SafeZone

Inspiration

Hazard information is public, free and completely scattered. Satellite fire detections live in one NASA portal, official warnings in a National Weather Service feed, air quality somewhere else again. When smoke appears on the horizon, nobody opens four dashboards. They ask someone.

That is a voice assistant's job, except a voice assistant has a real weakness here: it can tell you a fire is sixteen kilometres north-east, but it cannot show you where north-east is relative to your street. So we built the answer twice — once to be spoken, once to be drawn.

What it does

You ask SafeZone whether a place is safe. It checks wildfire hotspots, official weather alerts, air quality, wind and recent earthquakes at the same time, applies an explicit rule set, and answers in one or two spoken sentences. The map flies to the place and shows what it just said: hotspots sized by radiative power, alert polygons coloured by severity, an arrow for where the wind is carrying the smoke.

Then you keep talking. "How is the wind moving?" "How do I get to the nearest hospital away from the fire?" — that last one shows what the system understands: it takes the fire clusters it found a moment ago, feeds them in as zones to avoid, picks a hospital that is not in the direction of the fire even if a closer one is, and routes you there.

How we built it

The core is a self-hosted MCP server (specification 2025-11-25, Streamable HTTP, stateless), which is what the Alexa+ track asks for. It exposes nine tools over open data sources. Every tool returns the same shape: a short spoken summary, the map layers to draw, the numbers behind them, and where they came from. Alexa+ reads the summary; our simulator also draws the layers; the server never knows which one is calling.

MCP server — on AWS Lambda behind a Function URL. NASA FIRMS for satellite fire detections, NOAA/NWS for official alerts, USGS for earthquakes, Open-Meteo for air quality and wind, OpenStreetMap via Overpass for hospitals and shelters, Amazon Location Service for geocoding and routing.
Agent service — plays the part Alexa+ plays for a real device, and Amazon Polly speaks the answer. Its Amazon Bedrock Converse tool-use loop is written and unit-tested; while our AWS account finishes verification for Bedrock, the live deployment runs the deterministic scripted fallback over the same MCP tools, and switching to Bedrock is one redeploy.
Simulator — React and MapLibre, Web Speech API for listening, one layer style per hazard kind, and a risk panel that shows the reasoning rather than just the verdict.
Infrastructure — AWS CDK: CloudFront and S3 for the simulator, a Lambda Function URL for each of the two services, log groups and a budget alert. One command to deploy, one to tear down.

assess_risk is the tool that matters. It is not an average of scores but an explicit rule set, so every answer can be justified: a hotspot within 10 km is high; a hotspot within 30 km that is upwind in a wind of 15 km/h or more is also high, because that is the one whose smoke reaches you; two high factors from different sources compound to extreme.

Challenges we ran into

The wind direction is a trap. Weather APIs report the direction wind comes from. Get it backwards and the assistant confidently tells you the safe side of a fire is the dangerous one. It is tested as a rule and again through the whole tool, with opposite winds over the same fire.

Deployment bugs that cannot happen locally. Our Lambda adapter fills req.headers but leaves rawHeaders empty, and the MCP SDK transport builds its request from exactly that — so every call returned 415 while the health check looked fine. We found it by invoking the bundled handler locally with a Function URL payload.

Public data sources have opinions. Overpass rejects a User-Agent containing an email in parentheses with a 406 and answers 504 when busy. The National Weather Service replies HTTP 400 outside the US, which is an answer, not a failure — so the tool says "US locations only" instead of erroring.

Accomplishments that we're proud of

The project explains itself: every answer names its sources, every risk level lists the factors that produced it, and the demo fixtures are real recorded API responses. And it runs with nothing: npm install && npm run demo starts the whole stack from recorded data with no API keys and no AWS account.

What we learned

Designing for two very different clients at once — a voice assistant with no screen and a map with no voice — forced a cleaner contract than either would have alone. Once every tool had to return both a sentence and a geometry, a lot of design questions answered themselves.

What's next for SafeZone

Alexa+ itself — registering the MCP server with Alexa+, and the MCP Apps extension so a device with a screen can show the same map in the conversation.
Watching instead of answering — follow a place and speak up when its risk changes, so the first you hear about the fire is before you ask.
Official alerts outside the US — GDACS (EU JRC / UN) beside national feeds.
Bedrock on in production — once account verification completes.