The LLM explains, never calculates
Every figure in an answer was computed in code and carries a provenance tag, so a number can be traced to brokerage data, a search result, or a calculation, and the model has nothing to invent.
Finn Advisor
A single-user financial assistant over read-only brokerage data, where every number comes from code and the LLM only explains it.
- Role
- Designed and built
- Where
- Independent project
- When
- Aug 2026
- Access
- Public repo
Problem
An assistant connected to a brokerage account should answer 'how is my portfolio doing, why did this fall, am I over-concentrated' from real holdings and live news. It must never trade, leak tokens, invent numbers, or follow instructions buried in web content.
01
A safety gate with no model in it
Regular-expression rules refuse prompt injection, credential requests, and questions about other people's data before any LLM or tool runs.
02
Deterministic routing
Intent is matched in code and sent to a LangGraph workflow: portfolio or research. Only questions the router cannot place go to a Google ADK agent with four sub-agents.
03
Memory, then a degradable login
Long-term memory loads with privacy levels and writes only after the user confirms. If the brokerage login has expired, the workflow takes a degraded branch instead of failing.
04
Read-only by policy
The brokerage is reached over MCP, with its tools loaded as LangChain tools. An allow-list admits 16 read-only tools; trading tools and anything unknown are blocked inside the client.
05
Numbers come from code
Allocation, concentration, and risk are computed without a model, and every section of the snapshot is tagged with where it came from: brokerage data, web search, or a deterministic calculation.
06
Web results are data, not instructions
Research questions search the web with a fallback provider, and results are fenced as untrusted external data before they reach the model.
07
Explain, log, and check the output
The LLM router falls back from NVIDIA NIM to Gemini Flash and logs every call with the reason for any fallback. The model only explains numbers it was given, and a final check withholds anything that looks like a leaked secret.
Measured
- Read-only brokerage tools, verified live
- 16
- Tests (341 unit, 2 integration)
- 343
- LLM calls in the input safety gate
- 0
- LLM providers with logged fallback
- 2
How it's verified
- Harness
- Deterministic router into LangGraph workflows with a Google ADK fallback agent, an MCP client for the brokerage, and an LLM router that falls back from NVIDIA NIM to Gemini with every call logged.
- Evals
- An offline evaluation harness (4 cases) and a red-team suite (10 cases) run through a mock evaluator; no committed scores yet.
- Guardrails
- A regex input gate before any model, an allow-list of 16 read-only brokerage tools with trading tools blocked, fenced web results, and an output screen for leaked secrets.
- Testing
- 343 tests (341 unit, 2 integration).
In depth
Safety as code, with honest limits
Injection and credential requests are blocked by rules, write tools by the MCP tool policy, and leaked secrets by an output screen.
- Buy and sell advice is limited only by the system prompt
- Web content is fenced as data, but not scanned for instructions
- The offline eval set has 4 cases and the red-team suite 10, run through a mock evaluator
Room to grow into A2A
The ADK agent calls LangGraph workflows directly in Python, behind an interface that can later become an agent-to-agent call without changing the workflows.
Decisions
- 01Route in code; use the ADK agent only as a fallback for unmatched questions.
- 02Enforce read-only access in the tool policy, not the prompt.
- 03Treat a failed brokerage login as a degraded answer, not an error.
Stack
Python · LangGraph · Google ADK · MCP (Kite) · langchain-mcp-adapters · NVIDIA NIM · Gemini Flash · SQLite · Streamlit · Docker