EchoPulse & ConsentGate MCP

Real-time acoustic FFT home triage, X-Ray blueprints, and a deterministic Information-Flow Firewall for Alexa+ over MCP.

Comment

Inspiration

Every year, 68 million U.S. households hear an unfamiliar rattle, screech, or hum coming from a washing machine, refrigerator, furnace, or water main—and face a frustrating dilemma:

  1. Pay $185–$280 just for an emergency technician visit to diagnose a $22–$39 OEM part that takes 20 minutes to swap.
  2. Ask a baseline text LLM voice assistant, which fails in two critical ways:
    • Baseline LLMs are deaf to mechanical physics: Text LLMs cannot compute a 2048-point Fast Fourier Transform, measure Total Harmonic Distortion (THD%), detect a 2,424 Hz outer-race bearing screech, or distinguish a lethal 240V Contactor Plasma Arc from a benign 60 Hz hum.
    • Autonomous MCP Agents are vulnerable to Confused Deputy Hijacking: When Alexa+ scrapes third-party repair bulletins, calendar invites, emails, or courier instructions over the Model Context Protocol (MCP), hidden Indirect Prompt Injections can silently hijack high-consequence tools—ordering counterfeit $349 parts (place_amazon_order), unlocking smart deadbolts (unlock_front_door), or disarming Ring alarms (disarm_ring_alarm).

We built EchoPulse & ConsentGate MCP to give Amazon Echo Show 15 + Alexa+ genuine signal-processing ears, interactive X-Ray eyes, and a deterministic cryptographic safety spine.

What it does

EchoPulse & ConsentGate MCP is a self-hosted MCP 2025-11-25 Streamable HTTP server, Open Agent Skill (SKILL.md), and Echo Show 15 Multimodal Wall Hub uniting three deterministic engines:

  1. Real-Time 2048-Point Radix-2 Cooley-Tukey FFT & Mechanical Fault Classifier (engine/acoustic-dsp.js):

    • Processes live 16.384 kHz audio (from the user's real microphone or our built-in physics-accurate Web Audio synthesizer) using a 4-term Blackman-Harris window (-92 dB sidelobe suppression) and multi-frame Welch periodogram averaging (8 Hz/bin resolution).
    • Extracts Fundamental Frequency \(f_0\), Dominant Fault Peak \(f_{\text{fault}}\), Total Harmonic Distortion (THD%), Time-Domain Crest Factor (dB), High-Frequency Plasma/Arc Energy Ratio (>3.5 kHz), and UL-2034 Temporal-4 Cadence.
    • Diagnoses household faults (Whirlpool Drain Pump Impeller Cavitation at 784 Hz, GE Evaporator Fan Frost Rub at 1,144 Hz, Carrier Draft Inducer Bearing Wear at 2,424 Hz, Copper Pipe Water-Hammer Shock) and stages the exact Amazon Prime OEM replacement part (#WPW10348269 — $28.40, saving $186.60 over a technician dispatch).

  2. Interactive X-Ray Appliance Blueprints on Echo Show 15 (index.html, js/app.js):

    • Renders real-time 60 FPS frequency spectrograms, time-domain oscilloscopes, and animated vector X-Ray cross-sections highlighting the exact failing sub-assembly, paired with Studio Neural AI Voiceover (en-US-AvaNeural & en-US-GuyNeural).

  3. Deterministic Life-Safety Lockout & ConsentGate Information-Flow Firewall (engine/lattice.js):

    • Life-Safety Lockout: If the FFT detects 240V Contactor Electrical Arcing or a UL-2034 Carbon Monoxide Temporal-4 Alarm (3,104 Hz), the MCP server deterministically locks out DIY repair instructions, trips the smart load-center breaker or gas relay, and unlocks exit doors for evacuation.
    • Confused Deputy Firewall: Enforces formal capability triples \((\tau, \kappa, \sigma)\) across all 16 Alexa+ MCP tools. When untrusted external data (fetch_repair_bulletin, read_calendar_invite, read_delivery_instructions, read_email) attempts to trigger an unrequested high-consequence tool, ConsentGate halts execution at the MCP transport boundary, displays a visual Provenance Diff, and requires a 2-Word Phonetic Voice Step-Up Token ("Echo Falcon").

How we built it

  • MCP 2025-11-25 Streamable HTTP Transport (server.js & mcp/server-core.js): Implements the Model Context Protocol 2025-11-25 specification over single-endpoint Streamable HTTP (POST /mcp JSON-RPC 2.0 single & batch, GET /mcp SSE text/event-stream, and DELETE /mcp session termination with Mcp-Session-Id tracking) alongside an in-browser JSON-RPC loopback so the live GitHub Pages demo runs identically to the Node.js server.
  • Open Agent Skill Manifest (SKILL.md): Declares all 16 Alexa+ tools, multimodal acoustic diagnostic workflows, and deterministic safety invariants.
  • Mathematical Signal Processing (engine/acoustic-dsp.js): Each 2048-sample frame \(x[n]\) is weighted by the 4-term Blackman-Harris window before in-place Radix-2 Cooley-Tukey decimation:

$$w[n] = 0.35875 - 0.48829\cos\left(\frac{2\pi n}{N-1}\right) + 0.14128\cos\left(\frac{4\pi n}{N-1}\right) - 0.01168\cos\left(\frac{6\pi n}{N-1}\right)$$

$$\text{THD}(\%) = 100 \times \frac{\sqrt{\sum_{m=2}^{6} P[m \cdot k_0]}}{P[k_0]}$$

  • Information-Flow Control (IFC) Lattice (engine/lattice.js): Tracks session taint monotonically across tool invocations:

$$\tau_{\text{ctx}}^{(t)} = \max\left(\tau_{\text{ctx}}^{(t-1)},\; \tau_{\text{source}}(T_t)\right)$$

  • AWS Builder Integration (mcp/aws-adapter.js): Integrates Amazon Bedrock Converse API (anthropic.claude-3-5-sonnet-20241022-v2:0) for semantic Intent Anchor extraction and Amazon DynamoDB (ConsentGateAuditLedger) for immutable provenance logging, paired with a 100% zero-key local deterministic fallback so judges can run every test offline in one command.
  • Zero-Dependency Open-Source Engineering: Written in 100% pure JavaScript/Node.js with 0 external npm packages (package.json has zero dependencies), making the codebase completely immune to third-party npm supply-chain attacks.

