The Last Shift

An Alexa+ escape room built as a self-hosted MCP server: an elicitation-gated escape, a live MCP Apps room map, and Amazon Bedrock narration.

Comment

What it does

The Last Shift is a self-hosted MCP server (MCP spec 2025-11-25, Streamable HTTP) built for the Alexa+ track. It runs a time-pressured escape-room game: the player is locked in Maintenance Bay 7 on Kessler Station with a 600-second clock, and has to examine the room, find two code fragments, and escape before time runs out.

The server exposes three MCP tools (examine_room, use_item, attempt_escape) and two resources (room://state, a structured JSON view of the game; ui://room-map, an MCP Apps resource rendering a live room map with a ticking clock in a sandboxed iframe). The decisive action, attempt_escape, is gated by MCP elicitation - the server asks for the escape code as a structured input before deciding success or failure. Room narration tries MCP sampling first, and otherwise calls Amazon Bedrock directly - which is the path that actually fires for Alexa+, since, according to Amazon's documentation (mcp-toolkit-client-lifecycle.html, last updated Jul 10, 2026; checked 2026-09-17), Alexa+'s own initialize never declares sampling.

Features and functionality

  • Three MCP tools, two MCP resources, one MCP elicitation flow, over a real Streamable HTTP transport (session lifecycle, Origin/CORS validation).
  • An MCP Apps view (ui://room-map) with a real ui/initialize handshake and a live-updating room panel - no reload needed between tool calls.
  • Two narration paths: MCP sampling (for hosts that declare it) and direct Amazon Bedrock calls (the actual Alexa+ path).
  • A deterministic demo mode (DEMO_MODE=recorded) for a reproducible video, alongside a verified, working live-Bedrock path (see examples/).
  • 99/99 server tests, 5/5 client tests.
  • A friction log with five confirmed, reproducible findings in upstream MCP packages (the official SDK, @modelcontextprotocol/express, and ext-apps), each separating a confirmed mechanism from a proposed fix.

Potential impact

  • For developers building Alexa+ MCP add-ons: a small, complete, MIT-licensed reference that combines pieces a real add-on needs and that are hard to find working together — Streamable HTTP session handling with Origin/CORS validation, an elicitation-gated action, an MCP Apps view updated live through the host↔view channel, and a narration path that still works when the client doesn't declare sampling (the Alexa+ case). 104 tests document the expected behavior.
  • For MCP SDK maintainers: five reproducible friction findings, each separating a confirmed mechanism from a concrete proposed fix (see Product Feedback and FRICTION-LOG.md).
  • For Alexa+ experiences: the same pattern — short, time-boxed, stateful interactive stories with a visual panel — could be adapted for screen devices. This was not tested on real Alexa+ devices: the Alexa+ MCP Toolkit is available to select partners only.

Protocol compliance (short)

We name known gaps instead of claiming full compliance. We have not audited the base spec requirement by requirement; one MUST we know is not met: elicitation state is tied to the MCP session, not to a user identity, because the server has no authentication. Details, including the MCP Apps extension status, are in the README's "Protocol compliance" section.

Technologies used

Node.js, TypeScript, the official MCP packages (@modelcontextprotocol/core, /server, /express, /node, /ext-apps, v2), Zod, Express, the AWS SDK for JavaScript v3 (@aws-sdk/client-bedrock-runtime), Amazon Bedrock (Claude Haiku, cross-region EU inference profile), Vite + vanilla TypeScript on the client, the MCP Inspector (open-source, @modelcontextprotocol/inspector) as a verification tool during development.

Developed with Claude Code (Anthropic's AI coding assistant) as a pair-programming tool; it appears as a co-author in the commit history.

Data used

No external or personal data. All game content (the station, the room, the puzzle) is original and self-contained. Narration text is either a pre-written fixture (DEMO_MODE=recorded) or generated live by Amazon Bedrock from a fixed prompt template describing the room - no user data is collected or stored beyond in-memory, per-session game state (inventory, discovered fragments, the countdown).

Challenges we ran into

  • Alexa+ clients don't declare sampling, so narration had to work without it: we added a direct Amazon Bedrock path and verified it live, including a deliberate failure case that falls back cleanly.
  • Origin validation and CORS for a real browser client weren't covered out of the box by the MCP packages we used; we wrote small middlewares and logged each gap (five friction-log entries).
  • Our first MCP Apps view skipped the ui/initialize handshake, which made a required host notification impossible to send. We found this by reading the extension spec and rebuilt the view around the full handshake.
  • Keeping claims honest: we name the requirements we don't meet instead of claiming full compliance.

What's next

  • Authentication (OAuth 2.1), which would also let game state be bound to a user identity and close the known elicitation gap.
  • SSE resumability (priming events) for unstable connections.
  • A fullscreen control and an accessibility pass on the room panel.
  • Filing the five friction findings upstream as issues or pull requests.

Built during the hackathon window

All code was written within the submission period (the repo's first commit is 2026-09-13, confirmed via git log --reverse; the Submission Period runs from August 31, 2026, 10:15 am PT to October 23, 2026, 12:00 pm PT per the Official Rules). No code predates the hackathon or was carried over from an earlier project.

Built With

Share this project:

Updates

Submission history