits. LedgerTB keeps the books and exports a close package; LedgerPDF turns that package into the binder. Tax Prep Ledger decides what must tie to what; LedgerPDF renders the marks. It computes nothing about a return, and it is separate from LedgerClaw and TaxClaw.
How I built it
Twenty-two calendar days from the first commit to v0.3.1, 224 commits, one author, with Claude Code as the engineering team.
- Two runtimes, one contract. An Electron and React shell talks to a Python engine over JSON on stdio. The engine is frozen with PyInstaller and shipped inside the app.
- The MCP server is the app. A single bundled script launched from the installed binary, exposing 36 tools that drive the same model the UI drives. Live mode edits the binder open on screen over a unix socket, never TCP, with a fresh 256-bit token per launch.
- Durability first. Sources are opened read-only and SHA-256 fingerprinted. Export writes a temp file, validates it, then commits atomically.
- Orchestrated agents. A lead Claude Code session, a reading agent for context, and a fast agent for mechanical work. The hard reasoning stays in the lead.
- Local means verifiable. No accounts, no telemetry, no auto-update. Copyleft is deliberate: the local-only claim is only worth what a firm’s IT reviewer can check.