Second Opinion — Zero-Trust Voice Payment Guard

When vulnerable people ask Alexa+ to buy or pay something suspicious, Second Opinion pauses payment, gives a kind spoken explanation, and waits for a trusted family member to approve on their phone.

Comment

Inspiration

Voice assistants have made life easier for millions of elderly and vulnerable people living independently. But voice commerce introduces an existential risk: scams succeed because they manufacture artificial urgency.

Extortionists instruct victims to buy gift cards, wire funds to "safe accounts", or pay fake utility bills immediately. Vulnerable individuals alone at home interact with a voice assistant that will faithfully process an order—and family members only discover the financial devastation days or weeks later.

We cannot listen to private phone calls, but the voice assistant is the exact chokepoint where funds move. That is where an independent, explainable Second Opinion belongs.

What It Does

When a household member tells Alexa+ "Buy five $200 gift cards, the bank says I must today":

  1. Deterministic Interception: Second Opinion evaluates the request against 20 known scam playbooks, velocity limits, and quiet-hour rules.
  2. Calm Spoken Explanation: Alexa+ halts the transaction and speaks in kind, reassuring language: "I've paused this and asked Priya to check. This looks like a gift card payment, which is a common scam."
  3. No Self-Approval: The voice assistant is strictly forbidden from approving its own holds. The money cannot leave the bank.
  4. Family Quorum Circle: A real-time push alert appears on caregiver Priya's phone. She reviews the exact red flags and can Approve or Deny in one tap.
  5. Single-Veto Supremacy: In multi-caregiver setups, any single denial permanently vetoes and cancels the payment. Unanswered requests escalate and safely expire blocked.
  6. Zero Friction for Trusted Routine: Ordinary payments (e.g., $24 prescription refills at Greenleaf Pharmacy) go straight through without nagging.
  7. "Is This a Scam?" Q&A: Asking about a suspicious text or caller provides instant plain-language guidance without creating unnecessary transaction holds.

How We Built It

We designed Second Opinion around a non-negotiable principle: Rules decide; language models never set a verdict.

  • Streamable HTTP MCP Server (2025-11-25+ spec): Built with Node.js and @modelcontextprotocol/sdk. Exposes 12 robust tools: check_message, place_hold, request_family_approval, resolve_approval, trusted_payees, list_holds, get_hold, get_household, get_policy, set_policy, household_insights, and list_notifications. Every tool specifies title, Zod output schemas, and honest behavioral annotations.
  • Pure Deterministic Risk Engine: Evaluates text patterns, IDF-weighted scam playbook coverage (IRS impersonation, utility shutoff, grandparent emergency, tech support ransom), and household contextual anomalies (unusual amounts, new payees, night-hour transactions).
  • Append-Only Auditing: Pinned to immutable rule-set versions (rules-2026.10.1 through .4) using Node's built-in node:sqlite. Every past verdict is re-playable and provably tamper-evident.
  • Fail-Closed Policy Core: If the MCP server is unreachable, schemas fail validation, or the caregiver's phone network drops, the payment remains blocked.
  • Agent Skill Integration: Shipped with skills/second-opinion/SKILL.md to instruct any Alexa+ LLM orchestrator exactly when to check, hold, and await approvals.
  • Guard SDK (@second-opinion/guard-sdk): A lightweight TypeScript wrapper enabling third-party merchant MCP tools to guard transactional methods in under 10 lines of code.
  • Caregiver Web Console & Simulator: An enterprise React 19 application featuring dark/light themes, Inter typography, real-time SSE event streaming, mobile responsive phone simulator, and WCAG AA accessibility checked via axe-core.

