HawkAI

The Bloomberg Terminal for teams that can't afford Bloomberg. Type a name -- HawkAI autonomously investigates financial crime risk and delivers a scored report in under 4 minutes.

Comment

Inspiration

Every business — before signing a contract, onboarding a vendor, or wiring money — needs to answer one question: can we trust who we're dealing with?

Large banks pay $50,000–$500,000/year for tools like Refinitiv World-Check to answer that question. Small businesses? They Google the name and hope for the best.

I wanted to build something that gives every business — not just enterprises — the power of a seasoned compliance analyst, available instantly.

What it does

HawkAI is an autonomous KYC/AML intelligence terminal. You type a name — a company, person, or fund. The agent takes over from there.

It runs a 6-step investigation pipeline autonomously:

  1. Web Research — searches the internet across multiple targeted queries using live Google Search grounding (sanctions, adverse media, corporate structure, ownership, jurisdiction)
  2. Entity Profiling — extracts and structures everything discovered (type, addresses, identifiers, aliases, directors, shareholders) and stores it in MongoDB Atlas
  3. Vector Correlation — runs 768-dimensional vector similarity search using Atlas $vectorSearch to surface semantically similar risk profiles already in the database
  4. Correlation Analysis — queries MongoDB to find entities sharing directors, addresses, or identifiers
  5. Risk Signal Classification — Gemini 2.5 Pro identifies and categorizes specific risk signals across 8 categories: Governance, Fraud, Sanctions, Financial, Regulatory, Litigation, Reputation, Other
  6. Risk Synthesis — Gemini 2.5 Pro reasons across all findings and produces a structured report: risk score (0–100), risk level (CRITICAL / HIGH / MEDIUM / LOW), analyst confidence, key findings with cited evidence, and recommended compliance actions

Beyond single investigations, HawkAI also supports:

  • Batch screening — comma-separate multiple names to queue simultaneous investigations
  • Entity Relationship Network — a force-directed graph (CORRELATIONS tab) connecting all investigated entities by shared risk signal categories, letting analysts see the full risk landscape at once
  • Watchlist alerts — star any entity to watch it; a live badge appears when watched entities hit HIGH or CRITICAL risk
  • PDF export — full multi-page compliance reports exported with one click
  • Light and dark mode — analyst preference, persisted across sessions

Every investigation is stored in MongoDB Atlas. The database grows smarter with every entity investigated, building institutional knowledge over time.

How I built it

Agent Framework: Google ADK 2.0 with a SequentialAgent orchestrator (ScoutOrchestrator) that runs two specialized sub-agents in sequence:

  • ResearchAgent — uses ADK's built-in Google Search tool exclusively. ADK does not allow mixing built-in tools with custom tools in the same agent, so research is isolated here.
  • IntelligenceAgent—uses 7 custom async Python tools: lookup_entity_via_mcp (entity pre-check via MCP Server), check_ofac_sanctions (screens against OFAC SDN list — 17,557 US Treasury sanctioned entities — via MCP Server), extract_and_store_entity, run_vector_similarity_search, find_correlated_entities, classify_and_store_signals, synthesize_risk_report.

Models:

  • gemini-2.5-flash — agent orchestration and tool calling (fast, supports live Search grounding)
  • gemini-2.5-pro — signal classification and final report synthesis (highest reasoning quality)
  • gemini-embedding-001 — produces 768-dimensional entity embeddings for vector search

Database: Database: MongoDB Atlas M0 with four collections (investigations, entities, risk_signals, sanctions_lists) and an Atlas Vector Search index on entities.embedding (768-dim cosine similarity).

Backend: FastAPI with async Motor driver. Every agent event — tool calls, step transitions, text output, snapshots — is pushed to the frontend via Server-Sent Events in real time. Nothing is polled.

Frontend: Next.js 14 with TypeScript. The Bloomberg Terminal-style UI (JetBrains Mono, amber-on-ink palette) shows a live pipeline tracker, dossier vault, entity relationship network graph (pure JavaScript force simulation, no D3), signals library, and watchlist alerts — all driven by SSE.

Deployment: Backend on Google Cloud Run (us-central1, min-instances=1 to eliminate cold starts). Frontend on Vercel with automatic deploys from GitHub.

Challenges

The hardest architectural decision was the ADK constraint: Google Search (built-in tool) cannot share an agent session with custom function tools or MCP tools. This forced a proper two-agent design — which ultimately made the system more robust, but required scrapping the initial single-agent architecture entirely.

The MongoDB MCP Server presented a real production challenge: stdio subprocess lifetime is not guaranteed in Cloud Run's serverless environment. The solution was a dual-driver architecture — lookup_entity_via_mcp uses ADK MCPToolset with the pre-installed mongodb-mcp-server binary for entity lookups and capability enumeration at the start of each investigation, while Motor handles all write operations (upserts, inserts, updates) where atomic guarantees matter. The MCP subprocess is wrapped in an 8-second timeout with automatic Motor fallback if Cloud Run terminates the child process.

A second MCP tool, check_ofac_sanctions, queries the pre-loaded OFAC SDN database (17,557 US Treasury sanctioned entities stored in a dedicated sanctions_lists collection) at the start of every investigation — providing authoritative sanctions ground truth rather than relying on model inference alone.

Tuning the risk synthesis prompt to produce consistent structured output without hallucinating signals took the most iterations. The final prompt explicitly instructs the model to only report signals with direct cited evidence (dollar amounts, dates, regulatory bodies, case numbers).

Building the entity network graph without D3 required implementing a full force-directed simulation in plain JavaScript — Coulomb repulsion, Hooke springs, center gravity, velocity damping — running 250 synchronous iterations before first render to produce a stable layout.

What I learned

ADK's multi-agent constraint is actually good architecture. Separating web research from database operations forced clean separation of concerns — each agent has a focused, unambiguous instruction set.

MongoDB's flexible document model is genuinely the right choice for entity data. Every entity type (company vs person vs fund) has completely different fields that would require painful schema gymnastics in a relational database.

The hardest part of building an intelligence agent is not the AI — it is making the output trustworthy and the demo reproducible.

What's next for HawkAI

  • Continuous Monitoring — instead of one-off investigations, HawkAI watches entities you have already cleared and re-triggers automatically when new adverse media, sanctions updates, or ownership changes are detected. A clean entity today can be a risky one tomorrow.
  • Structured Data Sources — expanding beyond the OFAC SDN list (already integrated — 17,557 entries) to include SEC EDGAR enforcement actions, OpenCorporates registry data, and Companies House filings for authoritative ground truth across all signal categories.
  • SMB Compliance API — flat monthly pricing, no enterprise contracts, no compliance team required. Institutional-grade due diligence accessible to any business.

Built With

  • atlas-vector-search
  • docker
  • fastapi
  • gemini-2-5-flash
  • gemini-2-5-pro
  • google-adk
  • google-cloud-run
  • google-search-grounding
  • mongodb-atlas
  • mongodb-mcp-server
  • motor
  • next-js
  • ofac-sdn
  • pydantic
  • python
  • react
  • server-sent-events
  • typescript
  • vercel
Share this project:

Updates