Hold On

A money-safety add-on for voice assistants: when an older adult asks to pay, it checks the request against official scam guidance and asks a trusted family member before risky or large payments.

Comment

The problem

In its 2025 annual report, the FBI's Internet Crime Complaint Center counted 201,266 complaints from people aged 60 and over, with $7.748 billion in reported losses, up 59% from 2024. The official advice is short and consistent: the FTC says to "stop and talk to someone you trust", and the CFPB recommends choosing a trusted contact person.

A voice assistant that can pay for things is where that pause should happen, and where it is easiest to skip. "Buy four $500 gift cards" is a sentence an assistant can simply carry out.

What Hold On does

Hold On is a self-hosted MCP server with an Agent Skill. An assistant calls it whenever a request would move money, or whenever someone says a caller is demanding payment.

  1. Check. The request is compared with 12 scam patterns (gift card demands, government impersonation, "keep it secret", crypto ATMs, bail emergencies, tech support, and others). Each pattern carries the official guidance it comes from: source URL, quotation, and the date it was read.
  2. Verify. The payee is compared with a registry of 11 official payees (IRS, Social Security, Medicare, USPS, FTC and six large utilities): official domains and, where on file, phone numbers and the payment methods each one accepts or never uses.
  3. Hold. Unless the payee is confirmed, the amount is under the family's limit and there are no warning signs, the request is put on hold and a trusted family member is notified. They see the context and decide in their own assistant, on an MCP Apps card, or on a plain web page.
  4. Pay. Only an approved request to a confirmed payee is paid. Payments are simulated; no real money moves.

Three choices shape how it behaves:

  • Verdicts come from rules and a registry, never from a model's guess. The rule engine is a pure function, and "not in the registry" is a valid answer.
  • Nothing actionable from a suspicious message reaches the older adult. Phone numbers and links supplied by a caller are never shown on their screen or put in what Hold On gives their assistant to say, and the Agent Skill tells the assistant never to repeat them. They only ever get registry-verified official contact details.
  • The decision moves to the trusted contact, per the family's policy. The older adult's cards have no approve button and no links. Gift cards or cryptocurrency to a government agency or utility are always blocked, and the family cannot switch that off.

The wording matters as much as the logic. Every sentence Hold On gives a person to hear is written out in advance, in its code, rules and registry, and none of it blames the person: the request is the problem.

The demo

The video shows three requests from "Margaret" on a kitchen display, with her daughter "Sarah" on a phone:

  • An IRS gift-card demand. Stopped. Sarah's card lists the reasons one per line, the FTC and IRS ones with their sources, and offers only "Deny".
  • A genuine electric bill. The payee is confirmed, the amount is over the family's limit, Sarah approves, and Margaret's assistant tells her it can pay.
  • A roofer's deposit. Not in the registry, so the honest answer is "I can't confirm who they are"; Sarah can vouch for a payee she knows.

How it was built

  • MCP server: TypeScript on the v2 MCP SDK. It negotiates protocol 2025-11-25 over Streamable HTTP with sessions, and serves the same tools statelessly for 2026-07-28. Twelve tools, eight for the older adult's assistant and four for the trusted contact's, all with outputSchema, structured content and annotations.
  • MCP features in real use: form elicitation (one safety question when a key detail is missing, with a spoken fallback), progress notifications while waiting for the family's decision, tool execution errors with actionable messages, and three MCP Apps cards.
  • Agent Skill: skills/holdon-money-safety/SKILL.md tells an assistant when to call Hold On and how to speak about it.
  • Data with sources: registry/payees.json and rules/scam-patterns.json. A script re-fetches every cited page and checks that each quotation is still there.
  • Tests: 317 (run on 2026-10-12), including a raw initialize request that asserts the negotiated protocol version.

What was hard

No Alexa+ developer tooling was available to hackathon participants, so there was nothing to test a voice-and-screen experience against. We built the missing piece as a separate open-source tool (Voicestage, below) and tested Hold On in it: two devices, two people, voice, cards, and events that arrive later.

Three of the friction-log entries that cost us the most:

  • The track's minimum revision loses elicitation under the SDK's default HTTP handler. createMcpHandler serves 2025-11-25 clients without sessions, so a server cannot ask the user a question. We route 2025-era traffic to sessionful transports ourselves (F-01).
  • MCP has no message for telling a person something when no request is in flight. "Sarah denied it" has to reach Margaret's kitchen display on its own. Both projects carry a second channel beside MCP for that (V-03).
  • A web host for MCP Apps must use a sandbox proxy on a second origin, and the package ships none. We first shipped a host that did not conform, then wrote the proxy (V-02).

What it does not do

Hold On is a demonstration. Payments are simulated, authentication uses fixed demo tokens, notifications are Server-Sent Events and a webhook (no SMS or email), and the registry covers 11 payees. Matching is rule-based, so wording outside the patterns can be missed. Nothing here is a claim about how the real Alexa+ runtime behaves.

What is next

OAuth 2.1 as described in the MCP authorization specification; real notification channels; a registry maintained from official sources at scale; and, in place of the simulated receipt, the host platform's own purchasing capability with Hold On as the gate.

Built With

Share this project:

Updates

Submission history