Shortlist

The constraint that shaped the build

The interesting engineering problem here was not the extraction. It was that the person using this is not technical, does not want to manage an API key, and should never receive a usage bill she did not expect.

So every model call shells out to the Claude Code CLI running under her own subscription on her own machine. There is no API key to provision, no per-token billing to monitor, and no server to host or secure. Any stray key in the environment is stripped from the child process, so a leftover credential cannot silently hijack auth or billing. An API path exists as a fallback, but the subscription path is the product.

The same reasoning drove the output. An export nobody opens is not a deliverable, so the result is written directly into her Google Drive as a formatted sheet with a frozen header, sized columns, and a filter row. A spreadsheet download exists as a no-auth fallback, and the button goes quiet once the Google path is configured.

What it does

• •Reads the source material. Fetches each document concurrently, strips it to clean text, and extracts structured fields into a consistent schema.
• •Scores against a rubric. Fit is judged with a documented methodology rather than per-document improvisation, then calibrated across the whole batch so the scores are comparable to each other.
• •Asks before it assumes. After reading the documents, it asks about requirements the source material raises but the inputs do not answer. Those answers feed scoring and synthesis.
• •Shows its work as it goes. Progress streams per document over NDJSON, so a long run is legible instead of a spinner.
• •Lands where she works. Generate once, export many: the formatted Google Sheet and the spreadsheet fallback both reuse the same generated result rather than re-running the model.

The handoff

A tool only counts if the person it was built for can operate it without the person who built it. Shortlist ships as a double-click launcher that starts the backend, serves the built frontend as static files from the same process, and self-updates. No Node install, no terminal, no second process to remember. Setup is documented in her language, not mine, including the one-time Google authorization. That handoff, not the model call, was the part that took the most iteration.