NOAI

Inspiration

A voice assistant is most useful when it knows your life: your GP, your landlord, your brother's birthday. Today that means handing all of it to the assistant's cloud. NOAI keeps your notes sealed on your device and lets Alexa+ ask them questions through MCP, while treating Alexa+ as what it is: another model, on someone else's servers. The name says it: NOAI, pronounced No Eye.

What it does

NOAI is a self-hosted MCP server (Model Context Protocol 2025-11-25, Streamable HTTP) in front of an encrypted personal vault. It offers Alexa+, or any MCP client, four tools:

• ask_noai: answers questions from your notes, drafts messages, sets reminders and summarises bills
• remember: seals a new fact into the vault and sends nothing to any model
• list_reminders: upcoming reminders, redacted
• verify_disclosures: the signed log of everything that ever left the vault

Every tool result handed to Alexa+ is treated as a disclosure:

• Minimal. Alexa+ receives the answer only, never the notes behind it.
• Redacted. Phone numbers, emails, IBANs, card numbers, IP addresses and API keys stay as placeholders such as [PHONE_1]. The owner can allow a kind, for example phone numbers, so Alexa+ can read the number out; everything else stays on the device.
• Receipted. The exact text handed over is hashed with SHA-256, signed on the device with Ed25519 and chained into the same append-only ledger as the model call, with the client's name on it.

So one spoken question leaves two receipts: what the language model saw, and what the assistant was handed. In the live run in our video, "What is my GP's phone number?" sent 1,096 redacted bytes to NVIDIA Nemotron and handed 37 bytes to the assistant: "The GP’s phone number is [PHONE_1]." The real number never left the machine. The assistant in the video is simulated: a standard MCP client calling the real NOAI server, with live model answers and fictional demo data.

How we built it

• The vault is AES-256-GCM with a key derived from your passphrase by scrypt. Nothing readable sits on disk.
• Retrieval runs on the device: BM25 fused with all-MiniLM-L6-v2 as WebAssembly, so only the few passages a question needs are chosen.
• Answers come from NVIDIA Nemotron 3 Super on Nebius Token Factory, through one egress file that redacts, enforces a byte ceiling, hashes and receipts every call. A test fails the build if any other source file can reach the network.
• The MCP server is two small files with no MCP SDK: the protocol (JSON-RPC 2.0, initialize, tools/list, tools/call, ping) and a Streamable HTTP transport with a bearer token compared in constant time, an Origin check against DNS rebinding, sessions that name the client on every receipt, and a request size limit. One tool call runs at a time because the vault and ledger are single-writer files.
• It binds to 127.0.0.1 by default. Reaching it from a hosted assistant means an HTTPS tunnel the owner controls; the vault, keys and ledger never leave the machine.
• 69 automated tests, none using the network. Ten are new for MCP and run a real HTTP server: the token, origin and session locks, the placeholder staying a placeholder, reveal-by-kind, two receipts on one intact chain, and a broken chain reported to the assistant.

Challenges we ran into

• Deciding what Alexa+ should hear. NOAI's gate only ever returned the fully restored answer, because until now the only reader was the owner on their own screen. Handing that to Alexa+ would have given every private value to a second cloud. We changed the gate to keep the placeholder map on the device, so the MCP server can restore only the kinds the owner allowed.
• Citations like [P1] help on screen but mean nothing when spoken, and they point at text Alexa+ never receives, so the MCP path removes them.
• A reminder or memory the model asks for is an instruction to the device, not something to say out loud, so those lines are stripped before the handover and sealed locally instead.

Accomplishments we are proud of

• An assistant integration where the integration itself is audited: every byte Alexa+ receives is on a signed chain anyone can verify offline.
• It works with a standard MCP client unchanged. We tested it with the official MCP Inspector.

What we learned

The assistant is also a recipient. Privacy work usually stops at the model provider; with voice assistants there is a second hop, and it deserves the same minimisation and the same receipts.

What's next

• Recognising names on the device so they can be withheld like numbers.
• OAuth 2.1 for the MCP endpoint, replacing the static token.
• A one-command tunnel setup for connecting a home machine to Alexa+.

Built With

• alexa-plus
• model-context-protocol
• nebius-token-factory
• node.js
• nvidia-nemotron
• onnxruntime-web
• streamable-http
• typescript
• webassembly
• webcrypto