Vendor Change Briefing

An Alexa+ hackathon prototype that turns public vendor-policy changes into a short, evidence-backed spoken briefing for procurement, privacy, and vendor-risk teams.

The project exposes a self-hosted Model Context Protocol server over Streamable HTTP using protocol version 2025-11-25. Its live tool calls Policy Change Monitor on Apify; a deterministic demo path keeps the judging experience reliable and costs nothing.

Why this can win

• It solves a specific business workflow rather than presenting a generic assistant.

• The backend is already a published, paid product with preserved before-and-after evidence.

• The same submission can enter Alexa+ as its primary track and layer on AWS Builder plus Open Source.

• The demo supports follow-up questions: what changed, why it matters, and what a reviewer should do next.

Related MCP server: Plain English

From demo to production

The demo is also a direct path to the paid Policy Change Monitor. A procurement or compliance team can start with the Enterprise Vendor Policy Pack, replace the sample pages with its vendor register, and schedule recurring checks at $0.004 per public page.

The Build, Ship, Shape submission deadline is October 23, 2026. This repository targets the Alexa+ primary track and Open Source mini challenge; AWS Builder remains conditional on a real, tested AWS integration rather than a README-only claim.

Run locally

Requires Node.js 20 or newer and no package installation.

node src/server.js

Open http://127.0.0.1:8787 for the simulated Alexa+ experience. The MCP endpoint is http://127.0.0.1:8787/mcp.

For live checks, set APIFY_TOKEN in the process environment. The token is sent only in an Authorization: Bearer header to Apify. Every live tool request has a caller-controlled cost ceiling and is limited to 25 pages.

MCP tools

• get_demo_briefing — deterministic zero-cost judging path

• estimate_monitoring_cost — page-check cost calculator at $0.004/check

• explain_demo_change — evidence-backed follow-up on why a change matters and what to do next

• check_vendor_policies — live Apify-backed check for up to 25 public policy pages

Test

node --test

Tests cover protocol initialization, tool discovery/calls, cost ceilings, missing-credential behavior, origin validation, and the stateless GET response.

Security posture

• Binds to 127.0.0.1 by default

• Validates browser Origin values

• Caps request bodies and live page counts

• Does not accept arbitrary backend/API destinations

• Keeps the Apify token out of URLs and responses

• Leaves fetching safeguards to Policy Change Monitor, which blocks private-network and metadata targets

Hackathon status

Created during the Build, Ship, Shape hackathon window. A Devpost draft is ready; AWS deployment, the Bedrock narrative layer, evaluation results, and the public demo video are still pending.

See SUBMISSION-DRAFT.md for the current judge-facing narrative and completion checklist.

License

MIT