Hearth: an Alexa+ caregiving co-pilot

Hearth is a self-hosted MCP server that turns Alexa+ into a shared memory and early-warning system for families caring for an aging parent. It listens, spots changes, and asks before it alerts.

Comment

Inspiration

More than one in five American adults is an unpaid family caregiver, and many of them do it from far away. Care for an aging parent ends up spread across pill organizers, sticky notes, fridge calendars and group texts. Nobody has the whole picture, and the person with the most information, the parent, is the one least likely to open an app.

But she will talk to the speaker in her kitchen. We wanted Alexa+ to become the shared memory between a parent and the family looking after her. She just talks, the family just asks, and nobody has to remember everything alone.

What it does

Hearth is a self-hosted MCP server (spec 2025-11-25, Streamable HTTP) that gives Alexa+ a caregiving memory for one household.

  • Mom just talks. "Did I take my pills?", "I just took my lisinopril and metformin", "My knee hurts on the stairs, maybe a 7." Hearth logs each dose against her schedule, keeps count of what's left, and compares every check-in with her own recent baseline.
  • It asks before it alerts. If a check-in mentions a fall, dizziness, chest pain or confusion, the tool uses MCP elicitation in the middle of the call to ask "Should I alert Sarah right away?". On a yes, Sarah's phone buzzes (ntfy.sh push or any webhook). Nothing is ever sent without a yes, and clients without elicitation get a read-back-and-confirm fallback.
  • The family catches up. From her own home, Sarah asks "How has Mom been doing this week?". Alexa answers out loud, and on screen devices Hearth renders an MCP App card with adherence, pain, sleep and mood trends, missed doses, refills running low, and appointments that still need a driver.
  • It coordinates rides. Booking an appointment triggers a titled-enum elicitation, "Who can drive Margaret?", then records the answer and notifies the driver.
  • One household, every device. Every Echo, phone and family member shares one store, so what Mom says at 8 am is in her daughter's 9 pm digest.

Hearth is built for the Alexa+ MCP Toolkit: OAuth 2.1 service tokens, account linking with PKCE behind a household PIN, RFC 9728 Protected Resource Metadata, and tool calls under the 500 ms budget. The repo also includes a simulated Alexa+ Echo Show with voice in and out, an MCP Apps host, elicitation answered by tap or voice, and a live MCP trace, so anyone can try it without hardware.

How we built it

  • Server: TypeScript on Node 22+, run directly with Node's type stripping (no build step), using the official @modelcontextprotocol/sdk 1.32.1 and a shared node:sqlite store.
  • Transport: Streamable HTTP with one McpServer per session over the shared store, so an elicitation reaches the device that asked. It also handles GET SSE streams, DELETE teardown, Origin validation against DNS rebinding, and CORS for browser clients.
  • MCP features: tools with structuredContent and annotations, form-mode elicitation (boolean, string and titled-enum oneOf), resources and a resource template with completion, prompts, logging notifications, server-pushed notifications/message for reminders, and an MCP App at ui://hearth/digest.
  • Concern detection: each check-in is compared with Mom's own 7-day average, so a pain score 3 or more points above her usual level gets flagged even if it would be normal for someone else. Red-flag words (a fall, chest pain, confusion) and high pain scores mark it urgent and trigger the "should I alert Sarah?" elicitation. Low mood, very short sleep and repeated missed doses add it to the family digest.
  • Proactive layer: a minute-by-minute scheduler for overdue-dose reminders and the weekly summary, an event hub that pushes to every connected session, a token-protected care-team inbox (POST /inbox/notes, accepting JSON or inbound-email form posts), and email through Resend or ntfy's email forwarding.
  • Alexa+ auth: a built-in OAuth 2.1 authorization server shaped to the toolkit: service and user scopes, PKCE S256, single-use codes, rotating refresh tokens, PIN-gated consent with lockout, and speaker identity carried in the token.
  • Simulator: Express plus vanilla JS, the Web Speech API, an MCP Apps postMessage host, and Claude as the agent loop over a real MCP client session. It also has a scripted playback mode, so judges can run it without an API key.
  • Quality: 41 automated tests, including reminder stages on a simulated clock, the care-team inbox, the weekly email, speaker identity, an Alexa+-shaped OAuth contract test, a latency budget test, and end-to-end MCP over HTTP with elicitation accept and decline.

Built during the hackathon

Hearth and mcp-http-probe are new projects, started during the submission window (Aug 31 – Oct 23, 2026). The first commit is dated 2026-10-12, and the full history is public in the repo.

Open-source contribution: mcp-http-probe

Along the way we built mcp-http-probe, a dependency-free conformance checker for any Streamable HTTP MCP server. It runs 23 black-box checks (Accept negotiation, Origin 403, session-ID rules, 202 for notifications, MCP-Protocol-Version 400, session 404, GET SSE or 405, DELETE teardown and more), and each failure links to the relevant spec section. It's on npm and the GitHub Marketplace as uses: Chinmay-92/mcp-http-probe@v1. Hearth passes all 23 checks.

Challenges we ran into

  • Getting elicitation to the right device. A single global server sent prompts to the wrong session. The fix was one McpServer per session over a shared household store.
  • A security default that breaks the spec. The SDK's Streamable HTTP transport ships with Origin validation off, even though the spec says servers MUST validate it. We added our own guard and then built the probe so nobody else ships this by accident.
  • Alexa+ and the MCP spec disagree on 401s. The toolkit wants a bare 401 to start account linking, while MCP 2025-11-25 requires WWW-Authenticate. We chose Alexa+ and kept RFC 9728 metadata discoverable at the well-known path.
  • The 500 ms budget. Keeping every tool call fast meant moving alert delivery into the background and adding a latency test to CI.
  • MCP Apps spec ambiguity. The examples name the handshake both initialize and ui/initialize, and two resourceUri keys are in use, so we support both.

Accomplishments that we're proud of

  • An agent that asks permission before escalating, using elicitation exactly the way it was designed: in the middle of a tool call, with the user in control.
  • One server that serves a voice-only grandparent and a screen-first adult child, each with the right interaction.
  • An open-source tool that found a MUST-level violation in a server built from the standard SDK example on its first run.

What we learned

  • Elicitation turns an MCP tool from "do the thing" into "check with a human first", which matters most when the thing is "alert the family".
  • SDK tests verify the SDK, not your deployment. Real breakage lives in the glue: session maps, auth middleware, proxies and default security settings.
  • Voice-first design is mostly about what not to say. Answers have to be short and specific, with the detail saved for the screen.

What's next for Hearth

  • Reminders straight to the Echo. Today an overdue-dose reminder reaches screens connected to Hearth and the family's phones. Once Alexa+ lets an MCP add-on push to a linked Echo, Mom will hear it in her kitchen.
  • Speaker identity from Alexa+ itself. Hearth asks "Who uses this Alexa?" at account linking. With voice-profile identity passed through to MCP servers, a shared Echo would know whether Mom or a visiting son is speaking.
  • Real care-team integrations. Connect the inbox to patient-portal messages and pharmacy refill notices, so the family sees them without forwarding anything.
  • More caregivers, more households. Let a family manage two parents, and add paid carers with limited permissions.
  • mcp-http-probe upstream. Run it against more public MCP servers and send fixes back, starting with Origin validation on by default in the TypeScript SDK.

Built With

Share this project:

Updates

Submission history