Safeshop

Your AI online-shopping fraud investigator. We instantly analyze suspicious websites, social media sellers, and fake reviews to break the online shopping scam chain before you lose money.

Comment

Inspiration

The explosion of social commerce has brought a massive wave of online shopping fraud. Millions of people buy directly from Instagram pages or WhatsApp stores, completely bypassing the safety nets of traditional e-commerce platforms. After hearing so many cases of such fraud from friends and family alike, I decided to take action.

When I looked at existing tools like Google Safe Browsing or standard URL checkers, I realized they only catch a fraction of the problem. They check domains, but they can't tell you if an Instagram handle with 10k followers is actually a throwaway scam account, or if a product's 5-star reviews were all generated by bots in the last 48 hours. With over $2 billion lost to online shopping scams annually, I wanted to build a "second opinion" for the internet which was an AI investigator that breaks the entire fraud chain before the user ever hits "pay."

What it does

SafeShop is a conversational AI agent that investigates online merchants on your behalf. You simply paste a website link, an Instagram handle, a product URL, or a tracking number.

The agent then steps through a series of checks:

  1. Domain Intelligence: Checks WHOIS data and SSL certificates for throwaway domains.
  2. Social Shop Scanner: Validates Instagram sellers against heuristics and our community database.
  3. Review Authenticity: Analyzes product reviews for burst-posting and generic AI-generated language.
  4. Delivery Guard: Validates tracking numbers and spots post-purchase fraud.

Most importantly, SafeShop features Community Memory. Every scan and victim report is logged in MongoDB. If one person reports a scam, the next person to ask about that seller is instantly warned.

How I built it

I built SafeShop using the following architecture:

  • Frontend: A responsive Next.js 16 single-page application styled with Tailwind CSS, hosted on Google Cloud Run.
  • Agent Core: Google Cloud Agent Platform powered by Gemini 1.5 Pro.
  • Tooling (MCP Server): Built a combined FastMCP server in Python that connects Gemini to external APIs (WHOIS, Safe Browsing, AfterShip).
  • Database: MongoDB Atlas acts as the community memory layer.

To prevent malicious users from flooding the system with fake reports, I implemented a robust confidence scoring model in our backend. The total community confidence score $S_c$ is calculated as:

$$S_c = \min\left(100, \sum_{i=1}^{n} w_s R_{s,i} + \sum_{j=1}^{m} w_v R_{v,j}\right)$$

Where $R_{s}$ represents anonymous suspicion reports (lower weight, $w_s = 10$) and $R_{v}$ represents verified victim reports with evidence (higher weight, $w_v = 40$ to $70$). A score of $\ge 70$ triggers a global community warning.

Challenges we ran into

My biggest hurdle was the integration and environment setup, specifically working within WSL2.

Developing a decoupled architecture on Windows Subsystem for Linux (WSL2) created a maze of networking issues. Routing localhost traffic between my Next.js frontend, the Python virtual environments (.venv), Docker containers, and the Google Cloud SDK emulators required constant troubleshooting. Port forwarding and firewall rules in WSL2 frequently dropped the streaming connections between the MCP server and the frontend.

Additionally, integrating the Vertex AI streaming response (Server-Sent Events) into the Next.js UI was highly complex. The UI initially expected strict JSON objects for our verdict styling, but the AI naturally returns conversational text chunks. I had to rewrite our Next.js API route and state management multiple times to safely parse the AI's paragraph output and map it to the strict TypeScript interfaces without crashing the app.

Accomplishments that we're proud of

  • The Community Memory System: I successfully created a database that learns. Using MongoDB TTL indexes for rate-limiting and IP hashing for privacy, I built a safe, anti-bot reporting system. So even if a fraud site/ seller has not been reported before, the users get a chance to raise a dispute and make it easier for other users to warn them of fraud accounts. It's almost like a self-training fraud detector that bridges the gap between users and AI services.
  • Seamless UI: I managed to distill complex AI reasoning, WHOIS lookups, and database queries into a "zero-jargon," 2-second experience for the end user.
  • MCP Implementation: Successfully combining multiple disparate Python tools into a single FastMCP server that Gemini can autonomously call.
  • Security Layer: Successfully developed a security-victim layer that prevents bots and malicious users for fake mass reporting of sellers.

What I learned

I learned a massive amount about the Model Context Protocol (MCP) and how to design tools that LLMs can reliably use. I also leveled up my skills in React state management (specifically handling raw text streams) and learned the hard way how to properly secure a public-facing community database against malicious data injection. Finally, I learned how to effectively debug complex networking loops in WSL2.

What's next for Safeshop

Right now, you have to go to the web app to scan a seller. Our next steps are taking SafeShop directly to where the users are:

  1. Browser Extension: To automatically scan checkout pages and product reviews while you browse, eliminating the need to copy-paste URLs.
  2. Better Interface and UX for chat: Currently, user inputs are streamlined through a single field but I would like to make the UX better by making the agent look more conversational by making a chatbot interface. But the agent responses are completely right at the moment.
  3. Media Extension: I would like to implement a feature where users can upload images/ screenshots/ videos that can be analysed by the agent for handling more complex analysis while raising a dispute or reporting a seller.
  4. WhatsApp Bot Integration: Users will be able to simply forward a sketchy product link or seller profile to a SafeShop WhatsApp number and get an instant AI verdict in the chat.
  5. Facebook Marketplace Expansion: Currently, the social commerce scanning is tailored to Instagram. We plan to extend the heuristics to cover Facebook Marketplace sellers and groups, where peer-to-peer scams are incredibly prevalent.

Built With

Share this project:

Updates