Lets Alexa+ access family stories a parent has already delivered, exposing read-only tools such as listing family stories through the MCP add-on.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
Spoken Letter lets a family record a story in their own voice and deliver it to a child far away. This public companion repository brings those delivered stories to Alexa+ as an MCP add-on, built for the Amazon App Dev 2026 hackathon (Alexa+ track, AWS Builder and Open Source mini challenges).
It contains a dual-era MCP server (2026-07-28 specification served alongside the
2025-era handshake Alexa+ sends), an OAuth 2.1 authorization server, a simulated Alexa+
client on AWS (Strands Agents, Bedrock, Transcribe, Polly), the Amazon packaging path,
and a CDK deployment at alexa.spokenletter.com. The add-on is the parent's tool: it
exposes only stories the parent has already delivered, and no child account, voice or
data exists on this path.
Open-source contribution: aws/aws-cdk#39390
(open pull request, issue #39389) adds
MCP protocol versions 2025-11-25 and 2026-07-28 to MCPProtocolVersion in
aws-cdk-lib/aws-bedrockagentcore, with unit tests, a README update and an integration
test deployed in this project's account.
Amazon gives external developers no Alexa+ integration path yet, and a custom skill never receives raw audio. The hackathon video therefore shows the envisioned experience on a real Echo Show with a development-stage custom skill, following a fixed demo script written by the family that recorded the demo story. Which steps are real and which are staged:
Step | Treatment |
Playing stories by storyteller or by title | Real: skill → agent API → MCP server → delivered fixture stories, played with the AudioPlayer |
Credits | Staged: the account starts with no credits and a fixed purchase scene offers three packs from |
Listener and saved wish | Staged: one listener and one wish from |
Story conversation | Staged: fixed replies from the demo script; no model call |
Script on screen | Real: an APL teleprompter with a 3-2-1 countdown, showing the script the storyteller wrote in the Spoken Letter app |
Recording | Staged: nothing is captured; "playback" plays a take recorded beforehand of the same script in the Spoken Letter app |
Music and sound effects | Staged: the finished mix the Spoken Letter app produced for that take |
Send | Staged: a confirmation only; nothing is delivered |
Creation progress | Real: a creation record in DynamoDB ( |
The listener's first name in the demo is used with the family's consent. The
Alexa+ simulator at /demo runs the real agent on Bedrock; the staged
create flow is English only, and the Spanish skill keeps its draft flow.
Related MCP server: Aura+
Alexa+ (Amazon, US, en-US) Simulated Alexa+ client (judges, Owner)
│ OAuth 2.1 auth code + PKCE │ browser SPA at https://alexa.spokenletter.com/demo
│ Streamable HTTP, legacy initialize │ mic → agent API → Transcribe streaming
▼ ▼
https://alexa.spokenletter.com (CloudFront → Lambda function URL, RESPONSE_STREAM, Hono)
├── /mcp createMcpHandler (2026-07-28 + legacy 'stateless'), bearer JWT
├── /.well-known/oauth-protected-resource RFC 9728 → issuer = same host
├── /.well-known/oauth-authorization-server RFC 8414
├── /.well-known/jwks.json KMS asymmetric public key
├── /oauth/authorize|token|continue|revoke packages/oauth, DynamoDB tables
├── /bridge/link/complete|revoke bearer ALEXA_BRIDGE_SECRET, called by Spoken Letter
├── /agent/* packages/agent: Strands + Bedrock, Polly, Transcribe (Lambda)
└── /demo/* packages/simulator static SPA (S3 origin)
Agent → AgentCore Gateway (MCP server target, outbound client_credentials) → /mcp
Alexa+ → /mcp directly (Amazon requires the server itself)Every entry does real work in code and has a friction-log entry. The status column gives the live state on 2026-10-18 (account 106403001709, us-east-1).
