Inspiration

Enterprise operations teams lose hours every day navigating fragmented toolchains — jumping between task trackers, log dashboards, incident queues, and Slack threads just to answer a single question like "What's overdue and who do I need to follow up with?"

We noticed a critical gap: traditional AI chatbots stop at suggestions. They tell you what to do, but they never actually do it — and they certainly don't prove they did it. The moment a chatbot says "you should follow up with Marcus about TSK-8041," the human is right back to copy-pasting, context-switching, and manually tracking outcomes with zero audit trail.

We asked ourselves: What if an AI agent could understand your intent, decompose it into concrete steps, execute those steps against real operational tools, and hand you cryptographic proof that every action was completed?

That question — combined with the emergence of the Model Context Protocol (MCP) as an open standard for tool interoperability and Amazon Alexa+ as a voice-powered dispatch layer — became the spark for AgentFlow AI.

What it does

AgentFlow AI is an autonomous workflow command center that transforms natural language intent into verified, multi-step operational actions using connected MCP tools, Amazon Alexa+ runtime dispatch, and Amazon Bedrock reasoning models.

Instead of chatting with a bot, users command an autonomous operations engine:

Intelligent Decomposition — Type a goal like "Identify overdue tasks, prioritize the critical ones, prepare follow-up drafts, and give me an executive summary" and the Agent Planner translates it into a structured, numbered execution DAG (e.g., 01 → Retrieve, 02 → Rank, 03 → Draft, 04 → Save).
Real MCP Tool Invocation — Each step calls a real, schema-validated tool via the Model Context Protocol (2024-11-05). No mock responses — the list_tasks tool queries an operational backlog, analyze_priorities runs a multi-factor urgency heuristic scoring tasks from $0$–$100$, and create_follow_up_draft generates personalized stakeholder communications.
Traceable Cryptographic Proof — Every action generates a SHA-256 verification token:

$$h = \text{SHA-256}\bigl(\texttt{tool_name} \;|\; \text{JSON}(input) \;|\; \text{JSON}(output) \;|\; t_{\text{ISO}}\bigr)$$

These tokens are committed to an immutable audit ledger, so any action can be independently verified after the fact.

Human-in-the-Loop Safeguards — In supervised mode, the engine halts at security-sensitive steps (external communications, destructive mutations) and waits for explicit human approval before proceeding.
Executive Synthesis — After execution, the agent produces a rich result card with a headline summary, key findings, a prioritized items matrix, one-click-copy follow-up drafts, and cryptographic evidence tokens.

The platform ships with 7 fully functional pages: Executive Overview, Agent Workspace, Workflow Library, Execution History, MCP Tool Explorer, Connected Integrations, and Settings — plus a Cmd+K command palette for rapid navigation.

How we built it

AgentFlow AI is a full-stack TypeScript application with a clear three-layer architecture:

Layer	Technology	Role
Frontend	React 19, Radix UI, Motion (Framer), Tailwind CSS 4	7-page command center with accessible, animated UI
Backend	Express, Node.js, TypeScript	18 REST endpoints, MCP JSON-RPC server, workflow engine, SSE streaming
Protocol	MCP `2024-11-05`, JSON-RPC 2.0, SHA-256	Standard tool discovery, invocation, and cryptographic verification

MCP Server: We built a spec-compliant Model Context Protocol server exposing 8 operational tools — list_tasks, get_task_details, analyze_priorities, create_follow_up_draft, save_workflow_result, query_metrics, trigger_notification, and verify_compliance_audit — each with full JSON Schema input validation. The server handles the initialize capability handshake, tools/list discovery, and tools/call execution over JSON-RPC 2.0, plus a live SSE notification stream.

Workflow Engine: The autonomous planner performs intent classification on natural language prompts, maps detected intents (retrieval, analysis, generation, persistence, compliance) to canonical tool sequences, and builds a numbered execution DAG. During execution, it manages real-time step status tracking, input/output capture, SHA-256 proof generation, and human-in-the-loop approval gates.

Frontend: We used Radix UI primitives (Dialog, Tabs, ScrollArea, Popover, Tooltip) for full keyboard accessibility and Motion for smooth micro-animations on step execution, status transitions, and card reveals. Design follows a strict 60-30-10 palette with tabular-nums for aligned metrics and zero decorative elements.

Testing: 28 integration tests validate MCP protocol compliance, JSON Schema adherence, tool invocation correctness, workflow planning, execution sequencing, HITL gate enforcement, and cryptographic proof generation.

Challenges we ran into

MCP Protocol Negotiation Precision — The 2024-11-05 specification demands exact capability negotiation during the initialize handshake. Both server and client must declare supported capabilities, and the server must refuse unsupported methods with specific JSON-RPC error codes ($-32601$ for method-not-found, $-32602$ for invalid params). Getting the ServerCapabilities response shape exactly right — including nested tools.listChanged booleans — required meticulous cross-referencing with the spec.

Execution DAG Planner Without Over-Engineering — Translating free-form prompts like "find overdue tasks and draft follow-ups" into a structured $n$-step execution plan required balancing flexibility with determinism. The same prompt needed to reliably produce the same DAG. We iterated through several approaches before settling on a keyword-based intent classification system that maps detected intents to canonical tool sequences — robust and debuggable without requiring a fine-tuned LLM at the planner layer.

