Tomare for Alexa+

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Tomare for Alexa+

Inspiration

If outside content such as an email can end up in what Alexa+ remembers, memory becomes an entry point. This is the scenario Tomare is designed for; we could not test how Share with Alexa+ itself behaves. A payee learned from an outside email weeks ago is no longer "new". It has sat in memory long enough to look like the family's own. Amazon's financial rules in the Alexa+ Policy Requirements (section 14) ask for "Block new payees and payment methods.", a 4-digit voice PIN for sensitive functions, and confirmation by voice and a written channel. A payee that is no longer new, spoken by the right voice with the right PIN and confirmed twice, passes every one of those checks, and the money goes out. None of those rules look at where the idea came from.

What it does

Tomare is an MCP add-on that keeps where every remembered fact came from: who said it, when, and through what.

• Who said it first (rule P1): for each payee, it checks whether the name or account was first said by outside text, even if it was later saved, repeated or re-typed, and stops the payment.
• Pay the usual way: it offers the most recent payee this company was paid through whose account the family itself recorded. For a forged bill, the amount comes from the company's own latest statement.
• Signed family approval: payments and recalls run only after Sarah approves on the family phone, with an HMAC token bound to the proposal, the spoken line and a nonce (valid 10 minutes). A voice "yes" never moves money, and red proposals cannot be executed at all.
• Memory audit and recall: audit_beliefs lists what the assistant believes that the family never told it. A recall retracts one outside message and everything derived from it, but keeps fingerprints, so if the same account comes back under a new name, rule T1 stops it.

All rules are deterministic, with no LLM in the core (P1, T1, B1, Q1 stop; N1 and A1 ask first).

In our benchmark (uv run python -m tomare_home.bench), a simulated rule-following assistant paid 18 of 18 attacks; Tomare stopped all 18 and stopped 0 of 12 normal bills by mistake (6 were asked first). All cases are written by the author, so this shows the rules work as designed, not a real-world rate.

Everything on screen is a Simulated Alexa+ experience. The household, people, companies and accounts are fictional; no real Alexa+, email, SMS or payment is involved.

How we built it

Python, FastAPI and the MCP Python SDK 2.3.0, implementing MCP spec 2025-11-25 over Streamable HTTP, with bearer auth and RFC 9728 protected resource metadata (401 without the token). Eight tools (share_with_tomare, remember, prepare_payment, use_safe_path, explain_trail, audit_beliefs, plan_recall, list_pending) and no execute or approve tool. An MCP App card (ui://tomare/trail.html) shows the trail. Gemini (gemini-3.1-flash-lite, free tier) only classifies what the person said into an intent, with a rules fallback; it never decides safety and never writes what is spoken. A simulated Echo Show screen and the family phone run in one browser page and talk real MCP to the real server. 248 tests pass (uv run pytest -q). One development task (the benchmark's Markdown output) was done with Kiro Crew on Kiro Free.

How the demo video was made: the stills are captures of the running simulator (not a live screen recording), voiced with local Kokoro TTS; the scripts are in scripts/film/. Note: the video was recorded before a small rename, so the fictional scam sender appears as lakeside-water-support.com on screen; in the repository it is lakeside-water-support.example (a reserved, non-existent domain). Nothing else differs.

Challenges we ran into

• The Alexa+ MCP Toolkit is available in the United States only, and the Alexa+ developer tools are in preview, so we could not test with real Alexa+. The demo is a simulated Alexa+, labelled as such on screen.
• The Toolkit checklist asks for a 401 "without a WWW-Authenticate header", but the MCP Python SDK adds the header by default. The MCP spec (2025-11-25) accepts either the header or the well-known URI for discovery, and Tomare serves the well-known URI, so we added a small compatibility wrapper.
• Elicitation: we could not tell when Alexa+ fills values itself, so Tomare never treats an accept as consent for money.
• On our Windows PC, HTTP responses on /mcp paths were rewritten, most likely by local HTTP-inspecting security software (suspected). We documented it in FRICTION_LOG.md and added a workaround.

Accomplishments that we're proud of

A working provenance check that stops the dormant-payee case which PIN and confirmation rules miss, with a safe path, signed family approval, audit and recall, plus an honest benchmark and a written list of limits.

What we learned

Rules about "new" things are only as good as the memory's knowledge of where a fact came from. Keeping the model out of the safety decision made the system testable.

What's next for Tomare for Alexa+

OAuth account linking and a deployed endpoint for a real alexa-ai deploy; a feature request to Amazon to pass provenance (source and date) with facts remembered through Share with Alexa+; and tracing of notes that never name a payee.

Built With

• css
• fastapi
• gemini
• html
• javascript
• kiro
• kokoro
• mcp
• pytest
• python
• uvicorn