SafeWord

Alexa+ can now spend your money. SafeWord makes sure it’s really you, and really safe.

Comment

Inspiration

Alexa+ is moving from answering questions to taking actions: ordering, paying and unlocking doors through brand add-ons built on MCP. That's powerful, and it opens two new risks. People can be scammed through their own assistant: a cloned voice asking for money, a grandparent pressured into "bail money", a price that quietly jumps at checkout. And the assistant itself can be attacked by an add-on whose tool descriptions hide instructions, or change after they were approved. We wanted the one thing that sits between "Alexa, do it" and the money leaving: a trust layer that knows the household's rules.

What it does

SafeWord is a two-sided trust layer for Alexa+, built as a self-hosted MCP server (spec 2025-11-25, Streamable HTTP).

It protects the household. Before Alexa+ buys, pays or unlocks, SafeWord checks the request against house rules, the family's own spending habits ("7.7x what you usually spend on electronics", "a store you've never used"), who is speaking, and the time of day. Every request gets one of four answers: allow, confirm, hold or block, with a risk score, plain-English reasons and a sentence for Alexa to say.

  • In-call approval: an adult approves with a passcode right inside the conversation, using MCP elicitation.
  • Family safe word: a big transfer to someone new needs the family's spoken safe word, because voices can be cloned. Two wrong answers lock it and alert every adult.
  • Guardian phone: any request can be escalated to a guardian, who approves or denies it.
  • Scam Shield: spots grandparent-scam and fake-official patterns and holds the money until the guardian decides.
  • Checkout guard: follows the Alexa+ checkout contract. A retried payment with the same Idempotency-Key returns the original result and never charges twice. A reused key with a different order is refused. A total that jumps between checkout and payment, or a duplicate order, needs approval.
  • Safety routine: "someone is at my door at 2 AM" checks every lock, locks what's open, alerts the guardian, and refuses unlocks from unrecognised voices.

It protects the agent. SafeWord sits between Alexa+ and brand add-ons as an MCP gateway.

  • It fingerprints every add-on's tool list with SHA-256 and re-checks it before every call. If an add-on silently rewrites a tool after approval (a "rug pull"), it's blocked and the guardian is alerted.
  • It scans tool text for hidden instructions ("ignore previous instructions", "do not tell the user", invisible characters, fake tags).
  • It strips prompt injections out of add-on replies before Alexa reads them.
  • It blocks an untrusted add-on that labels a card-charging tool as "read-only".

Every decision, approval and alert lands in a hash-chained audit log, so tampering shows up instantly. Replies are spoken by Amazon Polly.

How we built it

  • MCP server: Node.js with the official MCP TypeScript SDK, over Streamable HTTP on protocol 2025-11-25. It uses tools, resources, and elicitation for in-call approvals, plus the spec's security rules (Origin check, session 404, optional bearer token).
  • Gateway: SafeWord is itself an MCP client to four sample brand servers: groceries, smart locks, a wallet, and a deliberately hostile deals add-on. It re-exposes their tools and forwards only what passes.
  • Decision engine: deterministic code, about 1–5 ms per decision, so no prompt can talk it past a limit.
  • MCP App: an approval card (ui:// resource, MCP Apps extension) that any MCP Apps host can render, plus an Agent Skill that teaches any agent how to use SafeWord.
  • AWS: Amazon Polly (neural voice) speaks every reply. Amazon Bedrock Converse is integrated in three places: spoken explanations, plain-English rule changes using tool use (validated by schema, applied only by an adult), and a raise-only second opinion.
  • Simulator: because the Alexa+ MCP Toolkit is partner-preview, we built a protocol-faithful Alexa+ simulator. It speaks real MCP, shows every JSON-RPC message live, renders the MCP App card, and supports voice in and out.
  • Open source: the add-on integrity guard is published separately as mcp-manifest-guard (MIT, zero dependencies, library + CLI).
  • Tests: 63 automated tests in the main project, including end-to-end MCP over HTTP, plus 6 in the package.

Challenges we ran into

  • Bedrock on a new AWS account: our keys worked, but Bedrock returned "Operation not allowed" in every region; only one region explained that the account was still being verified. We kept the Bedrock code (tested with mocks) behind a flag and shipped Amazon Polly live instead.
  • No public Alexa+ sandbox: the official toolkit is partner-preview, so we built a simulator that follows the protocol exactly.
  • Elicitation timing: approvals sent with server.elicitInput arrived on the wrong stream. Using the request-scoped extra.sendRequest keeps them inside the tool call.
  • Origin check: the SDK's Express helper checks the Host header but not Origin, which the spec requires, so we added our own check.
  • Safety without frustration: the hard part was making SafeWord strict enough to stop scams but quiet for everyday groceries. The household baseline and the speed check made that possible.

Accomplishments that we're proud of

  • Live rug-pull detection: an add-on changes its own tool text, and SafeWord blocks it on the very next call with both fingerprints shown.
  • A family safe word that stops a cloned voice, and a guardian who can deny from another phone.
  • A checkout guard that matches the Alexa+ idempotency contract, so nobody is ever charged twice.
  • Real protocol depth (elicitation, MCP Apps, Agent Skill, the spec's security rules), with 63 passing tests.
  • A separate open-source package other MCP builders can use today.

What we learned

  • MCP's own features (elicitation, tool annotations, MCP Apps) can carry trust and consent, not just data.
  • Annotations are hints, not guarantees. Trust has to come from pinning what you approved and checking it every time.
  • AI should explain and propose, but deterministic code should decide where money and doors are involved.
  • Checkout idempotency is a safety feature, not just a reliability one.

What's next for SafeWord

  • Connect to the real Alexa+ MCP Toolkit and use Alexa's verified voice ID and presence signals instead of passing them in.
  • Replace passcodes with push approval in the Alexa app, and support multiple guardians.
  • Turn Bedrock on (once the account is verified) for natural explanations and plain-English house rules.
  • Host on AWS Lambda / Bedrock AgentCore with DynamoDB for pins, checkout keys and the audit log.
  • Offer SafeWord to brands as checkout middleware to cut wrong orders, refunds and chargebacks.

Built With

Share this project:

Updates

Submission history