Custodian

Inspiration

Recalls for a car seat, a minivan or a smoke detector are public, but they are easy to miss. I built Custodian in September 2026 for the Alexa+ track of Amazon's Build, Ship, Shape 2026.

What it does

You tell it what you own. It keeps checking the public CPSC, NHTSA and openFDA recall feeds, tracks the small things that keep a home safe (smoke-detector batteries, filters, car-seat expiry, vehicle service, warranties), and answers in one or two spoken sentences with the remedy included. It runs as a self-hosted MCP server with 10 tools and an MCP App with 5 screen views.

How I built it

• Matching is deterministic, and every match carries a written reason: a MiniSearch index over titles, products and keywords, with brand, model and distinctive-word overlap weighted.
• Alexa+ allows 500 ms per tool call, so no tool handler does network I/O or calls a model; that all runs in an hourly sweeper, and tests assert p95 under 100 ms per tool through the real HTTP stack.
• I wrote the two-tier OAuth 2.1 authorization server by hand to fit the Alexa+ account-linking shape: client_credentials for service calls, authorization_code with PKCE S256 for household calls, ES256 JWTs, single-use codes, rotating refresh tokens and scope gating per JSON-RPC method.
• A TypeScript monorepo with file and single-table DynamoDB stores under one contract suite, 79 vitest tests on recorded feed fixtures, and a CDK stack synthesized in CI.

Challenges

The add-on itself was not submitted to the hackathon: the Alexa CLI is distributed through a private AWS CodeArtifact repository that needs an AWS account, which I do not have, so the repo stands as a portfolio piece.

Try it

The live demo runs the repo's own TypeScript (MCP server and tools, recall sweeper, matcher, feed parsers and the MCP App) in your browser, over recall responses recorded in the repo's test fixtures; no live feeds, OAuth or Bedrock.

Built With

• aws-cdk
• dynamodb
• express.js
• mcp
• oauth
• preact
• typescript
• vitest