Inspiration
Most people have gotten the text: "Your account will be locked! Verify now." Some are scams, some are real, and only few can tell. The T-Mobile track wants us to make the general population feel safer online. Our app Nemo Proxy is built exactly for that. NemoProxy investigates a suspicious text and explains its evidence and uncertainty, not just a verdict. Four scenarios: a carrier-billing phish, a clinic reminder, a package text, or an adversarial message ordering a revocation, refused, zero actions proposed. A Nemotron agent investigates with bounded tools and returns a validated assessment, concern, evidence, unknowns, recovery steps. No invented scores; out of budget, it says incomplete. Then a sandbox demo: test the protected account (200), simulate a compromise, hit "Protect demo account," the backend revokes that session, and the same credential gets a 401. Simulated fixtures are labelled; a bad message is never proof a session was stolen.
How we built it
A FastAPI backend runs a Nemotron investigator with a bounded tool loop (6 rounds). Assessments are validated, with a retry for misstated provenance. Tool text is untrusted: injection can't authorize actions, and the model can propose a revocation but never approve it. SpacetimeDB holds versioned investigations, evidence, sessions (hash only), and actions with receipts; only the backend writes verdicts. The React frontend shows Investigator and Customer views synced by a SpacetimeDB subscription. Redaction runs before any third-party call; a failed service means inconclusive, never fabricated.
Challenges we ran into
Going live fought back. Our first key was a placeholder (401), and our model had moved endpoints (410). Worst was subtle: response_format: json_object suppresses tool calling, so the model fabricated tool results as prose, now only on final-answer turns. The model also called our labelled simulated fixture a live Web Risk flag, fixed in three layers: wording, a prompt rule, a server check. The UI gave up polling at 30 seconds while live runs take 34–63.
Accomplishments that we're proud of
Live end to end: real Nemotron investigations on every scenario, the injection refused with zero actions, and a six-step revocation - 200 before, 401 after, with a receipt. Phase C passes 30/30. A verdict is only as honest as its grounding, and receiving a phishing message and having a session stolen are two different claims an interface must separate.
What's next for Nemo Proxy
Live Web Risk reputation to replace the simulated fixture, faster streamed investigations, more scenarios, and a path toward real carrier hooks under the same honesty rules.
