GnyPcior SafeDesk

Human-gated Alexa+ agent for safe Windows actions: scoped previews, explicit approval, independent readback, revocation, and no blind retries.

Comment

Inspiration

GnyPcior SafeDesk started from a practical problem: an AI assistant can be useful only if a person can see exactly what it is about to do, approve the real effect, and independently verify what actually happened. I wanted to explore that safety pattern for an Alexa+ style agent that can help with everyday computer tasks without giving an LLM unrestricted control of a Windows machine.

What it does

GnyPcior SafeDesk is a human-gated Windows/MCP agent prototype for the Alexa+ track. A user requests a small task, the agent prepares a scoped preview, binds the exact target and content with SHA-256, and waits for a separate human approval. Only then can the Windows customer-agent perform the action inside an authorized synthetic workspace.

After execution, SafeDesk independently reads the result back from disk, verifies the bytes and hashes, revokes the temporary authority and folder grant, and records the task as completed so it cannot be blindly replayed.

The demo UI is an Alexa+ style simulation. The underlying safety workflow and MCP tools are real; it does not claim to use a closed-beta Alexa+ partner SDK.

How I built it

For this hackathon I isolated three vetted modules from my pre-existing GnyPcior customer-agent and built a new contest-specific SafeDesk application around them. Source parity is checked by SHA-256 so the isolated copy can be verified against the original modules.

The prototype includes:

  • a Node.js local service bound only to 127.0.0.1
  • real MCP 2025-11-25 over Streamable HTTP
  • tools for preparing, inspecting, executing and recovering synthetic tasks
  • exact preview hashes and short-lived authority leases
  • explicit UI approval separated from the MCP caller
  • create-new-only Windows file operations inside a synthetic sandbox
  • independent filesystem readback
  • permission revocation and no-replay recovery
  • Host/Origin checks and restrictive browser security headers
  • desktop and mobile browser flows tested with Playwright

Challenges

The hardest part was making the safety boundary real rather than cosmetic. The MCP client must not be able to approve its own action, choose arbitrary filesystem paths, or treat an API acknowledgement as proof of success. The design therefore separates planning, human approval, execution and verification into different stages.

Another challenge was packaging the prototype so judges can review it without exposing my private GnyPcior infrastructure, employer data, credentials or personal files.

Accomplishments

  • full local workflow tests: 11/11 PASS
  • independent fresh ZIP extraction, npm ci and full rerun: 11/11 PASS
  • real MCP initialize / tools/list / tools/call flow
  • unapproved MCP execution is refused
  • out-of-scope filesystem access is denied
  • completed tasks recover as COMPLETED_NO_REPLAY
  • desktop and mobile UI verified
  • private review package and a short demo video prepared

What I learned

The biggest lesson is that safe agentic automation is not just about asking for confirmation. The approval must be bound to the exact effect, the execution must be scoped, and the result must be verified from the real target system.

What's next

The next step is to connect this safety pattern to a judge-accessible Alexa+ experience while keeping the same human approval and verification guarantees. I also want to make the MCP surface easier for other agents to use without weakening the approval boundary.

Built With

Share this project:

Updates

Submission history