HearthMCP: Identity-Aware Alexa+ Agent Layer

Inspiration

Smart speakers like Amazon Echo sit in the central hub of our homes—the kitchen,

living room, and family spaces. In these shared environments, parents, teenagers, children, and visitors all share the exact same microphone.

With the emergence of agentic voice assistants powered by **Alexa+** and tool-

calling protocols like the Model Context Protocol (MCP), this shared environment introduces three critical vulnerabilities: 1. Acoustic Privacy Leaks: Alexa+ speaks order histories and calendar events out loud to anyone within earshot—routinely spoiling surprise birthday gifts or reading aloud sensitive personal notes. 2. The Voice PIN Security Hazard: Authorizing high-risk actions (purchases or unlocking smart deadbolts) through 4-digit spoken voice PINs is flawed: children overhear and memorize them, and they are vulnerable to acoustic replay. 3. The MCP Multi-User Void: Standard MCP servers expose every tool indiscriminately to the connected agent without caller-level authorization boundaries or role-based access control.

We built **HearthMCP** to solve this: an identity-aware, self-hosted MCP server

for Alexa+ that enforces fine-grained household access control, dynamic data shaping, and dual-channel out-of-band authorization.

---

## What It Does

HearthMCP acts as a secure, ambient-first mediation gateway between Alexa+ and

your smart home:

* **Call-Time Cedar Authorization:** Evaluates every incoming `tools/call`

against declarative AWS Cedar policies. Rather than failing cryptically, unauthorized calls return structured verbal explanations (isError: true) so Alexa+ politely explains why an action cannot be completed. * Dual-Channel Out-of-Band Approval: High-risk actions—such as a teenager attempting to unlock a smart deadbolt or placing an order exceeding the \$25 household limit—are escrowed into a pending state. A push approval request is dispatched to the parent's device, completely eliminating spoken PINs. * Role-Based Data Shaping: Sanitizes tool responses before they are returned to Alexa+. Secret gifts (isGift: true) and confidential calendar notes are automatically filtered out for non-parent callers. * Tamper-Evident Audit Logging: Every voice invocation, authorization decision, parameter hash, and policy evaluation is recorded to an append-only, token-scrubbed SQLite audit log.

---

## Mathematical & Security Invariants

HearthMCP models access decisions and data protection mathematically using formal

policy semantics:

### 1. Default-Deny Policy Evaluation
Let $\mathcal{P}$ be the set of principals (household members), $\mathcal{A}$ the

set of tool actions, $\mathcal{R}$ the target resources, and $\mathcal{C}$ the invocation context. Every request tuple $(p, a, r, c) \in \mathcal{P} \times \mathcal{A} \times \mathcal{R} \times \mathcal{C}$ is evaluated by the Cedar WASM engine:

$$\text{Decision}(p, a, r, c) = \begin{cases} 
\text{Allow} & \text{if } \exists \pi \in \Pi_{\text{permit}} \text{ satisfied}

\;\land\; \neg \exists \phi \in \Pi_{\text{forbid}} \text{ satisfied} \ \text{Deny} & \text{otherwise (fail-closed)} \end{cases}$$

### 2. Privacy Data Shaping Invariant
Let $\mathcal{O}$ be the set of order items returned by the commerce engine. The

shaping function $\mathcal{S}(\mathcal{O}, \text{role})$ guarantees that unprivileged household roles never receive gift metadata:

$$\forall o \in \mathcal{O}, \quad \Big(o.\text{isGift} = \text{true} \;\land\;

\text{role} \neq \text{Parent}\Big) \implies o \notin \mathcal{S}(\mathcal{O}, \text{role})$$

### 3. Voice Turn Latency SLA
To prevent Alexa+ voice interaction timeouts, the total pipeline latency budget

is constrained to:

$$\mathbb{P}\left(T_{\text{ingress}} + T_{\text{auth}} + T_{\text{cedar}} +

T_{\text{actuation}} + T_{\text{shaping}} \le 500\text{ ms}\right) \ge 0.95$$

In our benchmarks, in-process Cedar WASM evaluations completed in $p_{99} <

10\text{ ms}$, with total end-to-end response times under $120\text{ ms}$.