Tool | Function | Status |
AWS CDK | One-command deploy ( | Live: all seven stacks deployed. Last updates: Core and Edge 2026-09-28, Observability 2026-10-01, Simulator, Api, Gateway and Skill 2026-10-19 |
MCP TypeScript SDK v2 ( | Dual-era | Live at |
Lambda function URL (RESPONSE_STREAM), CloudFront, ACM, Route53 |
| Live: |
Lambda@Edge | Origin-response function that restores the | Live since 2026-09-09; the challenge reaches clients through CloudFront on 2026-10-18 |
DynamoDB | OAuth state ( | Live: four tables. The OAuth token flow passed on 2026-09-09; demo receipts read back from DynamoDB in the 2026-10-01 console journeys; the API accepted every creation record of the 2026-10-09 purchase-scene run |
KMS | An asymmetric RSA key for JWT signing ( | Live: signs every access token, including the tokens the AgentCore Gateway uses for its tool calls (last on 2026-10-17) |
Secrets Manager |
| Live: read at each API cold start ( |
S3 | Simulator SPA, fixture audio and demo takes, Polly replies (1-day lifecycle) | Live: CloudFront serves the SPA, the fixture stories and the takes (HTTP 200, each size equal to the local file, 2026-10-09) |
Amazon Bedrock + Strands Agents | The agent behind the simulator and the skill's story requests: | Live since 2026-09-09. The API log shows agent turns with Bedrock token counts from the Echo (device mode) and the simulator (demo mode) up to 2026-10-17. The staged create flow uses fixed lines and calls no model |
Bedrock AgentCore Gateway |
| Live: gateway |
Amazon Transcribe (streaming) | Voice input: WebM/Opus from the browser, converted to 16 kHz PCM, streamed | Deployed, live use not verified: the API log has no |
Amazon Polly | Spoken replies in the simulator, neural | Live: |
CloudWatch + X-Ray |
| Live: alarms |
Alexa Skills Kit, ASK CLI and SMAPI | Classic custom skill ( | Live in the development stage with a beta test. Family stories played on a real Echo Show from 2026-09-09. On 2026-10-18 the full staged demo script ran on an Echo Show 5 under Alexa+ (US account) |
Alexa proactive events |
| Partly live: the permission and subscription events reached |
Kiro Crew | CDK scaffold draft | Not used: not available on the build machine (friction log, 2026-09-08) |
Requirements: Node.js 24, pnpm 11, and for Phase 6 onward the AWS CLI with the archy
profile. Python 3.11 or newer runs the cc-rpi lifecycle scripts under .rpi/.
pnpm install
pnpm typecheck && pnpm lint && pnpm test && pnpm -F infra synthThe same four commands, plus the simulator's Playwright smoke (pnpm test:e2e), are the
single verify job in .github/workflows/verify.yml.
The complete local gate is declared in .rpi/policy.json and run by
python3 .rpi/scripts/rpi-verify.py.
Run the MCP server locally on :4310 (prints a one-time MCP_DEV_TOKEN unless one is set):
pnpm dev
curl -s -X POST http://localhost:4310/mcp \
-H "authorization: Bearer $MCP_DEV_TOKEN" -H "content-type: application/json" \
-H "accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_family_stories","arguments":{}}}'The whole link flow can be driven locally without the private repository:
DEV_ROUTES=1 PROVIDER_MODE=auto pnpm dev # prints ALEXA_BRIDGE_SECRET once
ALEXA_BRIDGE_SECRET=<printed> node scripts/mock-spoken-letter.mjs # :3007, stands in for Spoken Letter
node scripts/e2e-link.mjs # authorize → confirm → code → JWT → toolsOpen http://localhost:4310/dev/start in a browser for the same flow by hand. Copy
.env.example to .env to pin the generated values.
The simulated Alexa+ client runs with pnpm dev (server on :4310, Vite on
:5173/demo/, AWS credentials from the archy profile for Bedrock, Polly and Transcribe)
or pnpm dev:offline (scripted model, canned transcript, no AWS). pnpm test:e2e runs
the Playwright smoke against the simulator's in-app mock.
