Home MCP Guardian

Ring watches the door; the family's phone decides whether it opens. It also tells you when the guardian itself has stopped — and an AI agent can only ask.

Comment

Inspiration

Caring for a parent who lives alone from far away, the failure we feared most was not "hard to use" but "we thought it was running and it had stopped long ago": a camera offline for days, a light that never came on. At the same time, AI agents are starting to operate things in the home — so who decides to open the front door? We wanted a guardian a family would actually trust: it sees the door, it knows when it has stopped, and a person always decides.

Edge first: the decision stays at home

  • The door is decided at home. The hub runs on a Mac in the home and listens on 127.0.0.1 only; the door opens only after the hub itself has verified a trusted family phone.
  • The cloud only carries messages. The AWS relay passes signed messages; the hub checks each phone's signature with the key it stored when the phone was enabled, so a compromised relay can delay an answer but cannot create an approval.
  • Face matching stays home. The optional face hint runs on the Mac; only people who agreed are enrolled, and only an encrypted feature is kept, never a photo.
  • The edge device is a real board. The home gateway is an ESP32-C3 on USB: no Wi-Fi, no credentials; it only reports a heartbeat and the parent's button.
  • The cloud watches the home in return. If the hub goes quiet, a CloudWatch alarm emails the family.

The project began as a cloud MCP chain (still deployed, earlier phase); for the front door, we moved the decision into the home.

What it does

  • Ring at the door → family phone approves. A doorbell press, a person at the door, or an AI / family request opens a banner on the admin phone with the Ring door snapshot and one-tap Ring live view. Approve within 60 seconds to open (the lock is simulated) and get a receipt; the video and snapshot are closed and dropped as soon as you decide.
  • The AI can only ask. Any MCP client calling the door tool gets "pending approval"; schedules, batches and the cloud cannot unlock. Approval is bound to the phone's own key.
  • What an AI agent may do on its own: An MCP client can immediately run low-risk actions within family-set limits (lights, the AC between 24–28 °C, and the robot vacuum during daytime hours from 08:00–20:00). Anything outside those bounds is blocked before reaching a device and logged on the timeline, and unlocking the door is always strictly a request requiring approval from a family phone.
  • Approve from anywhere. A small AWS relay (Lambda function URL + DynamoDB) only passes signed messages; the hub at home verifies each phone's signature before anything opens. The door-request email carries the link. Four scripted live runs: approval to door open in 2.4–3.2 seconds.
  • Ring webhooks for a hub behind NAT: a home hub has no public address, so Ring webhooks go to a mailbox on our AWS relay, which checks Ring's X-Signature (HMAC-SHA256 of the raw body) and drops repeats; the hub at home pulls them over its signed channel. A doorbell press becomes a door request; device_offline raises the camera-offline alert at once. Tested live with signed events in Ring's documented format (real Ring deliveries need partner credentials): 0.7–2.5 s from delivery to the hub.
  • Three layers of "it stopped" detection: the Ring camera, the home gateway, and the hub itself (an Amazon CloudWatch dead-man alarm). Real emails through Amazon SNS, only when something changes.
  • A real home gateway and a button for Mom: A Seeed XIAO ESP32-C3 board over USB sends a heartbeat to the hub every minute—if it is unplugged, the family is emailed after five minutes. A short button press logs on the family's timeline that she is okay (without sending an email), while holding the button emails the family for help. The door lock and appliances remain simulated.
  • A routine with receipts: every scheduled step ends as confirmed, not done, or cannot confirm — and missed steps wait for the family instead of being made up silently.
  • The parent hears it: the Mac speaker says what happened in short, fixed sentences; when the home has a Ring Chime, it sounds first (Chime playback API, skipped when offline or snoozed). The Playground sandbox has no Chime, so playback is tested against documented responses; finding devices and their capabilities ran on the real Ring API.
  • Daily care note: Amazon Bedrock (Claude Sonnet 4.5) writes a short note from the day's log only; if it mentions a time or number that is not in the log, the family gets a plain template instead.
  • Optional face hint, with consent: "looks like the carer" on the approval screen — a hint only; the person still decides.

