Scam Check for Alexa+

Ask Alexa before you pay — a calm second opinion on suspicious calls and messages for older adults.

Comment

Inspiration

Scam calls and texts reach older adults every day: a "grandson" in jail who needs gift cards, a "city office" refund that has to be claimed at an ATM, a parcel stuck for a small fee. Many older adults already talk to Alexa every day. We wanted the safest moment — before any money moves — to be one sentence away: "Alexa, is this a scam?"

What it does

Scam Check is an MCP server for the Alexa+ track, plus a simulated Alexa+ experience on an Echo Show screen. The user describes a call or reads out a message, and Alexa+ calls our tools:

  • check_call / check_message — a rule engine and an AI judge the call or message. The answer is a risk level, up to three warning signs in plain words, and one clear next step, written to be read aloud.
  • notify_trusted_contact — lets a family member know, only after the user says yes.
  • call_trusted_number — calls family or an official helpline (AARP Fraud Watch Network Helpline in the US, the 188 consumer hotline and #9110 in Japan). The tool has no phone-number input, so a number from a scammer can never be dialed.
  • save_trusted_contact — adds a contact by voice ("add my son Mike, 555-0142"). Nothing is saved until the person confirms on screen, and numbers that appeared in a checked call or message are blocked.
  • get_safety_steps — what to do if money or details were already shared.

It works in seven languages: English, Japanese, Spanish, Chinese, Korean, Vietnamese and Portuguese. The screen, the voice, the AI answers and the helplines all follow the chosen language.

How we built it

  • MCP server: MCP TypeScript SDK on Cloudflare Workers, spec 2025-11-25, Streamable HTTP, stateless (a fresh server and transport per request). Tool inputs are validated with zod, and results come back as structured content.
  • Judgement: rules first (gift cards, crypto or wire payments, secrecy, threats, requests for codes, remote access, ATM refunds, small delivery fees), then Gemini with a strict JSON schema. The stricter level always wins, and if the AI is slow (over 8 seconds) or unavailable, the rules still answer.
  • Simulated Alexa+ host: a web app that connects to /mcp with the official MCP client, lists the tools, and lets a language model choose which tool to call (function calling). It uses the Web Speech API for voice in and out, and shows a live MCP traffic panel.
  • Safety by design: the assistant never repeats numbers or links from a suspicious message, asks before contacting family, and stores nothing the user says. Trusted contacts stay in the user's own browser.

Challenges we ran into

  • Finding the MCP transport that runs on Cloudflare Workers. The web-standard transport exists in the SDK but is easy to miss.
  • A Node.js MCP client hung on tools/list against our stateless server, because it opened a GET stream that never closed. Answering GET with 405 fixed it.
  • Keeping answers in one language: the model sometimes left a tool's language at its English default, so the host now always passes the screen language.
  • Making it fast enough for a voice conversation: we answer straight from the tool result instead of making a second model call, and cap the AI at 8 seconds.

Accomplishments that we're proud of

  • A call tool that cannot be tricked into dialing a scammer's number, by design rather than by prompt.
  • One flow that goes from "is this a scam?" to telling family or calling an official helpline in two taps or two sentences.
  • Seven languages, with country-appropriate helplines.

What we learned

For older users, the hard part is not detection but tone: short sentences, one next step, and never making the person feel foolish. Stateless Streamable HTTP is a great fit for serverless platforms once GET streams are handled.

What's next

  • Live scam patterns: a daily job that collects new scam alerts from official sources (police and consumer agencies) and updates the checks, with a human review step.
  • Photo checks: send a photo of a suspicious letter, envelope or SMS screen and get the same plain-language answer, without storing the image.
  • Real delivery: SMS or Alexa app notifications to family, and a production Alexa+ integration.

Built With

Share this project:

Updates

Submission history