Volcan

Accessible code review through spoken dialogue, symbol spelling and code Braille, with explicit approval before any GitHub action.

Comment

Volcan lets blind and low-vision developers review AI-written code by ear and touch, then confirm a review bound to the exact commit.

Inspiration

A one-character edit can reverse an authorization check. For a developer listening to a raw diff, finding that change means navigating punctuation, deleted lines and added lines before reaching the risk. We wanted the risky change to be the first thing they hear, with precise code available when they ask for it.

What it does

Give Volcan a pull request or a patch. It returns a spoken explanation, a short sound cue and Unicode Braille of the code. The cue falls for a security finding and rises for a clean patch. Deterministic rules identify the risk before a model adds its explanation; the response always names whether Amazon Bedrock or the local engine answered.

A developer can open a real public pull request, ask for a numbered line, spell its symbols, leave a comment and request changes. Volcan reads back the proposed review and waits for confirmation. A single-use approval grant binds that action to the reviewed head commit. If the head changes, the approval expires. The public demo records the review as a dry run and sends nothing to GitHub.

Alexa+ and AWS

Volcan is a self-hosted Model Context Protocol server built for the Alexa+ MCP route. Its companion web client performs a real MCP handshake and replays Amazon’s documented Alexa+ request shapes against the live server. The Alexa+ front end is simulated: Amazon’s partner-only add-on tools were not available to us, and Alexa+ or an Echo has not called this server. The browser can provide speech recognition and speech synthesis, while typed commands and keyboard controls remain available.

Amazon Bedrock supplies the optional Claude Sonnet 5 explanation. AWS Lambda and Amazon API Gateway serve the app; Amazon DynamoDB preserves dialogue state and atomically claims approvals; AWS Secrets Manager supplies the signing secret; Amazon CloudWatch records operational metrics. Removing the AWS backend removes the hosted review and durable approval flow.

Challenges and improvements

Speech needs a stop path, asynchronous answers need to announce errors and completion, and a stale answer must not replace a newer review. The interface now handles these cases and preserves keyboard focus. Braille also needs explicit limits: eight-dot code mode reverses all 95 printable ASCII characters exactly, while six-dot literary mode is labelled lossy, including ambiguous number and capital prefixes. Unsupported characters are reported rather than silently presented as exact code.

What we accomplished

The current release passed 990 tests with 93.83% statement coverage, including browser interaction, credential isolation, approval, transport and Braille regressions. It is deployed on AWS, with the deployed package hash verified against the merged source. These checks establish engineering behavior; they do not establish accessibility outcomes for real users.

What we learned and what is next

The useful unit is a complete review turn: risk first, exact code on request, an action read back, and a deliberate human confirmation. Next we need sessions with blind and low-vision developers, a Braille transcriber’s review, and a test with an authorized Alexa+ host. No blind developer or buyer has tested Volcan yet. The potential payer is an employer providing workplace accommodation; willingness to pay remains a hypothesis.

How we built it

Python 3.11, FastAPI and Pydantic, with domain rules separated from adapters and HTTP interfaces. A hand-written MCP server implements JSON-RPC 2.0 and Streamable HTTP for revision 2025-11-25. It publishes 12 tools with argument schemas; selected tools also return structured content and an MCP Apps review card.

The core combines a Python diff parser, PCM WAV cue synthesizer, two Braille renderings, a review-dialogue state machine and signed single-use approval grants. DynamoDB conditional transactions claim an action and its nonce together. The public page uses local HTML, CSS and JavaScript, with no remote scripts. Terraform declares the core AWS resources; the current API Gateway ingress was configured separately.

Amazon Bedrock is optional for explanation, and every answer identifies its actual source. The deterministic path remains available when no model answers. Live GitHub reads are separate from staged review writes; public writes remain disabled.

Current limitations

Alexa+ is simulated by a real web MCP client; the add-on package is locally built and checked, not certified or deployed. No Alexa+/Echo or physical Braille-display journey is claimed. The smart-display frame is drawn by the web page. Browser speech is optional and the demonstration uses typed/button commands.

The public GitHub review action is a recorded dry run. Domain tests distinguish agent and human principals, but the public interface is not proof of independent real-world human identity. A real write requires an authorized reviewer credential and explicit enabling.

Eight-dot code Braille is exact for the 95 printable ASCII characters; unsupported/control characters are reported and tabs do not count as lossless. Six-dot literary Braille is always described as lossy for code, even when no character collision is listed. No transcriber or blind user has validated the tables.

Detection results use self-written synthetic patches, including 86.4% recall on 40 Python patches; they are not held-out or production accuracy. There is no buyer validation. Current deployment was verified by AWS status, source revision and package hash. No new model answer or fresh public browser journey is claimed for today’s release. The video shows an earlier working build and does not demonstrate every later UI/Braille fix.

Built With

Share this project:

Updates

Submission history