Inventory Copilot

English · Español

A generative AI agent that queries and operates an inventory system in natural language — safe, auditable, evaluated and provider-agnostic. It runs at $0 locally (LM Studio, OmniRoute) and on Amazon Bedrock by changing one variable, with infrastructure in AWS CDK checked by cdk-nag.

v1.3 · 340+ tests · evaluations with dev/test sets, repetitions and a validated judge · evaluation gate in CI · all data is synthetic.

Companion project: LegacyBridge. Inventory Copilot answers can I trust what the agent does?: actions governed by the database and a real AWS deployment. LegacyBridge answers can I trust what the agent says about my data?: questions over a legacy ERP with a hostile schema, through MCP, with verifiable evidence, a measured rate of wrong answers given with confidence (SWAR) and a model cascade at 6% of the Bedrock cost.

The demo UI, the synthetic company and the architecture decision records (ADRs) are in Spanish.

What it demonstrates

Related MCP server: MCP SQL Server

Architecture

flowchart LR
    U[User] -->|IAM / local| API[FastAPI API<br/>Lambda + API Gateway]
    API --> G1[Input guardrails<br/>PII · injection · Bedrock Guardrail]
    G1 --> AG[Agent<br/>loop with trace]
    AG <--> LLM{LLM layer}
    LLM --> LMS[LM Studio<br/>local Qwen3.6]
    LLM --> OMR[OmniRoute<br/>free models]
    LLM --> BR[Amazon Bedrock<br/>MiniMax · Haiku · Qwen3]
    AG --> T1[query_inventory<br/>text-to-SQL + guard]
    AG --> T2[get_sku_status]
    AG --> T3[search_documents<br/>RAG pgvector]
    AG -->|pause and confirm| T4[propose_purchase_order]
    T1 & T2 --> RO[(Postgres / Aurora<br/>role copilot_ro)]
    T3 --> VEC[(pgvector)]
    T4 --> PO[(role copilot_po<br/>INSERT only)]
    PO -.->|human approval| APR[po_review<br/>role copilot_approver]
    AG --> G2[Output guardrails<br/>tool sanitization · DLP · PII]
    AG --> AUD[(audit_log<br/>append-only)]
    MCP[MCP server<br/>read-only] --> T1 & T2 & T3

Mapping to AWS Certified Generative AI Developer – Professional (AIP-C01)

Domains as listed in the official exam guide:

Results

Test set (never used for tuning). Local models: 3 repetitions, run 20261002T182158Z (v1.3.0). Bedrock: 1 repetition, runs 20261002T042745Z (v1.1.3: Sonnet 4.6 and Opus 4.6) and 20261001T225947Z (v1.1.2: Haiku, MiniMax and Qwen3 on Bedrock; v1.1.3 only changes reason validation; v1.3.0, the delivery warehouse and date of purchase orders). Comparison in ADR-010.

Every model except Qwen3 32B on Bedrock is fooled by the same attack that survives the defenses: misinformation planted in the data. It does not depend on the model.

* Estimated with the closest Qwen on Bedrock. ** Tokens inflated by OmniRoute's own context.

• Input guardrails: heuristics 80%; Bedrock Guardrail STANDARD 70%; combined 96.7% with 0.9% false positives.

• RAG: hit@1 of 100% with Titan Embeddings V2 and 87.5% with bge-m3 (test).

• Faithfulness judge: 96.5% agreement on 29 labeled cases (100% on the 16 clear errors and 92.3% on the 13 subtle ones); Bedrock grounding, 68.8% on the original 16.

• Exfiltration: the DLP output filter stopped it on all 5 models. Only misinformation in the data survives.

• Recommendation for AWS: MiniMax M2.1 + Titan V2 + local and Bedrock guardrails (ADR-010). Opus 4.6, the highest-quality model available, ties MiniMax on the agent and beats it on SQL (100% vs 93.3%), at 27 times the cost per query.

Quick start (local, $0)

git clone https://github.com/mcorona/AI-projects-inventory-copilot.git
cd AI-projects-inventory-copilot
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
docker compose up -d                  # Postgres 16 + pgvector with schema and roles
python -m scripts.generate_data       # synthetic data (seed 42)
python -m scripts.ingest_docs         # indexes the policies in pgvector
python -m pytest -q                   # no LLM or database needed
uvicorn src.api.app:app               # http://localhost:8000

In LM Studio, load qwen/qwen3.6-35b-a3b and text-embedding-bge-m3 and start the local server (port 1234). You can also use LLM_PROVIDER=omniroute or LLM_PROVIDER=bedrock.

AWS

aws login --profile <profile>
cd infra && npm ci
npx cdk synth                                        # 3 stacks + cdk-nag
npx cdk deploy InventoryGuardrail                    # no fixed cost, no cdk bootstrap
BEDROCK_GUARDRAIL_ID=... python -m evals.run_bedrock_guardrail_eval

InventoryData (Aurora Serverless v2 with auto-pause, isolated VPC with endpoints) and InventoryApp (Lambda + API Gateway with IAM) are validated with synth, template tests and cdk-nag in CI, and were deployed to a real account for a one-day test (ADR-009). That test found and fixed 4 bugs that neither the tests nor cdk-nag caught.

npx cdk bootstrap                                                    # once (Lambda assets)
npx cdk deploy --all -c allowDestroy=true                            # temporary test
npx cdk deploy --all -c allowDestroy=true -c dbEngine=rds            # accounts on the AWS free plan
npx cdk destroy --all -c allowDestroy=true

dbEngine=rds uses RDS PostgreSQL db.t4g.micro instead of Aurora, because on the free plan Aurora requires an express configuration that CloudFormation does not support. A one-day test costs ~US$2–3; left running it costs ~US$50 a month, mostly for the VPC endpoints.

InventoryGuardrail was deployed to a real account for the live evaluation (versions 1 to 3, see ADR-010) and was deleted when the project closed with npx cdk destroy InventoryGuardrail. No project resources remain in AWS; the deploy above recreates them.

Real Bedrock cost for Week 6: comparison run of 3 models + Guardrails + Titan, under US$5 estimated with config/pricing.json.

Limitations

• The test sets are small (8–30 cases) and the Bedrock models were evaluated with 1 repetition.

• The faithfulness judge is validated on 29 labeled cases (16 clear errors, 13 subtle ones); it misses 1 of the 8 unfaithful subtle cases.

• Known failures deliberately left unfixed, because fixing them by looking at the test set would contaminate it: t08 (warehouse names) and one false alarm from the router's verifier.

• The three stacks were deployed and tested live for one day, but the model path in AWS (agent answers, purchase orders through the API, RAG with Titan) was not: Bedrock was blocked for the account at the time. decided_by in approvals is free text; in production it would come from IAM or Cognito.

• Misinformation in the data (without instructions) is not stopped by any text guardrail.

Architecture decisions (in Spanish)

1. Provider-agnostic LLM layer

2. Text-to-SQL evaluated by execution accuracy

3. Neutral tool calling, custom agent loop and MCP

4. RAG on pgvector

5. Cascade model router

6. Purchase orders with human-in-the-loop

7. Layered guardrails

8. Evaluation strategy, cost and CI gate

9. AWS architecture with CDK and cdk-nag

10. Local vs. Bedrock comparison

Data and license

All data is synthetic (a fictional company). Never send real data to free providers. MIT license.