Inspiration
Millions of adult children live far from their aging parents. In India, the parent is often in Jaipur or Lucknow while the child works in Bengaluru, Pune or abroad. The pattern is familiar:
- Parents forget the evening pill.
- They play down symptoms so they "don't worry anyone".
- The family finds out when something has already gone wrong.
Phone apps don't solve this, because many elders won't use them. But they will talk. We wanted the parent's whole interface to be a sentence, and the family's to be a calm answer to "How's Mom doing today?", plus an alert the moment it matters.
What it does
KinLoop is an Alexa+ add-on: one self-hosted MCP server with two voices.
The parent, at home:
- "What do I need to do today?" Today's medicines with times and status, appointments, and family messages. On an Echo Show, an MCP Apps card shows the same plan.
- "I just took my blood pressure pill." Matched to the right scheduled dose (Amlodipine). Saying it twice never double-counts.
- "I'm feeling okay, slept badly." A mood and sleep check-in.
- "I'm feeling dizzy and I nearly fainted." Fixed safety rules, not AI, check for chest pain, breathlessness, a fall, fainting, confusion and stroke signs. A red flag alerts the family immediately, and Alexa tells the parent to call 112 or 911.
- In Hindi too: "मुझे सीने में दर्द हो रहा है" (chest pain) triggers the same rule.
- "You have about 4 days of Metformin left. I've let Arjun know." Each logged dose counts down the supply.
The family, from their own Alexa or the dashboard:
- "How's Mom doing today?" Urgent alerts first, then doses taken or missed, mood trend, refills, and a short daily summary.
- "I'm calling her now." The alert is marked handled, and the parent's Alexa tells her "Arjun has seen your alert." The loop closes on both sides.
- "Tell Mom I'll visit on Sunday", and "Add Metformin 500 mg at 8 PM for Mom", which is always read back and confirmed first.
Rules decide. The AI only writes.
How we built it
- MCP server (TypeScript, official MCP SDK). Built on the 2025-11-25 spec over Streamable HTTP, and fully stateless: a fresh server per request, JSON responses, no session IDs. The household context comes from the OAuth token.
- 10 tools. Each has precise descriptions, Zod-validated inputs and correct
readOnlyHint/destructiveHint/idempotentHintannotations. - Spoken output. Every result returns
structuredContentplus a spokencontenttext of the same facts. Invalid input comes back as a short spoken question, never a stack trace. - Alexa+ compatibility. A test sends the exact
initializeAlexa+ uses and checks it negotiates2025-03-26.
- 10 tools. Each has precise descriptions, Zod-validated inputs and correct
- Account linking. A small OAuth 2.1 authorization server built into the app:
- authorization code with PKCE (S256 only), the
resourceparameter, and the RFC 9728 and RFC 8414 metadata documents; - rotating refresh tokens, with tokens and codes stored only as SHA-256 hashes;
- a bare
401with noWWW-Authenticateheader, as Alexa+ requires.
- authorization code with PKCE (S256 only), the
- Rules engine. Pure functions with 100% line, branch and function coverage:
- a missed dose gets a reminder at +60 min and a family alert at +120 min;
- no check-in by 11 AM, three low-mood days in a row, a red flag, or a low supply each trigger an alert;
- alerts are deduplicated per incident;
- red flags are detected in English, Hinglish and Devanagari, including Hindi's trailing negation ("dard nahi hai" is not a red flag).
- AWS (AWS Builder), deployed with one SAM command:
- Lambda behind a Function URL serves the MCP server, OAuth, the REST API and the web app.
- DynamoDB is a single table with conditional writes for idempotency and TTL for retention.
- EventBridge Scheduler runs the rules every 10 minutes.
- SNS delivers email alerts.
- SSM Parameter Store holds secrets.
- Amazon Bedrock (Converse API) writes the family summary, Claude first with Nova as fallback, in an async Lambda so the voice path never waits on a model.
- Latency. Alexa+ requires answers in under 500 ms. Measured from CloudWatch on DynamoDB:
$$p_{95}^{\text{server}} \in [17,\ 68]\ \text{ms} \ll 500\ \text{ms}$$
- Demo client. A simulated Alexa+ client is a real MCP client over HTTP with OAuth tokens, using Bedrock tool use. It has speech in and out, a split screen ("Kamala's kitchen" and "Arjun in Bengaluru"), and a trace of every tool call with its latency.
- Quality. 69 rules tests, 65 integration tests and 5 Playwright browser tests, all run by GitHub Actions on every push.
Challenges we ran into
- An LLM missed a Hindi chest-pain report. In our final live run, the orchestrating model answered "मुझे सीने में दर्द हो रहा है" with "Okay." and called no tool. So the deterministic red-flag rules now check the parent's words before any model runs. No model can stand between "chest pain" and the family.
- An LLM told the family something false. Nova Lite wrote that a dose was missed when it was only due. Every AI summary now passes a deterministic check before anyone hears it: no false "missed" claims, no unknown medicines, no medical advice, no dropped red flags. In production, it rejected the false sentence and the accurate fallback summary went out.
- The first authenticated call failed with 415. On AWS Lambda, every MCP call failed even though all local tests passed. The Lambda adapter left
rawHeadersempty, so the MCP transport saw noContent-Type. We fixed it and added a test that replays a real Lambda Function URL event. - Elicitation vs. statelessness. Alexa+'s documented client doesn't advertise elicitation, and a stateless server can't receive mid-call replies. Destructive changes therefore use a two-step preview followed by
confirm: true. - Access gates. Our new AWS account needed hours of verification, the project is locked to one region (ap-southeast-2), the Claude model needs a use-case form, and we couldn't get the Alexa AI CLI during the event. Our simulated Alexa+ client drives the same deployed MCP server, and the add-on manifest is ready to deploy. All 14 issues are documented in our friction log.
What we learned
- Voice tools need two outputs: structured facts for the model, and a sentence a person actually wants to hear.
- Statelessness pays off. The token is the context, which made scaling and security simple.
- LLMs belong where tone matters, not where liability lives. Every time we let a model decide something, it eventually got it wrong. Every time a rule decided, the tests proved it right.
What's next
- Spoken Hindi replies, then Tamil, Bengali and Marathi.
- Pharmacy ordering from the refill countdown, with one confirmation.
- Ring integration for fall and doorbell context, with consent.
- Proactive announcements on the family's own Echo when Alexa+ supports them.
KinLoop is not a medical device and does not replace emergency services. The demo household is fictional.
Built With
- alexa
- amazon-bedrock
- amazon-dynamodb
- amazon-eventbridge-scheduler
- amazon-nova
- amazon-sns
- aws-lambda
- aws-sam
- aws-ssm
- claude
- express.js
- github-actions
- mcp-apps
- model-context-protocol
- next.js
- node.js
- oauth2
- playwright
- react
- typescript
- vitest
- zod
Log in or sign up for Devpost to join the conversation.