---

## How We Built It

HearthMCP was architected from the ground up for low-latency, deterministic

security:

* **Ingress & Transport:** Built with **Node.js 22 LTS** and **Fastify**,

implementing the Model Context Protocol over Streamable HTTP and Server-Sent Events (SSE) at /mcp. * Policy Engine: Integrated AWS Cedar via @cedar-policy/cedar-wasm, compiling Rust policy evaluation to WebAssembly for sub-millisecond, in-process authorization without external network hops. * Authentication & Identity: Implements OAuth 2.1 Bearer token validation and RFC 9728 discovery. When an unauthenticated caller connects, HearthMCP returns an HTTP 401 (suppressing WWW-Authenticate per Alexa+ specification) to prompt the Alexa companion app linking flow. * Storage & State: Single-file SQLite running in Write-Ahead Logging (WAL) mode (better-sqlite3), managing identity tables, approval escrow queues, and tamper-resistant audit logs. * Interactive UI & Admin Portal: * /admin: Real-time dashboard for parents to approve/deny pending escrow requests and inspect audit logs. * /simulator: Multi-role interactive voice tester allowing one-click switching between Parent, Teen, and Guest personas. * Verification Harness: Engineered a catalog oracle test suite (IAA001 to IAA010) using Vitest to rigorously test permissions, edge cases, and load performance.

---

## Challenges We Ran Into

1. **Alexa+ Tool Caching vs. Dynamic Roles:** Alexa+ inspects MCP tool manifests

during skill initialization and caches them indefinitely. We could not simply hide tools at registration time based on who is speaking. We solved this by registering all capabilities and moving policy checks to call-time evaluation, returning structured isError: true payloads containing conversational reasons that Alexa speaks naturally. 2. The Alexa+ 401 Handshake: Standard HTTP specs expect a WWW-Authenticate header with 401 Unauthorized responses. However, the Alexa+ client runtime strictly requires the omission of this header to trigger its native companion app account linking screen. 3. Zero-Overhead Policy Compilation: Running Cedar policy checks on every voice turn could easily introduce acoustic lag. Compiling AWS Cedar to in-process WebAssembly avoided microservice network overhead and brought policy decision latency under 10 ms.

---

## Accomplishments That We're Proud Of

* **Eliminating Spoken Voice PINs:** We replaced an outdated, eavesdroppable

authentication mechanism with an asynchronous, out-of-band mobile approval queue. * True Multi-Occupant Household Privacy: Prevented surprise gifts and private schedule details from ever being broadcast aloud across a living room. * 100% Deterministic Policy Verification: Successfully implemented and passed 10 complete behavioral catalog oracle tests covering everything from RFC 9728 discovery to high-concurrency burst workloads. * Lightweight Footprint: Entire stack runs in a self-hosted distroless container with steady-state memory usage under 128 MB.

---

## What We Learned

* **Ambient Voice is Different from Chatbots:** Traditional LLM chat agents

assume a 1:1 private screen interaction. Ambient voice assistants are broadcast devices in physical spaces—security and privacy must be enforced at the tool boundary, not trusted to model prompts. * Declarative Policies Beat Code Logic: Using AWS Cedar rather than sprawling if/else checks makes access policies readable, formally verifiable, and instantly auditable by household admins.

---

## What's Next for HearthMCP

* **Push & Wearable Notifications:** Integrating WebPush and Apple Watch/WearOS

quick-action buttons for 1-tap parental approvals. * Acoustic Voice Print Integration: Mapping Alexa Voice Profiles directly into verified MCP caller identity tokens. * Hardware Security Keys: FIDO2 / WebAuthn passkey support for approving high-value transactions.