SentryPay

Business Email Compromise costs companies $2.9B a year. SentryPay reads your Gmail, runs three Elastic intelligence checks, and auto-generates a SAR PDF in under 2 seconds when fraud is detected.

Comment

Inspiration

Business Email Compromise (BEC) is the #1 cyber threat to small and mid-sized businesses. The FBI estimates $2.9 billion in losses in 2023 alone — and the median loss per incident is $50,000. Yet most companies' only defense is a tired finance manager who's been told to "double-check the email."

The pattern is brutally simple:

  1. A vendor's email is compromised.
  2. Just before an invoice payment, "the vendor" emails: "We've changed banks — please update our account."
  3. The finance team updates the wiring instructions.
  4. The money goes to a fraudster's account. Recovery rate: under 30%.

We built SentryPay because no off-the-shelf tool gives a small business the same multi-source, real-time fraud intelligence that big banks pay millions for. We wanted to put a fraud-analyst-in-a-box behind every Gmail inbox.

What it does

SentryPay is an AI agent that intercepts payment requests in your Gmail before you wire the money. For every payment email — manual or auto-detected — it produces a BLOCK / FRICTION / ALLOW verdict in under 2 seconds, backed by three independent intelligence sources:

  1. Vector search across 306 known fraud typologies (BEC, romance scams, fake invoices, invoice diversion…)
  2. Sanctions/risk lookup against 68,564 flagged beneficiary accounts (OpenSanctions + FinCEN + community data)
  3. Behavioural anomaly detection against the user's 90-day Gmail payment history

When the agent blocks a payment, it auto-generates a draft Suspicious Activity Report (SAR) PDF in FinCEN-compliant format — ready for the compliance officer to review and file. We also expose the same three tools through an MCP server, so any agent (Claude Desktop, Cursor, Gemini, ADK) can plug in our fraud intelligence.

How we built it

Stack:

  • Reasoning: Gemini 2.5 Flash with structured-output JSON schemas
  • Tools layer: Custom MCP server exposing 3 Elastic-backed tools (FastMCP, stdio + HTTP/SSE)
  • Search substrate: Elasticsearch Serverless 9.5.0 — 5 indices, kNN vector + structured queries in one platform
  • Embeddings: Vertex AI text-embedding-004 (768-dim)
  • Backend: FastAPI with JWT auth, rate limiting, CORS, deployed on Cloud Run
  • Frontend: React + Vite, served from same Cloud Run instance
  • Gmail integration: Google OAuth (full Gmail scopes), 90-day backfill scan, 5-min real-time monitor
  • Observability: Langfuse for LLM trace inspection, BigQuery for decision audit trail
  • CI/CD: GitHub Actions → Cloud Build → Cloud Run (Workload Identity for auth)
  • SAR generation: ReportLab PDF synthesis with FinCEN-compliant template

The architectural choice was putting all five datasets in a single Elasticsearch substrate — typologies, sanctions, the user's transactions, their behavioural baseline, and the audit trail. Cross-channel correlation that would normally require stitching multiple systems together happens in one kNN query.

Challenges we ran into

  1. Gemini's response schema rejected Python's ["string", "null"] union types. Had to switch to uppercase types + nullable: True and add a robust JSON-repair fallback for malformed outputs.
  2. MCP's stdio transport breaks if the server writes anything to stdout — even an Elastic client startup log. Fixed by wrapping get_client() with contextlib.redirect_stdout(sys.stderr) so stdout stays clean for JSON-RPC.
  3. OAuth redirect URI mismatch in production. The backend was hardcoding localhost:5173 for the post-callback redirect. Pulled it into a FRONTEND_URL env var.
  4. Cloud Run deployment via GitHub Actions kept failing on log streaming due to IAM. Granted roles/viewer to the deploy service account and the build pipeline went green.
  5. Vite's build.outDir was set to ../agent/static, but our Dockerfile assumed frontend/dist. Took us a while to spot why the COPY step kept failing.
  6. Demo Mode for judges. OAuth in Test Mode only allows whitelisted Gmail accounts. We built a /auth/demo endpoint that issues a JWT for a pre-built demo account — judges click one button and see the full app populated with real (pre-analysed) emails.

Accomplishments that we're proud of

  • Sub-2-second verdicts end-to-end including 3 Elastic queries + Gemini reasoning
  • Auto-generated SAR PDFs that look like real compliance documents (FinCEN references, case IDs, redacted account numbers, recommended actions)
  • Per-user behavioural baseline built from 90 days of real Gmail history, with IQR-based outlier detection
  • Full continuous learning loop — human feedback on verdicts updates the beneficiary intelligence index
  • MCP server with 3 production-grade tools that any agent in the ecosystem can use

What we learned

  • Structured outputs (response_schema) save tremendous engineering time vs. parsing freeform LLM text — but the schema syntax has sharp edges across Vertex/OpenAI/Anthropic.
  • MCP is a real protocol, not just hype. Decoupling tool logic from agent logic via MCP made our codebase cleaner AND made the system more demoable.
  • Elastic Serverless is genuinely production-ready for vector + structured + aggregation workloads in one cluster. No need for a separate vector DB.
  • Observability Langfuse traces caught two tool-call regressions before they reached the frontend.

What's next for SentryPay

  • Slack + Microsoft Teams integration (BEC frequently happens via DMs, not just email)
  • Outgoing wire interception via banking APIs (Plaid, Stripe Treasury) — block at the rail level, not just at the email
  • Multi-tenant compliance dashboard so a CFO can monitor an entire org's risk in one view
  • OAuth Verified status so any Gmail user can sign in without being whitelisted
  • Fine-tuned classification model trained on the verdicts our community produces — pushing inference cost below $0.001 per email

Built With

Share this project:

Updates