Deploy (Owner, Phase 6 onward): pnpm run deploy. Release procedure: docs/release.md.
Real device (Phase 9): a thin classic Alexa Skill in packages/skill calls the same agent
endpoint and plays the family MP3 through AudioPlayer on an Echo. pnpm -F skill generate
rebuilds the interaction model from the tool metadata; pnpm -F @spoken-letter-alexa/skill run deploy creates the
development-stage skill with the ASK CLI (Owner gate); pnpm -F skill record:pull imports
historical raw records only. Raw recording and model-speech logging are intentionally
disabled, including when the deprecated RECORD_UTTERANCES or LOG_SAY switches are set.
Safe diagnostics work without either switch. Legacy slot nulls mean redacted, not missing;
slotPresence reports missing/present. Flow, response keys, interaction results, and
domain-separated hashes of ephemeral session/request IDs support recovery analysis
without logging speech, names, or user/device IDs. FallbackCount is an undimensioned
CloudWatch counter; hashes are log fields only. Safe diagnostics cannot reconstruct
utterances or produce training transcripts.
packages/shared env parsing, JSON logger, vendored agent-tool contract
packages/mcp-server dual-era MCP server, fixture provider, three read-only tools (Phase 1)
fixtures/ the Owner's recorded stories for the demo subject (see fixtures/README.md)
packages/oauth OAuth 2.1 authorization server: PKCE, client_credentials, RFC 8414/9728, JWT verifier (Phase 2)
app.ts composes OAuth + JWT-gated /mcp + dev routes; HttpProvider talks to the bridge (Phase 4)
packages/agent Strands + Bedrock agent loop, scripted offline model, Polly, Transcribe, sessions (Phase 5)
packages/simulator simulated Alexa+ SPA: Vite + React, brand tokens, Playwright smoke (Phase 5)
packages/app the composed server: OAuth + MCP + agent on one Hono app; local and Lambda entry points
packages/skill classic Alexa Skill front end for real-device footage: handler, agent client, generated interaction model (Phase 9)
infra/ CDK app: Core, Simulator, Api, Edge, Gateway, Observability, Skill stacks; bundle and seed scripts
amazon/ addon.json, agent-skill placeholder, runbook, US account checklist, Inspector guide (Phase 7)
scripts/ mock-spoken-letter.mjs (stand-in for the private bridge), e2e-link.mjs, verify-deploy.mjs, add-fixture-story.mjs
docs/ research, plans, decisions, friction log, product feedback, releaseEverything in this repository was created between 2026-09-03 (plan) and the submission
date, on the public develop and main branches. The dated history lives in
docs/plans/2026-09-03-alexa-plus-mcp-add-on-notes.md (one handoff per phase, every
review finding and its disposition, and the deviation register D1 to D25), in the later
plans' notes under docs/plans/, and in docs/friction-log.md.
The private Spoken Letter bridge (Phase 3 of the plan) is not part of this submission. The deployed server reads the delivered demo stories from the fixture catalog (PROVIDER_MODE=fixtures), and scripts/mock-spoken-letter.mjs stands in for the bridge in local runs.
Manual latency workflow: .github/workflows/latency.yml runs scripts/verify-deploy.mjs
from a us-east-1 runner against the deployed host (never deploys).
Agent workflow follows cc-rpi (Research, Plan, Implement, Validate). Shared project
facts and boundaries are in AGENTS.md; Claude Code reads them through CLAUDE.md.
Plan: docs/plans/2026-09-03-alexa-plus-mcp-add-on.md and its phase files.
Research: docs/research/. Decisions: docs/decisions/.
Friction log: docs/friction-log.md. Product feedback: docs/product-feedback.md.
MIT. See LICENSE.
This server cannot be deployed
Remote MCP server for AIStoryHub: stories, chapters, story bible, Voiceprints, AI generation.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Hosted text-to-speech MCP server: 66 voices in 9 languages, long-form narration, podcasts.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
