ShieldGentAI

Inspiration

Scam messages don't wait for a convenient time — they land at 11 PM, mid-class, whenever. By the time someone reads carefully enough to realize it's a scam, the moment to act on it has often already passed. I'd been exploring an idea around fraud detection for a while, in a few different forms, and kept running into the same realization: knowing a message is a scam isn't actually the hard part. The hard part is everything after — deciding to report it, warning family, following through on a chore most people just skip because they're busy. ShieldGent AI came from wanting to build something that doesn't stop at detection.

What it does

ShieldGent AI is a real-time security intelligence agent. You give it a suspicious message, and it:

Classifies risk as SAFE, SUSPICIOUS, or HIGH_RISK
Extracts the specific threat signals and evidence behind that score
Recommends a next action — log it, draft an alert, or draft a complaint
Saves the incident to Firestore as a persistent, auditable record
Surfaces everything on a live security dashboard, where a human approves or rejects before anything is considered final

It never claims to block a transaction or send anything automatically — it detects, explains, and recommends, and a human makes the final call.

How I built it

The stack is a React + Vite + Tailwind frontend, a FastAPI backend, a Google ADK agent powered by Gemini, and Firestore for persistence. I built this solo, on an i3 laptop with no GPU, which meant everything AI-related had to run through the Gemini API rather than locally — a constraint that shaped the whole architecture toward being lightweight and API-first from the start.

I built this as a fresh project rather than carrying forward an earlier idea I'd been exploring, since I wanted to try a genuinely different implementation approach this time — action-oriented and agentic rather than classification-only.

Challenges I ran into

Model churn: I built against gemini-2.0-flash, and partway through, the API started returning a 404 telling me it was deprecated in favor of gemini-3.6-flash — a reminder that AI infra moves fast even mid-build.
A silent import bug: my agent imported from services.firestore_services (plural) while the actual file was firestore_service.py (singular) — the kind of typo that would've broken the whole pipeline the moment the agent connected to the backend, caught just in time.
The Google Cloud billing wall: I wanted to deploy to Cloud Run, but Google Cloud now requires a card on file even for free-tier usage, and I didn't have one available to use. I decided to run the backend locally instead and treat Firestore's live console as my Google Cloud proof.
Protecting secrets in git: with a Firebase service-account key and API keys in the project, I had to be careful setting up .gitignore correctly before ever pushing — including catching a .gitignore that was sitting in the wrong folder and wouldn't have excluded anything.

Accomplishments that I'am proud of

Going from zero to a fully working, end-to-end agent — real Gemini analysis, real Firestore persistence, real dashboard — inside a single tight build window, solo.
Building a security tool that's honest about its own limits: ShieldGent never overclaims what it can do, which I think matters more in a security product than in almost any other kind.
Catching and fixing real bugs (the import typo, the misplaced .gitignore) before they became demo-day disasters, by testing deliberately instead of assuming AI-generated code was correct.
Designing the whole system around a human-in-the-loop principle from day one, not bolting it on as an afterthought.

What I learned

Building solo under a hard deadline taught me to scope ruthlessly . I cut a planned auto-refresh feature and an analytics dashboard because they weren't essential to proving the core idea worked. I also learned to treat "the AI says it's done" with suspicion - checking real terminal output, real Firestore documents, and real API responses mattered more than trusting confident-sounding code. And I learned that a security tool's credibility comes from what it doesn't claim as much as what it does.

What's next for ShieldGent AI

The current prototype proves the intelligence and the workflow. The next step is bringing ShieldGent on-device , running analysis locally on the phone using on-device/edge AI, so sensitive messages never have to leave the device at all. That would turn ShieldGent from a security dashboard into a real-time, privacy-preserving personal security agent — alerting people the moment a scam arrives, not after they've gone looking for a tool to check it.