Scam Guardian for Alexa+

A voice guardian that helps older adults in the United States check a suspicious call before they pay. They hang up and tell Alexa what happened. Alexa names the warning signs, checks with the real family member on a number the family saved in advance, says what the family member answered, and helps them report it.

It never says a payment is safe, never contacts the caller, never asks for card, bank or Social Security numbers, and never records anything.

Built for the Amazon Developer Hackathon "Build, Ship, Shape", Alexa+ track.

Demo video (2 min 50 s): youtu.be/P9RzZagbMyM

Why

In 2025, people aged 60 and over filed 201,266 complaints with the FBI's Internet Crime Complaint Center and reported $7.7 billion in losses (2025 IC3 Annual Report, complaints by age group). The FTC's advice for a family emergency call is simple: hang up and check with the family member on a number you know (FTC consumer advice). Scam Guardian turns that advice into a conversation a frightened person can follow.

Related MCP server: Aegis

What it does

The family organizer sets everything up from a phone: who Alexa can check with, who gets a heads up, an optional family password, and a history of checks. One button deletes it all. To look around without an email, "Open Ruth's family page" on the Echo opens the demo family's page, with the checks just made.

Try it

• Hosted demo, no sign in, on AWS: the simulated Echo Show. Type or talk as Ruth, and answer as Michael on the demo phone beside it.

• Locally in two minutes, no AWS account needed:

pnpm install
pnpm dev

Open http://localhost:8787/echo, then type or say: "My grandson just called. He's in jail and needs two thousand dollars in gift cards for bail." Each visitor gets a private demo family (Ruth, her grandson Michael, her daughter Sarah). The demo phone on the right shows what the family receives; tap a reply there to answer as Michael.

Requirements: Node.js 24 and pnpm 9. Speech input uses the browser's speech recognition (Chrome or Edge); typing always works.

Architecture

flowchart LR
  subgraph Browser
    Echo["Simulated Echo Show<br/>speech in, captions, MCP Apps cards"]
    Phone["Demo phone<br/>what the family receives"]
    Family["Family page"]
  end
  subgraph Web["Web app (Lambda, Hono)"]
    Turn["Turn: redact, then<br/>Bedrock or rule based mode,<br/>then output guard"]
    Client["MCP client"]
  end
  subgraph MCP["MCP server (Lambda, Streamable HTTP)"]
    Tools["8 tools<br/>assess_call, prepare_outreach, confirm_outreach,<br/>get_updates, check_family_password,<br/>get_guidance, prepare_report, close_check"]
    Views["MCP Apps views<br/>ui://guardian/*"]
  end
  Echo -->|"what the person said"| Turn
  Turn --> Client -->|"household token"| Tools
  Turn -->|"Converse with tools"| Bedrock["Amazon Bedrock<br/>Claude Haiku 4.5"]
  Echo -->|"spoken line"| Polly["Amazon Polly<br/>neural voice"]
  Tools --> DDB[("DynamoDB<br/>one table, TTL")]
  Tools -->|"real email"| SES["Amazon SES"]
  Tools -->|"text messages"| Phone
  Family --> DDB
  Tools --- Data["Scam patterns<br/>FTC and FBI sources only"]

• MCP server (apps/mcp-server): the product. Self-hosted, stateless Streamable HTTP with MCP TypeScript SDK v2, protocol 2026-07-28 and 2025-11-25 on one endpoint. Bearer household tokens (HS256, issuer and audience checked) and OAuth protected resource metadata, so an Alexa+ account linking server can issue the same claims. Three tools carry MCP Apps views (text/html;profile=mcp-app) for the Echo Show screen.

• Simulated Echo Show (apps/web/echo): Alexa+ MCP onboarding is open to select partners only (see FRICTION_LOG.md #1), so the web app plays the device. It is a real MCP Apps host (AppBridge) and its agent reaches the MCP server through the official MCP client, the way Alexa+ would.

• Two conversation modes, one conversation: rules answer what must be exact or instant (danger, a caller still on the line, the first description with its official warning signs, the answer to a question they asked, known requests like "any news?"); Claude Haiku 4.5 on Amazon Bedrock answers free questions and new details with the same MCP tools, within a 3 second deadline, and reads every line the rules said. Rules also answer when the model is slow, unavailable, or over budget. Every sentence goes through the same output guard either way. Measured on AWS: docs/measurements.md.

• Scam patterns (packages/scam-patterns): 9 patterns and 17 warning signs written only from FTC and FBI alerts; every pattern and sign cites its source, the schema is checked on every push and a weekly CI job checks that every link still works. Published on its own under MIT as Chinorab/us-scam-patterns for anyone building scam help for older adults (pnpm export:dataset keeps it in sync).

Safety by design

The constitution (.specify/memory/constitution.md) sets eight principles. Each one is enforced in code, not only in the prompt:

A red team suite of 75 adversarial utterances (pressure to approve, dictated numbers, "call him back", "tell me the password", the caller still on the line) runs on every push through the whole path, with fourteen multi turn attacks that arrive in the middle of a check (a new number in the yes, danger while a question is open, "so I can pay now?" after a relative confirmed), and a live runner sends the same set to Bedrock (tests/redteam).

AWS

Deploy with one command after cdk bootstrap: pnpm run deploy. Details, costs and limits: docs/deploy.md. Measurements: docs/measurements.md.

Alexa+ readiness

When the Alexa+ MCP toolkit opens to all developers, the same server plugs in as an add-on: Streamable HTTP at /mcp, protocol 2025-11-25, tool answers well under the toolkit's 500 ms (p95 on AWS: assess_call 31 ms, confirm_outreach 296 ms, see docs/measurements.md), MCP Apps views for Echo Show screens, protected resource metadata for account linking, and assistant rules carried in the server instructions.

Checks

pnpm check         # lint, format, copy rules, types, then 700+ unit, contract and red team tests
pnpm test:e2e      # Playwright: the Echo and the family page in a real Chromium, axe WCAG 2.2 AA, 200% zoom
pnpm smoke         # pages, security headers, Echo and MCP auth of a running site, local or deployed
pnpm measure       # answer time per turn and time to the check message
pnpm demo:play     # plays the demo video script on the Echo, for screen recording
pnpm test:redteam:live  # the red team against the real model on Bedrock
pnpm tool-latency  # tool median and p95 from the deployed MCP server's CloudWatch logs
pnpm aws:check     # what an AWS account still needs before the first deploy

Both the test suites and Playwright run in CI on every push. Every contract test also runs on the DynamoDB store through an in memory table, so the cloud storage is tested without an AWS account, and the full conversation mode is tested with a scripted stand in for Bedrock that issues real tool calls.

Project documents

• Specification: specs/001-voice-scam-guardian/spec.md

• Plan and research: plan.md, research.md

• Constitution: .specify/memory/constitution.md

• Product feedback: FEEDBACK.md

• Friction log: FRICTION_LOG.md

• Privacy: served at /privacy

Credits

• Fonts: Overpass and Atkinson Hyperlegible Next (Braille Institute), both under the SIL Open Font License, served through Fontsource.

• Icons: Lucide, ISC license.

• Scam patterns: written from FTC and FBI publications, cited one by one in the dataset.

License

MIT, see LICENSE. Design notes: DESIGN.md.