Why I built this
Most homes have one person who knows where the water valve is. When that person is out and a pipe starts leaking, everyone else is guessing.
I looked at the warranty tracker apps that already exist. They ask you to scan a receipt or type things in and then they send you a reminder. That helps on a calm day. It doesn't help when there's water on the floor and your hands are wet. A voice assistant is already in the room at that point so I built for that moment.
What it does
Drawer is an MCP server made for Alexa+. You tell it things in normal sentences. Where the main valve is. Who your plumber is. What you bought, how long the return window is and how long the warranty runs.
When something goes wrong you just say it. "The washing machine is leaking." Drawer answers in a fixed order: where to shut the water off first, which appliance you mean, whether it's still covered, where you kept the papers and who to call. If you want it can draft a claim message. It never sends anything. You read it and send it yourself.
A few rules I set early:
- Gas, smoke, fire and sparks get fixed safety steps. Leave the house, then call emergency services. That text lives in the code and no model writes it.
- Drawer never guesses a return window or a warranty. It only uses the dates you gave it and says so each time.
- A house sitter can get a guest code. It opens only the things I marked as guest-safe and it expires on its own.
- Everything personal is encrypted and each household has its own key. There's no email and no account, only a household name and a passphrase.
How I built it
Python and the official MCP SDK (2.3) over Streamable HTTP. Sign-in is OAuth with PKCE. Every tool call checks its own token from the request headers so nothing about who you are is shared between requests. Data sits in SQLite and the sensitive text is encrypted before it's written. Passphrases are hashed with scrypt. Tokens and guest codes are stored only as hashes.
The master encryption key is wrapped by AWS KMS. Drawer asks KMS for a data key once and keeps only the wrapped copy on disk. After that it asks KMS to unwrap it at every start so the plain key never sits in a file. Only the key goes to AWS and no household data does. I ran it against the real service and the server prints which key source it is using when it starts.
I don't have access to a real Alexa+ account so I wrote a small web simulator. You type a sentence and it picks one tool and calls the real MCP endpoint with your own login. It's rules only. There's no AI model in it.
There are 11 automated tests. They cover sign-in, every tool, guest limits, one household not seeing another's data and deleting everything. One test opens the raw database file and checks that none of the saved names or phone numbers appear in it. Three more cover the KMS key handling.
What went wrong
- I had no Alexa+ device so I can't say it works there. The README says so.
- My tests caught two bugs I would have missed. A phone number filter was erasing dates. A search matched the word "the" inside unrelated entries so asking for the plumber also read out the water valve.
- Amazon Bedrock never worked for me. My AWS account is new and it kept returning errors for about a day. I opened a support case and it still wasn't fixed when I submitted. The optional AI claim drafting is written and tested against a stand-in but I haven't run it for real. AWS KMS did work so that is the AWS service I'm entering with.
What I learned
Checking identity on every single call turned out simpler than managing sessions. Privacy also got easier once I treated it as something to build. That meant separate keys per household and hashes everywhere plus one command to delete it all.
What's next
Test the account linking on a real Alexa+ account. Build the shelf view as a proper MCP App for screens. Let family members share a household. Add receipt reading with an AI model after stripping out personal details.
Log in or sign up for Devpost to join the conversation.