FirstHour

Inspiration

After an online scam, the first minutes decide how much can be recovered. In India, reporting early to the 1930 cyber fraud helpline gives funds the best chance of being frozen. But a panicked victim is often still on a call, hands busy, not knowing what to do first. That’s a natural fit for a voice assistant.

What it does

FirstHour is a voice-first scam-response assistant built as an MCP server for Alexa+. You say what happened (shared an OTP, installed a remote-access app, sent money, gave card details, clicked a link). It builds an ordered plan, reads one action at a time, runs a 60-minute countdown with progress tracking, records evidence (amount, time, transaction ID, beneficiary), and generates a call script for your bank or India’s 1930 helpline. The India playbook was checked against public advisories; the US playbook is a prototype and unverified. This is not legal or financial advice.

How I built it

Python, the MCP SDK, Starlette, Streamable HTTP (protocol 2025-11-25 negotiated in my tests). Six deterministic tools: start_incident, next_step, complete_step, record_evidence, get_call_script, get_status. No LLM runs inside any tool, so answers are exact and testable. The web interface is a simulated Alexa+ (a keyword matcher stands in for Alexa+’s language model) that calls the real MCP endpoint, and it shows each tool call with its response time.

Challenges I ran into

Keeping the tools stateless for HTTP while remembering each incident. Keeping the guidance short enough to say aloud. Setting up the SDK: version 2.x renamed FastMCP, so I pinned mcp<2.

Accomplishments

A working end-to-end flow on a real MCP server, with automated smoke tests and about 3 ms p95 tool latency measured locally (no network).

What I learned

Putting the logic in deterministic tools and leaving the language to the assistant makes time-critical guidance predictable and easy to test.

What’s next

OAuth 2.1 with PKCE, an MCP Apps visual for Echo Show, verifying the US playbook, and real Alexa+ onboarding.

Built With

• amazonalexa+
• css
• cybersecurity
• html
• javascript
• modelcontextprotocol
• python
• starlette
• streamablehttp