Your AI can read the fund — not touch it.
The CFO question of the moment isn't "can AI answer questions about our numbers?" — it's "what happens the day it does something?" This demo wires an assistant to the (fictional) boutique fund from the daily-NAV demo through a read-only MCP server: seven tools that can answer any question about NAV, positions, P&L and reconciliation — and zero tools that can write, book, mark, send or execute. Ask it for the month's P&L, then tell it to book a trade — and watch the refusal happen at the wire, not in the prompt.
Honest-AI note. No live model call is made from this page. The assistant's replies are pre-scripted templates filled with live numbers computed in your browser from the synthetic book; the MCP panel shows the real JSON-RPC frames such a client and server exchange. In production, Claude issues these tool calls itself — the guardrail works identically, because it lives in the server, not in the model's good manners.
Pick a question. The ✋ ones are the point.
Seven tools. All reads. That's the whole server.
Least privilege, applied to AI: the assistant gets the narrowest surface that answers the question. Security isn't a system prompt asking the model to behave — the write path does not exist on this server. Watch a tool light up when it's called; watch the dashed row flash when the assistant is asked for a verb it doesn't hold.
01Refusal at the wire, not in the prompt
A model can be sweet-talked; a server that never implemented book_trade cannot.
JSON-RPC −32601 is not a policy — it's physics. The same pattern holds for any
system of record you let AI near.
02Reads are where the value is anyway
Every question here — NAV, drivers, weights, recon — is answered in seconds, from the governed number, not from a copy-paste into a chat window. You keep one source of truth and give AI a keyhole, not keys.
03The one operational tool only plans
plan_rerun drafts the runbook for fixing a bad day — and stops there.
The AI proposes; a human at the terminal disposes. Judgment stays where the accountability
is: with the operator who signs the NAV.
Plain-language key (MCP, JSON-RPC, −32601, NAV, recon)
- MCP (Model Context Protocol)
- An open standard for connecting AI assistants to data and tools — the "USB port" between a model and your systems.
- JSON-RPC
- The message format MCP speaks: each tool call is a small JSON request, each answer a JSON response.
- −32601
- The standard JSON-RPC error for "that method does not exist here" — the sound of a write being refused by design.
- NAV
- Net asset value — what the fund is worth; divided by units in issue, what one unit is worth.
- Recon
- Reconciliation — proving the fund's book matches the broker's records before any number is released.