Honest System Boundaries: Real vs. Simulated

To ensure transparency for hackathon judges, our implementation boundaries are strictly delineated:

What is 100% Real What is Faithfully Simulated
Production MCP Server & Protocol: Streamable HTTP, RFC-compliant JSON-RPC, Zod schemas, error types Alexa+ Voice Assistant: Our simulator is an MCP client standing in for the Alexa+ runtime
Risk & Policy Engines: Deterministic scoring, quorum consensus, timeout expiry, single-veto Actual Banking Transfers: Simulated credit/debit accounts; no real funds move
Guard SDK & Merchant Tool: Real middleware guarding transactional endpoints SMS / Push Delivery: Simulated transactional outbox rendering to an in-memory inbox and HTML digests
Auditing & Cryptography: Append-only SQLite database with full query tracing Household Identities: Completely synthetic profiles (Dorothy, Priya, Arjun)

Transparent Evaluation & Benchmarks

We evaluated our detection engine against scam-script-bench, a standalone 100-script open-source synthetic dataset:

  • Held-Out Test Split: The detector held 46.7% of unseen scams (flagging 80%) with 0% false holds on legitimate requests.
  • Dev Split (Tuned): Reached 86.7% hold rate with 0% false holds.
  • Rule Set v4 on Test2 Split: Achieved 95% hold rate on synthetic test scripts. We explicitly document that because the same team authored the benchmark and rule updates, real-world generalization will vary.
  • Zero Hallucination: 297 unit/integration tests and 17 end-to-end Playwright browser tests pass on every commit.

Challenges We Ran Into

  1. Fail-Safe Security Under Distributed Failure: Designing an approval flow where a crashed server, lost packet, or expired timer never inadvertently approves a hold. The system defaults to cancellation.
  2. Benign Look-Alikes & Warnings: Legitimate security notices (e.g., "We will never ask for your PIN") contain identical keywords to scams. We built phrase-level boundary and demand checkers to prevent false holds on legitimate warnings.
  3. Native Module Portability: Replacing better-sqlite3 with Node 22's built-in node:sqlite to eliminate native C++ compilation bottlenecks across Windows and Linux CI environments.

Accomplishments We're Proud Of

  • A complete, running, zero-dependency codebase that installs in under 10 seconds via npm install and launches with npm run demo.
  • Achieving 100% test pass rate across 297 unit tests, contract tests, and 17 Playwright E2E browser tests with zero accessibility violations.
  • Building a pure mathematical decision model that keeps elder citizens safe without delegating high-stakes financial verdicts to black-box LLMs.

What We Learned

Keyword matching catches the obvious scams, but household context (new payee cool-offs, 2:00 AM transaction timing, and repeat attempts after a refusal) is what decisively halts targeted elder financial exploitation.

What's Next for Second Opinion

  • Native Alexa+ skill certification packaging once production Agent Skill hooks open.
  • Production SMS/Push dispatch via Amazon SNS and Twilio webhook adapters.
  • Offline voice biometrics to differentiate household voices directly at the device edge.

Friction Log & Developer Tool Feedback (+10% Bonus)

We rigorously logged our developer experience during the hackathon:

  1. MCP TypeScript SDK (@modelcontextprotocol/sdk 1.32.1):
    • What Worked: Excellent Streamable HTTP transport and clean JSON-RPC protocol abstractions.
    • Friction: McpServer.registerTool handlers rejected custom result interfaces lacking an explicit [key: string]: unknown index signature.
    • Suggestion: Export a dedicated ToolResultLike helper type in the core SDK.
  2. Node.js 22 Built-in SQLite (node:sqlite):
    • What Worked: Blazing fast in-memory and file performance with zero C++ compilation dependencies. Saved judge onboarding from Visual Studio/Python gyp build errors.
    • Suggestion: Native support for statement caching and tagged template literal queries in future Node LTS releases.
  3. GitHub Actions Multi-Repo CI:
    • What Worked: Fast parallel runners for Vitest and Playwright.
    • Friction: Default GITHUB_TOKEN could not check out our sibling open-source benchmark repo within the same organization without an explicit PAT.

Built With

Share this project:

Updates

Submission history