WanderWrap

Remember the person. Find the gift—without spoiling the surprise.

Comment

Inspiration

WanderWrap began when I wanted to surprise my partner with a gift they would genuinely enjoy—but asking directly would spoil the surprise. The useful clues were already in ordinary memories: interests they had mentioned, things they enjoyed doing, and moments we had shared. The challenge was turning those clues into a thoughtful choice without becoming intrusive.

What it does

WanderWrap is a consent-first gifting companion for Alexa+ and the web. Instead of starting with a product keyword, it builds a visible Gift Brief from:

  • the relationship, occasion and emotional message;
  • deliberately selected evidence such as a remembered comment, known hobby, requested item or public excerpt;
  • interests the giver explicitly confirms;
  • budget, timing, exclusions and practical constraints.

Bounded specialists then compare four genuinely different gift directions. Every direction exposes its fit, recipient value, effort, trade-off and a possible failure mode. The chosen direction becomes a complete gift plan with a recipient check, delivery requirement, editable note and explicit approval boundary. Only then does WanderWrap prepare an Amazon handoff. Nothing is silently purchased.

The public production demo runs at https://www.wanderwrap.co.uk/gift-finder and needs no account.

How we built it

The Alexa+ path is a self-hosted Model Context Protocol server using specification 2025-11-25 and Streamable HTTP. It exposes recommendation and routing tools plus an adaptive ui:// MCP App gift board. A clearly labelled browser-based Alexa+ journey preview demonstrates the hackathon's permitted simulated-experience path while using the same consent and approval boundaries.

The shared core applies consent and approval policy, invokes least-privilege specialist agents, selects registered provider adapters and stores tenant-scoped state in encrypted DynamoDB. AWS Lambda and API Gateway host the development MCP/API runtime. Amazon Cognito provides authorization-code + PKCE identity and resource scopes. CloudWatch provides logs and alarms. GitHub Actions deploys through short-lived AWS OIDC roles. The Next.js companion runs on Vercel and calls server-side routes without exposing provider credentials.

An optional Amazon Bedrock Runtime adapter improves explanation wording. Deterministic ranking and explanations remain available if the model is unavailable.

Key features

  • Surprise without surveillance: selected evidence is processed transiently; sensitive text is discarded and proposed interests require confirmation.
  • A visible Gift Brief: assumptions, confirmed interests, constraints and uncertainty are inspectable before recommendations.
  • Meaningfully different directions: safe delight, shared creative ritual, lasting ritual and shared memory are compared—not four copies of one product.
  • Visible agent evidence: ten specialist roles leave concrete artifacts across privacy, clues, constraints, curation, recipient fit, routing, story and approval.
  • Alexa+-ready MCP: Streamable HTTP, protocol 2025-11-25, protected-resource discovery, scoped bearer validation, tool discovery and MCP Apps UI.
  • Safe Amazon handoff: Amazon owns the actual product, live price, availability, delivery and checkout. The fallback is disclosed and never described as a transaction.
  • Explicit approval: no purchase, payment, transfer, address disclosure or private-data action occurs silently.

Challenges

Official Alexa+ add-on tooling for this account still depends on selected-partner enablement and Amazon's private package registry. Identity verification alone did not unlock that package. We therefore built and tested the required self-hosted MCP server and used the hackathon's explicitly supported simulated Alexa+ web experience, while documenting the remaining official-onboarding gate.

Coordinating OAuth across Cognito, API Gateway, Lambda, Vercel and the pending Alexa redirect URI also required careful separation between the web PKCE client and Alexa's confidential client.

Accomplishments

  • A production seven-stage web journey from emotional intent to safe Amazon handoff.
  • A deployed AWS development MCP/API stack with Cognito, Lambda, API Gateway, DynamoDB, CloudWatch and isolated deployment roles.
  • A responsive MCP App plus voice-safe output.
  • Signed payload-bound approvals, tenant boundaries, idempotency and safe write behavior.
  • 94 automated contracts plus 3 authenticated HTTP end-to-end tests.

What we learned

Personalization does not have to mean surveillance. Confirmation is both a safety boundary and a useful product interaction. We also learned that recommendation quality and fulfilment confidence must be separate decisions—especially in voice interfaces, where an optimistic sentence can sound like a completed transaction.

What's next

We will complete official Alexa+ partner onboarding and Web Simulator evidence, connect approved Amazon Creators API credentials for provider-sourced catalogue facts, and finish the PayPal sandbox create/approve/capture/signed-webhook loop. Capabilities will only be labelled live after their credential, provider-sandbox and end-to-end evidence gates pass.

Testing

Run npm install, npm run check, and npm run test:e2e. The first command builds the Alexa MCP App and Next.js app, validates the AWS handler, and runs 94 contracts. The HTTP suite proves health, OAuth metadata, bearer/origin enforcement, MCP initialization, discovery, recommendation, routing and rejection of an unapproved write.

The public Gift Finder is live without an account. Amazon catalogue results, payments and official Alexa+ Web Simulator execution are not presented as live without their remaining provider evidence.

Built With

Share this project:

Updates

Submission history