Vault for Alexa+

A private memory for the things you track - sleep, water, mood, anything - that Alexa+ can read and write by voice, with your data owned by you.

Comment

Inspiration

People already track their lives - sleep, water, workouts, medication, mood - but the data ends up in a dozen apps, each with its own idea of what a "record" is. We wanted one private place that holds any data you define, and we wanted to talk to it. Alexa+ with the MCP Toolkit made that possible for the first time: an assistant that calls your own server, as you, with your own OAuth identity. The pitch is one sentence: "Alexa, log seven and a half hours of sleep" - and it lands in a vault that only you can read.

What it does

Vault is an authenticated remote MCP server that gives Alexa+ six voice tools:

  • find categories - what you track, five at a time ("say 'more'")
  • describe category - which fields a category records and which are required
  • log entry and confirm entry - reads the entry back ("I'll add to Sleep: hours 7.5… Should I save it?") and saves only after a spoken yes
  • recent entries - up to five entries from the last N days, oldest first
  • vault usage - your plan and how much of it you use

Every answer is one or two spoken sentences in English or Spanish, never an identifier, never more than five options, nothing saved without confirmation. Account linking is real OAuth: Cognito with Google sign-in, PKCE, scoped tokens; without a linked account the server answers a bare 401 so Alexa+ starts linking.

How we built it

TypeScript on AWS Lambda, Cognito + Google for identity, Terraform/Terragrunt for everything, GitHub Actions with an OIDC deploy role. MCP TypeScript SDK v2 with dual-version serving (2026-07-28 and the 2025-11-25 era Alexa+ speaks), designed the voice surface from the Alexa+ voice guidelines, self-served the Protected Resource Metadata and RFC 8414 documents Alexa+ reads during linking, and put the whole thing behind a REST API with end-to-end X-Ray tracing to prove the 500 ms budget. We also wired a Bedrock AgentCore Gateway with a REQUEST interceptor that carries the end user's token in params._meta, so agent clients get per-user identity too.

Because Amazon's local inspector is partner-gated, we built our own: a localhost proxy and browser UI with the same endpoints and output files, a scripted Alexa+ driver that plays the conversation and checks every voice rule, built-in account linking, and a per-run recording with a certification verdict.

Challenges we ran into

  • Which locale does Alexa+ send? The docs don't say. We select the locale per request from four signals (tool argument, _meta.locale, Accept-Language, a deployment default) and log which one won.
  • Scope names. One page says Alexa+ requests fixed mcp:tools-style scopes, another says it requests whatever the PRM advertises — and Cognito can't mint a bare mcp:tools. We advertise Cognito-qualified scopes and keep a scope-rewriting façade one variable away.
  • 401 with or without WWW-Authenticate? The MCP spec says with, the Alexa+ quickstart says without. The Alexa profile answers bare.
  • Identity through AgentCore Gateway. It doesn't forward the caller's bearer to MCP targets and Cognito has no token exchange; the interceptor-into-_meta design, re-verified by the server, was the way through.
  • The toolkit itself. The CLI and inspector live in a private CodeArtifact registry behind an IAM role Amazon has to trust first - still AccessDenied for our account - so we built the inspector.
  • Small AWS surprises that only appear at apply time: Cognito rejecting parentheses in a resource-server name, the AgentCore credential provider's client_secret_arn being a list of objects.

Accomplishments that we're proud of

  • A voice surface that follows the rules by construction: five-option pages with tokens, read-backds in speech - enforced by tests, not by hoping.
  • Real account linking with standards (RFC 9728 → RFC 8414 → PKCE) and per-user data isolation for the Agent Core Gateway.
  • A full environment - 61 resources - deployed from a GitHub Actions OIDC role, with X-Ray from and on the 500 ms budget.
  • A local inspector with the shape of Amazon's, plus the pieces Amazon's doesn't have: a voice drigs you can hand to a reviewer.

What we learned

Voice is a different contract from chat: the model can't scroll, so pagination, confirmation and another tool design, not the prompt. Authorization for assistants is still young — three documents disagreed on scopes and 401s, the official tooling is gated, building a faithful stand-in is faster than waiting.

What's next for Vault for Alexa+

  • Run the official Alexa+ toolkit and inspector the moment access arrives, diff their verdict during the certification.
  • Settle the open platform questions with real traffic: the locale signal, the scope names Alexa+ credentials with a single client.
  • Enable gateway application logs and traces once we've proved request bodies aren't recorded; pub breakdown.
  • More voice: reminders from your own data ("you logged water three days this week").
  • Open-source the local inspector and the two Claude Code plugins we used to build this.

Built With

Share this project:

Updates

Submission history