Human-in-the-Loop Without Blocking the UX — Supervised mode needs to pause execution at security-sensitive steps and wait for human approval, but naively blocking the server thread would freeze the entire UI. We implemented an asynchronous approval architecture: the workflow engine marks steps as awaiting_approval, the frontend polls for state changes with animated transitions, and a separate /approve endpoint resumes execution from the paused step.

Meaningful Cryptographic Proof — It's easy to slap a SHA-256 hash on something and call it "verified." The hard part is structuring the hash input so that an auditor can independently recompute and verify the record. Our hashing pipeline concatenates tool name, exact input arguments, exact output, and ISO timestamp — then exposes the verification tokens directly in the UI for transparent inspection.

7 Pages, One Design Language — Shipping 7 distinct pages (Overview, Agent Workspace, Workflow Library, Execution History, MCP Tool Explorer, Integrations, Settings) — each with unique data flows and interaction patterns — within hackathon time constraints required a strict shared component system (MetricCard, StatusBadge, JsonViewer, CommandPalette) and a design constitution enforced from day one.

Accomplishments that we're proud of

Fully spec-compliant MCP server — not a mock or a wrapper, but a real JSON-RPC 2.0 implementation handling initialize, tools/list, and tools/call with proper error codes and capability negotiation per the 2024-11-05 standard.
8 operational tools that are all actively implemented, schema-validated, and executable in real time — not stub responses, but tools that query a realistic operational backlog, run multi-factor urgency heuristics, generate personalized communications, and commit cryptographic proof.
End-to-end autonomous workflow execution — from natural language intent to structured DAG to step-by-step tool invocation to executive synthesis with proof tokens — in under 4 seconds.
Human-in-the-Loop that actually works — supervised execution mode genuinely pauses at critical steps, displays an approval gate in the UI, and only resumes after explicit human authorization.
28 passing integration tests covering protocol compliance, schema validation, tool invocation, workflow planning, execution sequencing, and HITL gate enforcement — all running in CI.
Interactive MCP Tool Explorer — a live developer console where judges can select any tool, fill in parameters from its JSON Schema, execute it against the real backend, and inspect the raw JSON response with round-trip latency. This is the "show, don't tell" feature for MCP compliance.
Production-grade UI with zero shortcuts — 7 pages, Cmd+K command palette, Radix accessibility primitives, Motion animations, responsive design, and a disciplined visual system — built to the standard of a real enterprise product, not a hackathon prototype.

What we learned

MCP is a powerful abstraction, but the spec rewards precision. Implementing a fully compliant server taught us how much the 2024-11-05 specification demands — from capability negotiation to JSON-RPC error semantics. The protocol is well-designed, but there's no room for "close enough."
Autonomous agents need guardrails, not just intelligence. Early prototypes ran happily off the rails — drafting emails to the wrong stakeholders, saving incomplete audit records. We learned that Human-in-the-Loop gates are not optional for production autonomy. The line between "helpful automation" and "dangerous automation" is thinner than you'd expect.
Proof matters more than results. Operations teams don't just want answers — they want evidence. The moment we added SHA-256 verification tokens and an immutable ledger, the entire system felt trustworthy in a way that raw AI output never does. Traceability is what separates a demo from a deployable system.
Multi-factor urgency scoring is deceptively hard. Tuning the weight vector $\mathbf{w} = [w_{\text{sla}}, w_{\text{overdue}}, w_{\text{blocked}}, w_{\text{priority}}]$ to produce intuitive urgency scores required iterative calibration. A task that's 2 days overdue but unblocked should score lower than one that's 1 day overdue but blocking 3 downstream deliverables — capturing that intuition in a linear heuristic took real iteration.
Design systems pay for themselves, even in hackathons. Investing upfront in shared components (MetricCard, StatusBadge, JsonViewer) and a strict design constitution (60-30-10 palette, tabular-nums, no decorative elements) meant that pages 5, 6, and 7 came together in a fraction of the time of pages 1 and 2. Consistency compounds.

What's next for AgentFlow AI — Autonomous Workflow Command Center

Live Amazon Bedrock Integration — Connect the planner to Claude 3.5 Sonnet and Amazon Titan via AWS Bedrock Agent Runtime for truly dynamic intent decomposition, replacing the current keyword-based classifier with LLM-powered plan generation.
Alexa+ Voice-First Workflows — Ship the Alexa+ Skill so users can say "Alexa, run my overdue triage" and receive a voice summary of findings with proof tokens pushed to their Alexa Show display.
Persistent Storage & Multi-Tenant Auth — Replace the in-memory data store with DynamoDB for durable execution history and add Cognito-based authentication for team-level access control and audit attribution.
Webhook & Slack Dispatch — Wire the trigger_notification tool to real Slack and webhook endpoints so follow-up drafts can be sent directly from the Agent Workspace with one click.
Plugin Architecture for Custom Tools — Allow teams to register their own MCP tools (Datadog queries, PagerDuty incidents, Jira transitions) via a plugin manifest, making AgentFlow a universal orchestration layer for any operational toolchain.
Execution Replay & Diff — Enable side-by-side comparison of workflow re-runs to surface how operational state changed between executions — critical for post-incident review and continuous improvement.