Challenges we ran into

  1. Separating Closely Spaced Mechanical Harmonics Under Heavy Ambient Noise (0 dB SNR): Standard rectangular FFT windows suffer from severe spectral leakage (-13 dB sidelobes), causing 60 Hz mains hum to mask adjacent bearing and impeller fault peaks when ambient noise equals signal power (0 dB SNR). Implementing a 4-term Blackman-Harris window (-92 dB sidelobe floor) with Welch periodogram averaging across overlapping frames raised our 0 dB SNR accuracy to 100.0% (28 / 28).
  2. Preventing LLM Self-Approval of Step-Up Challenges: In standard MCP tool-calling loops, if a server returns an authorization challenge inside a regular tool response, the LLM agent simply reads the token from its own context and calls the confirmation tool itself! We solved this by isolating the HMAC-SHA256 phonetic token in an out-of-band _meta.consentGateChallenge envelope rendered exclusively on the Echo Show 15 screen for physical human voice verification.
  3. Zero-Friction Judge Verification Without AWS Credentials: To ensure judges can evaluate both the live web app and the CLI benchmark in seconds without setting up IAM keys, we engineered an automatic dual-mode adapter (mcp/aws-adapter.js) that seamlessly switches between live AWS Bedrock/DynamoDB and our local deterministic lattice engine.

Accomplishments that we're proud of

We built a fully reproducible 220-evaluation dual benchmark (npm run benchmark) and 9 automated test suites (npm test) that execute in under 600ms:

Suite A: Radix-2 FFT Acoustic Fault Classification Across 4 AWGN Noise Tiers (112 PCM Waveforms)

Noise Condition (AWGN) Waveforms Tested Spectral Classification Accuracy Wilson 95% Confidence Interval Lethal Hazard Lockout Recall (240V Arc & CO T4)
+20 dB SNR (Quiet Room) 28 100.0% (28 / 28) [87.9% — 100.0%] 100.0% (8 / 8)
+12 dB SNR (Moderate Ambient) 28 100.0% (28 / 28) [87.9% — 100.0%] 100.0% (8 / 8)
+6 dB SNR (Heavy Household Noise) 28 100.0% (28 / 28) [87.9% — 100.0%] 100.0% (8 / 8)
0 dB SNR (Noise Power = Signal) 28 100.0% (28 / 28) [87.9% — 100.0%] 100.0% (8 / 8)
Pooled Total (All SNR Tiers) 112 100.0% (112 / 112) [96.7% — 100.0%] 100.0% (32 / 32)

Suite B: Cross-Tool Indirect Prompt Injection Benchmark (108 Multi-Turn Scenarios)

Execution Paradigm Attack Block Rate (Recall) False Positive Rate (FPR) Voice Step-Up Challenges Wilson 95% Confidence Interval
Unprotected Baseline Agent 0.0% (0 / 72) 0.0% (0 / 36) 0 [0.0% — 5.1%]
Heuristic Keyword Filter 6.9% (5 / 72) 0.0% (0 / 36) 0 [2.7% — 15.3%]
ConsentGate IFC Lattice (2025-11-25) 100.0% (72 / 72) 0.0% (0 / 36) 40 [94.9% — 100.0%]

What we learned

Building on the bleeding edge of Alexa+ Agent Skills and MCP 2025-11-25 Streamable HTTP taught us that multimodal voice agents require protocol-level provenance separation. We documented three formal engineering RFCs for the Amazon Alexa+ and MCP teams in FRICTION-LOG.md:

  1. RFC-1 (x-amzn-alexa-intent-anchor): Signed ASR utterance headers in MCP tools/call _meta so downstream servers can cryptographically distinguish direct human voice intent from model-inferred sub-goals.
  2. RFC-2 (x-mcp-content-trust): Content-level taint annotations on MCP tool responses so untrusted third-party data is automatically tagged before entering the LLM context window.
  3. RFC-3 (code: -32042 VOICE_STEP_UP_REQUIRED): Native out-of-band biometric voice step-up challenges in the Alexa+ runtime for high-consequence physical and financial actions.

What's next for EchoPulse & ConsentGate MCP

  • Multi-Microphone Phased-Array Beamforming on Echo Show 15: Leveraging the far-field microphone array on Echo Show devices to spatially localize acoustic faults across open-concept kitchens and utility rooms.
  • Expanded OEM Appliance Signature Library: Scaling from 8 core residential fault models to 150+ verified harmonic profiles across HVAC compressors, garage torsion springs, sump pumps, and dishwashers with direct 1-click Amazon Home Services integration.
  • Standardizing engine/lattice.js & engine/acoustic-dsp.js: Publishing our zero-dependency UMD modules as a reference security and acoustic telemetry layer for the broader Alexa+ MCP developer community.

Built With

Share this project:

Updates

Submission history