How we built it

  • Home hub: Node.js with no runtime dependencies, listening on 127.0.0.1 only; an MCP server (Streamable HTTP, spec 2025-11-25).
  • Home gateway: Seeed XIAO ESP32-C3 over USB (firmware included in the repo); the hub only opens USB serial ports manufactured by Espressif.
  • Ring API (Developer Playground token): devices, device capabilities, device status, Event History, Image Snapshots, Live Video over WebRTC WHEP (the phone's browser makes the SDP offer and the hub adds the Ring token, so the token never reaches the phone). Chime playback and partner webhooks (through the relay) are built to the documented formats; the Playground offers neither, so they were tested with documented responses and signed test events.
  • AWS: Amazon SNS + CloudWatch + least-privilege IAM (CloudFormation) for family alerts and the dead-man alarm; a separate relay stack (Lambda function URL + its own DynamoDB table with TTL + a role limited to that table); Amazon Bedrock Converse (Claude Sonnet 4.5, global cross-Region profile) through the notifier's least-privilege AWS CLI profile. We reviewed CloudFormation change sets before running them.
  • Phone trust: pairing code + a macOS system dialog or the admin phone's approval with matching check digits; each phone credential is replaced on every use, and a reused one revokes the phone. Remote approval uses a non-extractable P-256 key made in the phone's browser; the hub signs with Ed25519.
  • Face hint: OpenCV YuNet + SFace on the Mac; features encrypted with AES-256-GCM; consent required, deletable, hint only.
  • Demo video narration: Amazon Polly (generative voice).

Challenges we ran into

  • Playground tokens last 30 minutes, cannot be refreshed and cannot be requested often: we made pasting one a single tap on the phone, and the hub falls back to labelled simulation when it expires.
  • Ring account linking is not available to our (Taiwan) developer account, so no real webhooks or refresh tokens: the hub polls Event History every 10 seconds, and we built a webhook mailbox on the relay (tested with signed events in the documented format) that is ready for partner credentials.
  • Playground snapshots: the image URL answered 416 until the camera had streamed once; the approval screen now suggests live view and fetches the snapshot again after it starts.
  • Letting family approve from outside without handing the door to the cloud: the cloud only relays messages signed at both ends, and the hub verifies them.
  • Adding the relay to our existing cloud API would have required a new API deployment and broken the pinned admission of our earlier cloud MCP chain, so the relay became its own small stack.
  • First use of Claude on Bedrock: Sonnet 5 was not available to our account, then the Anthropic use case form, then a one-time Marketplace subscription. We moved to the Sonnet 4.5 global profile and kept the hub's permission limited to that one model.

Accomplishments that we're proud of

  • 30 simulated days: gateway outages over 5 minutes detected 12 / 12, blips under 3 minutes 0 / 22 false alarms, 59 emails instead of 765, 7 missed routine steps all reported and 0 made up.
  • Stress test, 8 scenarios against the real server: 100 concurrent MCP unlock calls create one request; the same credential sent 20 times opens the door once; with a test relay failing 25 % of calls, remote approval made 0 wrong decisions (in the recorded run 9 of 10 were delivered; the missed one stayed locked).
  • Two rounds of independent black-box attacks (door approval, pairing), all findings fixed; 279 automated tests and the 30-day evaluation re-run in GitHub Actions on every push, failing the build if any number in the README differs from the measured results.
  • Real Ring live view playing inside the approval screen and closing itself when the decision is made; real alert and care-note emails delivered through Amazon SNS.
  • Judges can try it in two minutes with two commands and no accounts (README, top).
  • Open-sourced the webhook mailbox as its own MIT project, ring-webhook-mailbox: CloudFormation template, client, tests — for any Ring developer whose hub has no public address.

What we learned

  • "Is the guardian still running?" is a signal that must be watched too.
  • When an AI enters the home, the most important design is what it cannot do — and that has to be proven by tests.
  • Fewer, better alerts help families more: notify on change, not on every heartbeat.

What's next for Home MCP Guardian

Who it is for. Families who look after an older parent from a distance, and home-care services whose carers come to the door. Both need the same three things: a person decides who comes in, a record of who opened the door and when, and a warning when the system watching the home has stopped.

From hackathon to product:

  1. Continuous real Ring data. With Ring account linking (OAuth), switch from polling a 30-minute Playground token to webhooks and refresh tokens, so the guardian runs for months, not minutes — the step toward a Ring Appstore listing as a care companion.
  2. A real lock behind the same rule. Put the approval flow in front of a smart lock with a vendor API. The rule does not change: agents, schedules and the cloud can only ask; the hub opens only after a trusted phone's signature.
  3. An always-on hub. The hub is plain Node.js with no runtime dependencies and listens only on 127.0.0.1, so the next step is moving it from a Mac to a small always-on home computer.
  4. Low running cost. In 30 simulated days the guardian sent 59 emails — well within Amazon SNS's monthly free email allowance — plus one Bedrock note a day.
  5. For the parent at home: try the Chime announcements on a real Ring Chime (implemented; the Playground sandbox has none).

Built With

Share this project:

Updates

Submission history