UCII for Alexa+

Everyday convenience. Human control. An Alexa+ simulation backed by real UCII identity, tool permissions and recorded activity. Allow an action, block it, and see the difference.

Comment

Inspiration

A useful assistant should make everyday tasks easier while leaving the human in control.

We built UCII for Alexa+ around one question: can a conversational assistant remain helpful while respecting permissions enforced outside the conversation?

UCII—Universal Cryptographic Identity Infrastructure—provides the identity and permission foundation. This project brings that foundation into a simple Alexa+ web simulation.

What it does

The application separates public requests from personal actions.

Anyone can check UCII service health, view sample recipes, or open public shopping and map links without signing in. Accessing saved shopping lists and managing permissions requires an authenticated HUMAN account.

Signed-in users can retrieve named shopping lists, add or remove items, and choose Allow or Block for connected tools. Activity displays saved tool results and permission history.

The central demonstration is straightforward:

  1. Add milk to a shopping list while edits are allowed.
  2. Block shopping-list changes.
  3. Request removal of milk: the tool denies the edit, and milk remains.
  4. Restore permission and repeat the same request: the removal succeeds.

The human changes the boundary. The tool enforces it.

How we built it

The web interface uses React and TypeScript. A self-hosted Python MCP gateway exposes tools through Streamable HTTP using MCP protocol version 2025-11-25.

The gateway connects to UCII’s existing identity, authentication, credential-verification and authorization services. The agent uses an ML-DSA-65 post-quantum signing credential held by a separate protected signer. Private signing material is not supplied to the browser.

Personal requests use a validated HUMAN session. Controlled tool actions check the agent credential and current UCII permission. Saved lists, tool results and permission records persist on the server.

The backend runs on Ubuntu using systemd services and nginx, with SQLite storage.

What is real—and what is simulated

The Alexa+ conversation layer is a clearly labeled, bounded simulation. It does not call a live Alexa+ service or use an unrestricted language model.

The connected UCII backend, MCP requests, authentication, agent credential checks, saved shopping lists, permission enforcement and Activity are real.

Recipes are predefined examples. Amazon and directions requests open external links. Nothing is purchased, and no infrastructure is deployed.

Challenges we faced

Our biggest challenge was keeping the experience simple without weakening the permission boundary.

Early iterations exposed too many advanced approval controls. We narrowed the main workflow to requests, results, Allow, Block and Activity. This made the product easier to understand and demonstrate.

We also resolved frontend/backend rollout mismatches, improved the sign-in experience, protected HUMAN identity retrieval from anonymous visitors, and reorganized the interface so requests and results remain close together.

What we learned

Identity, authentication and permission answer different questions. A verified agent credential does not automatically authorize an action. A human login does not mean every tool should be allowed.

We also learned that security is easier to communicate through a concrete result: the same request fails when blocked and succeeds when allowed.

What we’re proud of

We built a compact, working demonstration that connects everyday usefulness with human control.

The permission decision is enforced by the connected backend rather than relying on the simulated assistant to obey a conversational instruction. Users can inspect saved results and change the tool’s permission through a simple interface.

What’s next

Future work could connect additional useful tools and a live conversational integration when access is available, while preserving the same identity, permission and recorded-result boundaries.

UCII existed before this hackathon. The Alexa-focused web simulation, MCP gateway integration, shopping-list workflow, permission controls and demonstration were developed for this project during the hackathon.

Built by Brad Phee · UCII Labs.

Built With

Share this project:

Updates

Submission history