SourceWatch — a release decision copilot
Problem. AI assistants can find a new software release or source handoff, but a valid checksum does not mean an authorized owner has accepted the release. Silently promoting an unapproved version can cause the assistant to use the wrong source. A tampered handoff demands a different response.
Solution. SourceWatch is a local, read-only MCP release-decision prototype that makes those distinctions explicit. Its guided, Alexa+-style simulated experience walks an operator through three real HTTP MCP tool calls against the same synthetic release scenario, with the same owner and immutable accepted/observed SHA references:
check_release_change— what changed since the accepted release?verify_handoff_integrity— is the handoff structurally valid and accepted?explain_source_alert— what is the next safe human action?
The outcomes are HOLD_FOR_REVIEW for a valid but not yet accepted change, REJECT when handoff integrity fails, and PINNED_NO_CHANGE when the accepted release is unchanged. Owner or SHA inconsistencies fail closed. SourceWatch never accepts, promotes, or writes a release on behalf of a human.
How it works
- Python standard-library HTTP server implementing an MCP 2025-11-25 Streamable HTTP endpoint with JSON-RPC initialization, tools/list and tools/call.
- A local HTML/CSS/JavaScript UI displaying the real sequential MCP calls, source owner, accepted SHA, observed SHA and final decision.
- Immutable synthetic release fixtures and reproducible integrity, protocol and negative tests.
- The independently reviewed frozen E003 implementation has regression and actual HTTP MCP call evidence. A separate local Chrome demonstration exercised three scenarios and nine actual tool calls.
What is and is not integrated
Real: Runnable local MCP HTTP endpoint; browser UI; read-only tool execution; synthetic owner/SHA continuity checks; deterministic evidence; filmed local UI behavior.
Simulated: Alexa+-style conversation and source releases. Not claimed: live Amazon Alexa+ integration, access to gated Alexa+ developer tools, a production GitHub change feed, real end-user source authority, official SDK interoperability, production adoption, AWS integration or automatic source acceptance.
Impact and next steps
The intended audience is developers and teams handing source versions between AI assistants. The prototype demonstrates how agents can stop on ambiguous authorization instead of treating every hash-valid version as approved. Impact has not been measured with production users. Future work could include authorized source connectors, stronger actor attestation and further independent interoperability tests.
Demo and source
The short English video includes real local browser operation and explicitly labels synthetic data. The code repository includes run instructions, fixtures and tests. This is an Alexa+ track MCP server / web simulation submission, not a deployed Alexa+ add-on.
Built With
- css
- html
- javascript
- json-rpc
- model-context-protocol-(mcp)
- python
- streamable-http