Caselight

Inspiration

Fraud investigators at financial institutions spend an average of 45 minutes manually assembling the context for a single alert — pulling transaction history, comparing behavioral baselines, searching prior case files for similar patterns, and then writing a disposition report. That's 45 minutes per alert, with alert queues running into the hundreds.

We asked: what if an agent could do that in 45 seconds?

Not a rule-based filter. Not a chat assistant that answers questions. A true autonomous agent that investigates — retrieving semantically similar historical cases, analyzing behavioral anomalies against time-series baselines, surfacing a structured finding, and then pausing for a human approval gate before taking any real-world action.

That's Caselight.

What it does

Caselight is a multi-agent fraud-investigation system built on Google ADK and MongoDB Atlas. When a suspicious transaction event arrives via MongoDB Change Streams, the system:

1. Triage Agent (Gemini Flash) — classifies the alert severity and routes it to investigation
2. Investigation Agent (Gemini Pro) — performs semantic retrieval of similar historical fraud cases via Atlas Vector Search, compares current behavior against MongoDB Time-Series baselines, and assembles a structured case file
3. Human Approval Gate — streams the reasoning trace to an analyst dashboard; no action is taken without explicit approval
4. Action Agent — executes the approved disposition (flag, freeze, escalate) via the MongoDB MCP server
5. Report Agent (Gemini Pro) — generates a compliance-ready case narrative and writes it back to Atlas

The result: a complete investigation — evidence gathered, hypothesis formed, action taken, report written — in under 60 seconds.

How we built it

Agent framework: Google ADK (google-adk) with LlmAgent and MCPToolset. Four sub-agents communicate via ADK's built-in session and event system. Each sub-agent prompt is kept under 600 tokens for reliability.

MongoDB — three distinct capacities:

• Atlas Vector Search — semantic retrieval of historical fraud cases. When a new case comes in, the Investigation Agent queries by embedding similarity to surface the 5 most analogous prior cases. Embeddings are generated automatically by the MongoDB MCP server's Voyage AI integration on insert-many.
• Change Streams — real-time trigger pipeline. The Triage Agent subscribes to the transactions collection change stream; every new suspicious transaction fires the investigation workflow without polling.
• Time-Series collections — behavioral baseline analysis. Customer spending patterns, velocity, and geography are stored as time-series data; the Investigation Agent compares current behavior against rolling 30-day baselines to quantify anomaly score.

MCP integration: All MongoDB operations are performed through the official mongodb-js/mongodb-mcp-server. The agent never writes raw queries — it invokes MCP tools (find, aggregate, insert-many, vector-search), keeping the agent code clean and the data layer swappable.

Dashboard: FastAPI + HTMX + Tailwind CSS. Three panels: live transaction feed (SSE), investigation center with real-time reasoning trace streaming, and a similar-cases panel showing the Vector Search results that informed the finding.

Deployment: Agent runtime on Google Cloud Agent Engine; dashboard on Cloud Run; database on MongoDB Atlas M0 (free tier).

Challenges we ran into

• Prompt sizing discipline. Multi-agent ADK setups degrade quickly when sub-agent prompts grow beyond ~700 tokens. We enforced a hard 600-token ceiling on every sub-agent, which required several rounds of tightening.
• Change Stream reliability. Atlas M0 free tier has Change Stream limitations. We built a fallback polling loop for development and a clean switchover for the Cloud Run deployment.
• Embedding timing. Getting Voyage AI embeddings to auto-generate on insert-many via the MCP server required precise index configuration — the target field must be referenced by an existing vector-search index before bulk insert.

Accomplishments that we're proud of

• 45 minutes → 45 seconds. A complete fraud investigation cycle, fully traced and auditable, in under a minute.
• Three distinct MongoDB paradigms in one coherent agent. Vector Search, Change Streams, and Time-Series each serve a different behavioral need of the agent — not bolted on, but architecturally justified.
• Human-in-the-loop as a first-class design pattern. Every agent action passes through an explicit approval gate. Judges score Design — we treated the approval UX as the centerpiece, not an afterthought.
• MCP-native. Zero raw MongoDB queries in agent code. The MongoDB MCP server handles all data operations, making the architecture portable and auditable.

What we learned

• Google ADK's MCPToolset is the right abstraction level for agent-to-database communication — it keeps agent code readable while preserving the full power of the underlying tool server.
• Multi-agent decomposition (Triage → Investigation → Action → Report) dramatically improves reliability compared to a single monolithic agent prompt.
• Real-time streaming of agent reasoning (via SSE) is not just a demo trick — it's the key UX pattern that makes analysts trust the system enough to act on it.

What's next for Caselight

• Production hardening: SAR (Suspicious Activity Report) auto-draft generation; integration with core banking APIs for direct account action.
• Expanded vector corpus: Ingest FinCEN typology reports as additional retrieval context.
• Multi-institution deployment: Federated Atlas clusters so investigation agents can query anonymized cross-bank case patterns without sharing raw data.
• Continuous learning: Close the loop by writing agent-confirmed fraud cases back into the vector index, so retrieval quality improves with every investigation.

Built With

• atlas-vector-search
• faker
• fastapi
• gemini-flash
• gemini-pro
• google-adk-(google-adk)
• google-cloud-agent-engine
• google-cloud-run
• htmx
• mongodb-atlas
• mongodb-change-streams
• mongodb-mcp-server
• mongodb-time-series
• python-3.11
• tailwind-css
• voyage-ai