GhostFirst Voice Check: the browser goes first

GhostFirst lets voice assistants check suspicious links with a disposable browser that watches what the page does, like a form that appears only after loading, before anyone opens it.

Comment

Try it in 2 minutes

  1. Open https://mcp.ghostfirst.com, a voice-assistant simulator that is a real MCP client of our self-hosted MCP server (/mcp, spec 2025-11-25, Streamable HTTP).
  2. Type: Is this link safe? https://52-45-211-166.sslip.io/changes-face.html. The labelled demo page turns into a password form 3 s after loading → Caution, with a Deep Check offer. Say yes to see three visitors.
  3. Ask "why is it dangerous?" or "what should I do?"
  4. Try the one-time link https://52-45-211-166.sslip.io/reset?token=demo123 and answer No: nothing is visited.
  5. Switch EN/ES. The MCP traffic panel shows every protocol message.

No account needed. Code: https://github.com/Silentarcherjr/ghostfirst-open (Apache-2.0).

Inspiration

Americans 60 and older reported about $3 billion in fraud losses in 2025, and they are more likely than younger adults to lose money to scams that impersonate friends or family (FTC report to Congress, Oct 2026). Those scams usually arrive as a text with a link, and the scam starts the moment the link is opened. Voice assistants are already in many older adults' homes, so we asked: what if you could ask your assistant to check the link first, without anyone opening it?

What it does

What makes it different: reading a link can't tell you what the page will do after it loads. GhostFirst sends a disposable browser to watch. In our live demo, a page looks ordinary, then turns into a password form 3 seconds after loading; GhostFirst reports exactly that, as structured evidence, never as page text the assistant could be tricked by. People can ask follow-up questions, compare three visitors, and approve or decline visits to one-time links.

The browser goes first. The person stays in control.

GhostFirst Voice Check is a self-hosted MCP server for the Alexa+ track. A person shares a link and asks: "check the link from my grandson's text."

  • A disposable remote browser visits the link, away from the person's phone, and watches it over time.
  • Deterministic rules decide the verdict (no obvious danger / caution / danger). The AI never sets it. The answer is spoken and shown on an MCP Apps card with the evidence: where the link really ends up, whether the page asks for a password, code or card, and whether it changed into a form seconds after loading. You can't see that by reading the link.
  • If something looks off, it offers a Deep Check: the same page visited as a phone, a computer and another browser, with one tile per visitor.
  • Session state: links shared into the session (no URL dictation), plus follow-ups such as "why is it dangerous?" or "what should I do?", answered from the last result with no new tool call.
  • One-time links (password reset, sign-in) can be used up by a visit, so the server asks the human (Yes/No through MCP elicitation) before any visit. No means nothing is visited.
  • Page text never reaches the assistant. It only gets fixed sentences, host names and counts, so a malicious page cannot instruct it.
  • English and Spanish (es-US). It never says "safe", and every answer reminds you that no result is a guarantee.

How we built it

  • MCP server (Python, MCP SDK 2.2.0, spec 2025-11-25) over Streamable HTTP. Async jobs with polling (check_link / deep_check → get_check_result), a session-scoped inbox, Host/Origin protection and fail-closed errors.
  • MCP Apps card (ui://ghostfirst/verdict): sandboxed, hash-CSP HTML with no network access.
  • Voice simulator: plain JavaScript MCP client with speech synthesis and recognition, showing the real protocol traffic. Alexa+ developer tools are partner-only, so this is how judges can try a real MCP flow.
  • GhostFirst API on AWS: EC2 Graviton (t4g.small), Docker, Caddy TLS. Isolated Chromium (Playwright) visits the link, an OpenCV visual timeline detects pages that change after loading, and a rules engine produces the verdict.
  • What's open: the whole MCP layer is in the public repo. It runs against our hosted API with no credentials, or fully offline with fake evidence and mocked tests. The scanning engine stays private and is reached over its public API.
  • 40+ automated tests in the public repo, an accessibility review (375 px, 200% zoom, contrast ≥ 5.45:1) and live recorded demos against labelled test pages.

Challenges we ran into

  • No Alexa+ access for self-hosted MCP. We built a real MCP client simulator and documented it in our friction log.
  • Proxy compression held back the consent question until the call ended, which broke human-in-the-loop elicitation. Fixed at the Caddy layer.
  • Live data exposed bugs that mocks hid. A Deep Check repeated each reason once per visitor, and timings rendered as "—". We fixed both and re-recorded.
  • Being honest by construction: keeping page content and full URLs away from the assistant while still giving useful, specific evidence.

What we learned

Evidence beats verdicts. "This page changed into a password form 3 seconds after loading" is something a person can act on. "Looks risky" is not. Human consent has to live in the protocol (elicitation), not in the model's judgment.

Early feedback

We showed GhostFirst to a few older relatives, the people who receive "can you check this link?" texts. Their reaction was positive: they found it interesting and said it could help them and others like them. This was informal family feedback, not a user study; a structured test with older adults outside our family is our next step.

What's next

A structured test with older adults beyond our family, a real Alexa+ connection when self-hosted MCP access opens, optional caregiver notices, and more demo scenarios. The core engine stays private; the MCP layer is open source (Apache-2.0).

Built With

Share this project:

Updates

Submission history