Point Your Own AI at Rexfin, Not the Other Way Around

Most teams already have an AI habit (Claude, ChatGPT, an internal agent stack) and the obvious next step is pointing it at real financial data. The obvious risk is exactly what you’d expect: an agent given raw access to a spreadsheet or a warehouse table will answer a question whether or not it actually knows the answer, and it will do it in a confident sentence that looks identical whether it’s right or invented. Rexfin’s MCP surface is built to make that specific failure structurally impossible, not just less likely.

A small toolset, on purpose

The legacy version of this kind of surface tends to sprawl: dozens of tools covering every internal workflow an agent could conceivably want. Rexfin cuts that down to roughly ten: list and fetch atoms, pull a statement, ask a cited question, run the verifier over an answer, trace a value’s provenance chain, cross-check a figure across extraction backends, and a handful of others. Nothing in that list mutates the model, runs an arbitrary query, or exposes internal telemetry: it’s a read-and-verify surface, not a back door. The reason the list stays small isn’t minimalism for its own sake: an external agent’s tool router gets measurably worse at picking the right tool as the tool list grows, and every extra tool is also attack surface. A narrow, well-described toolset is what makes an agent reliably reach for verify before it reaches for a guess.

Cite-or-refuse, carried through the protocol

The rule that governs Rexfin’s own chat applies identically here: every value that comes back through MCP carries its source document and page, or the agent gets an explicit, structured refusal instead of a number. There’s no path through this surface that lets an agent “estimate” a figure it doesn’t have evidence for, because the surface has no generative-number capability to coax in the first place: it only returns what the verifier computed or sourced. Ask an external agent connected this way for FY24 revenue and it gets the figure plus the page it came from, or it tells you plainly that the figure isn’t available, never a plausible-sounding number sitting on nothing.

Scoped to exactly what you’re allowed to see

A connection is bound to a credential scoped to specific deals, and every tool call intersects the request against that scope: a credential limited to one deal can’t read another by guessing its ID, and there’s no “list everything” tool that would let it enumerate what exists. This mirrors the same access controls that govern who sees what inside the app; connecting an external copilot doesn’t create a second, looser door into the same data.

The operator inside the app works the same way

The same discipline shows up in Rexfin’s own tool-calling chat operator: it can set inputs, request a recalculation, or ask the engine to run a scenario, but it never emits a number of its own. Every prose answer it gives carries at least one citation back to a source atom, or it refuses to answer: the same trust-chain ranking that decides what counts as citable inside the grid decides what the operator is allowed to say out loud.

Who this is for

This is for teams that already run a copilot workflow and want it to answer finance questions with something better than a hallucination risk, and for anyone who wants an in-app assistant that can drive the model without ever being trusted to invent a figure. If your current setup is “paste the numbers into ChatGPT and hope,” this replaces the pasting with a connection that can’t return an uncited number even if the agent on the other end tries to get one.

See how citation and refusal work across the rest of the product on the product tour hub, or look at the API and webhook surface this shares its access model with.