JComit

Eveything what no one can do

Comment

Inspiration

AI is good at making sense of spending. But using it usually means uploading a bank statement, with your name and card number on every line, to someone else's server. Most people won't do that, and they are right not to. We wanted help from a strong model without handing over who you are.

What it does

JComit reads your bank statements and receipts on your own machine. It hides your name, account number and card number, and only then asks NVIDIA Nemotron for help. It does five things:

  • Sorts spending into categories. When a shop name tells Nemotron nothing, it looks the shop up on the web with Tavily and asks again.
  • Finds subscriptions and strange charges. On our demo statement it finds 4 subscriptions ($69.47 a month) and 3 alerts: a $1,899 purchase, a double Amazon charge and a first-time hotel abroad.
  • Writes a monthly review.
  • Remembers your corrections, even after a restart.
  • Logs every action, allowed or blocked, with the reason.

You can run it live in the browser on the sample statement or on your own CSV.

How we built it

  1. Simple rules and your saved corrections sort most transactions. On the demo, that covers 128 of 145.
  2. For the shops the rules don't know, our redaction code replaces names, accounts, cards, emails and phones with labels like [NAME_1].
  3. A leak guard checks the result and refuses to send anything that still holds the account holder's details.
  4. Nemotron 3 Super, served by Nebius Token Factory, sorts the remaining 12 shops in one request. It also writes the monthly review from category totals only.
  5. If Nemotron answers "Other", the agent searches the web for the redacted shop name with Tavily. It runs the search and the result through the leak guard, and asks Nemotron again with the snippets. A name that still holds a label is never searched.

The agent runs inside an NVIDIA OpenShell sandbox, installed with NemoClaw. The policy lets it reach Token Factory and Tavily search and nothing else. Code is read-only, and writes go to one folder. Both API keys stay outside the sandbox. Each skill declares the network access it needs, and the policy is generated from those declarations. The client uses only the Python standard library, because pip is blocked inside the sandbox. The page is built with Streamlit, and corrections are stored in SQLite.

Built with: NVIDIA Nemotron 3 Super, Nebius Token Factory, Nebius AI Cloud, Tavily, NVIDIA OpenShell, NemoClaw, Python, SQLite and Streamlit.

Challenges we ran into

  • No systemd in Codespaces. NemoClaw's setup needs systemd to run OpenShell's gateway, and GitHub Codespaces doesn't have it. We started the gateway ourselves and used OpenShell directly.
  • Waiting for an account. Token Factory approval took about a day. We built against NVIDIA's free endpoint in the meantime.
  • A model that thought out loud. On Token Factory, Nemotron 3.5 Lightning put its whole thinking process inside the answer field and broke our parser. We switched to Super.
  • Models we couldn't call. On the free tier, /v1/models lists models that fail with "Function not found for account". It cost us about an hour.
  • Finding every private detail. Names with accents, account numbers with spaces or dashes, and look-alikes such as AMC THEATRES 4421 all needed their own handling. It took four rounds of trying to break our own redaction code.
  • Web search can be wrong, and it is another place data could leak. Searching a made-up shop matched an unrelated consultancy, so we let Nemotron keep "Other" instead of guessing. Search queries pass through redaction and the leak guard, and a name with a label is never searched.

Accomplishments that we're proud of

  • The model never receives the account holder's name, account number or card number.
  • An upload to an outside site was blocked 10 times out of 10 in our checks. Approving the skill live adds one policy rule and lets it through. Removing the approval blocks it again.
  • Even code that has been tricked into misbehaving can't read the API keys.
  • 203 tests, 102 of them just for redaction.
  • Nemotron sorted all 12 unknown shops in one request, in under 6 seconds, at about 138 tokens per shop.

What we learned

  • A model doesn't need to know who you are to help with your money. Shop names and labels were enough.
  • A boundary you can test beats a promise. Being able to run a blocked upload ten times and see the log gave us more confidence than any rule we wrote down.
  • A second check is worth having. The leak guard catches what redaction misses.
  • Rules first, model second. Most transactions never needed Nemotron at all.
  • Every new service widens the privacy surface. Adding web search meant sending less, not more: shop name only, checked twice.

What's next for JComit

  • Test on real bank exports, which we have not done. All our data is synthetic.
  • Catch names that have no cue and aren't known in advance.
  • Make the sandbox easier to run where systemd is missing.
  • Run the full sandbox live in the demo. Today the page runs the real agent live, but the sandbox tabs show a recorded run.

Feedback on the Nebius and NVIDIA tools

(Everything here is unchanged except the new Tavily item.)

Nebius Token Factory was easy to start with, fast, and did what we asked.

  • The API is OpenAI-compatible, so we called it with Python's built-in urllib and no SDK. That mattered because pip is blocked in our sandbox.
  • Nemotron 3 Super gave clean, direct answers and followed "reply with JSON only" every time. Sorting one shop took about 138 tokens, so our $25 in credits was far more than we needed.
  • One request sorted all 12 unknown shops in under 6 seconds.
  • Account approval took about a day. Quicker approval during a hackathon would help a lot.
  • Model names are inconsistent: nvidia/nemotron-3-super-120b-a12b sits next to nvidia/Nemotron-3_5-Lightning. We had to copy names exactly every time.
  • Nemotron 3.5 Lightning returned its thinking inside the answer field. A separate field for the reasoning, like NVIDIA's own endpoint has, would fix it.

NVIDIA OpenShell was the best part of the stack for us.

  • One policy can say which website, which path and which program is allowed. Python could reach Token Factory, but curl going to the same address was blocked.
  • The provider feature is excellent. Our code only sees a placeholder, and OpenShell adds the real key on the way out. We used it for both Token Factory and Tavily.
  • Every connection is logged with a plain reason, such as endpoint example.com:443 is not allowed by any policy. We built our action log straight from these lines.
  • openshell policy set --wait updates a running sandbox in seconds, which made our "blocked, then allowed, then blocked again" demo easy to show live.
  • There's no built-in Nebius or Tavily profile, so we wrote our own. Built-in ones would save every team that step.
  • A few small things took trial and error: profile import needs --file, uploading a folder nests it one level deeper than expected, and a provider attached just before running a command didn't show up on the first run.

NVIDIA NemoClaw installed smoothly but assumes systemd.

  • The option to install now and connect the AI later (NEMOCLAW_DEFER_ONBOARDING) was useful while we waited for our Token Factory account.
  • Setup stopped in Codespaces with "service identity query returned invalid metadata". Windows without WSL isn't supported either. Support for environments without systemd would help the many students who use cloud dev environments.

NVIDIA Nemotron and build.nvidia.com showed good judgement on messy data.

  • Nemotron 3 Super put Franklin Barbecue under Dining and a foreign transaction fee under Fees. It also wrote a clear monthly review from category totals alone.
  • /v1/models lists Super and Ultra, but calling them returns "Function not found for account". Only models marked "Free Endpoint" worked. A clearer error, or a list showing only callable models, would have saved us an hour.

Tavily gave us the web lookups, and the credits came through the Nebius Builder Program.

  • The search API is a single POST, so it also worked with plain urllib. Passing include_answer returned a short summary we could hand straight to the model.
  • When I ran Tavily's CLI from my own account, my first search came back with "blocked due to excessive requests… verify you are using production API keys". Neither the message nor the code says what is actually wrong. Please confirm this one is what you saw and want in the feedback.

Built With

  • altair
  • docker
  • github-codespaces
  • nebius
  • nebius-token-factory
  • nvidia-nemoclaw
  • nvidia-nemotron
  • nvidia-openshell
  • python
  • sqlite
  • streamlit
Share this project:

Updates

Submission history