Xvimo

Xvimo receives suspicious messages on WhatsApp and web as an open-source AI agent, checks before Nigerians send money, with a verdict, reasons and evidence in English, Pidgin, Yoruba, Hausa or Igbo.

Comment

Inspiration

A month before this project on September 12, 2026, the punch news paper published that Nigerians savings to Ponzi scheme, it's not just that month alone, it's a pattern I have noticed over the years that people loose money to a certain rampant scheme that end up being a scam, this happens because they have no means to verify the source of that scheme, Some of the common patterns of their message is "Your BVN has been blocked, call this number", "Invest ₦50,000 today and earn ₦200,000 every week", or an interview invite from a company nobody can find. Ponzi schemes, fake jobs, loan-app fraud and bank impersonation take people's savings every year, and the people most at risk don't read regulator circulars or search company registries. They live on WhatsApp, and they have a few seconds to decide whether to pay.

I wanted a tool that meets them exactly there: forward the message, get a straight answer, with the evidence, in your own language.

What it does

Xvimo is an open-source scam checker built for Nigeria. You paste or forward a suspicious message (or a screenshot of one) on WhatsApp or the web demo, and Xvimo replies with:

  • a clear verdict: 🚨 Likely scam, ⚠️ Suspicious or ✅ No red flags found
  • the reason, in plain language
  • cited evidence when it searched: regulator warnings, news reports, company records
  • a reply in English, Nigerian Pidgin, Yoruba, Hausa or Igbo

Every step is shown live on the web demo: the triage, the routing decision, each search the agent runs and the final verdict. Xvimo also recognises abusive, sexual or threatening messages and gives block-and-report advice.

Xvimo also ships an MCP server, so Claude Desktop, Cursor or any AI agent can call check_message as a tool. We published the shareable part of our test set as NaijaScamBench on Hugging Face.

How we built it

Xvimo is a two-tier agent. Every model runs on Nebius Token Factory.

  1. Triage: NVIDIA Nemotron 3 Nano (30B, 3B active). Nano reads each message and returns structured JSON: verdict, confidence, scam type, language, organisations, links, promised returns and red flags. It answers clear cases in about a second, for about $0.14 per 1,000 messages.
  2. Routing, decided in code, not by the model. A missed scam is far worse than a false alarm, so routing is asymmetric. Nano may raise an alarm on its own. It may only clear a message on its own when it is confident and the message avoids every high-risk topic (BVN, ATM blocks, investments, loans, job interviews, prizes, links, codes, fees, romance openers). Messages in Yoruba, Hausa or Igbo are never cleared by Nano alone.
  3. Investigation: NVIDIA Nemotron 3 Ultra (550B, 55B active) agent. Ultra gets two tools through native tool calling: web_search and search_regulators (restricted to the SEC, CBN, EFCC, FCCPC, NCC, NIMC, CAC and NDIC). It writes its own queries, searches again if the evidence is thin (at most 3 rounds), and returns a verdict with citations. Every cited URL is checked against the pages the agent actually retrieved; anything else is removed.
  4. Screenshots are read by MiniCPM-V 4.5 (falling back to Gemma 3 27B), and the text goes through the same pipeline.

Stack: Python and FastAPI; WhatsApp through the 360dialog API; Tavily for search; Neon Postgres for an anonymous event log; a Docker image on GitHub Container Registry deployed on Render; LangSmith tracing (with phone numbers and emails masked) for every benchmark run; and an admin dashboard showing routing, cost, latency and usage.

I benchmarked the whole thing on 330 labelled Nigerian messages (169 scam, 161 legit) against five open models given the same prompt:

System Accuracy Scams caught False alarms Cost / 1,000 msgs
Nemotron 3 Ultra (single pass) 96.4% 98.8% 6.2% $2.27
Gemma 3 27B (single pass) 96.4% 99.4% 6.8% –
Nemotron 3 Nano (single pass) 93.6% 95.9% 8.7% $0.14
Xvimo pipeline (Nano → Ultra agent) 93.6% 97.6% 10.6% $3.90
Nemotron 3 Super (single pass) 78.8% 99.4% 42.9% –

Challenges we ran into

  • Getting onto WhatsApp. My Meta's test number was locked by automated checks after the first messages. Twilio's trial requires templates that trial accounts can't create, and Vonage's sign-up verification failed. I finally shipped on the 360dialog sandbox. The pipeline is separate from the messaging layer, so each switch only touched a thin bot file.
  • Hosting from Nigeria. Billing setup for some platforms didn't support my country, and free Docker hosting options had changed. We moved to Render with a free Postgres database and a keep-alive job.
  • The agent was too cautious, and then not cautious enough. The benchmark I used showed the full agent pipeline was less accurate than a single Ultra call, mainly because it called routine bank alerts and reminders "suspicious". When I told it to relax, it started clearing fake job invites, which in Nigeria rarely ask for money in the text: the fee comes at the venue. Getting this balance right took several measured rounds, not guesses.
  • Running out of search credits mid-benchmark. The web-search credits ran out partway through the revised agent's run, so I recorded that run's improvement (168 of 169 scams caught) only as a partial result.
  • Thin local-language data. I had 32 Pidgin messages but only 4 each in Yoruba, Hausa and Igbo, so I say so rather than claim 100%.

Accomplishments that we're proud of

  • A working product, not a notebook: live on WhatsApp and the web, used by real people in an open beta (83 real checks in the first three days it opened to the public).
  • An honest benchmark. I published the table above even though it shows our own pipeline losing to a single model call on accuracy, and I explain what the agent adds: evidence, regulator lookups and a reason people can act on.
  • No invented sources: every citation is verified against what the agent actually opened.
  • Open source end to end: open models on Nebius Token Factory, MIT-licensed code, an MCP server any agent can use, and NaijaScamBench, a public Nigerian scam dataset.

What we learned

  • Don't let the cheap model say "safe". Fixing false alarms in the prompt made the model too lenient on real scams. Moving the final "is it safe?" decision for risky topics out of the model and into code fixed both.
  • An agent needs strict verdict rules. "Suspicious" has to mean a concrete red flag, not "I'm unsure".
  • Measure before you claim. Early numbers on 10 to 50 tuning messages looked perfect. 330 messages told the truth.
  • Context is the product. Nigerian scams have their own shape (BVN alerts, venue interviews, "only 10 slots"), and a model only catches them reliably when it's told what they look like.

What's next for Xvimo

  • Finish the agent tuning and rerun the benchmark on new, unseen messages, publishing the result transparently.
  • Native-speaker review and many more Yoruba, Hausa and Igbo messages, added to NaijaScamBench.
  • Move from the WhatsApp sandbox to a production number, so anyone can message Xvimo directly.
  • A shareable verdict card people can forward to the family group that sent them the scam.
  • Scam radar: anonymous, aggregated trends of what scams are circulating this week, for journalists and regulators.
  • Expand beyond Nigeria, starting with Ghana and Kenya, adding their regulators and languages.

Built With

  • 360dialog
  • css
  • docker
  • fastapi
  • gemma
  • github-actions
  • html
  • hugging-face
  • langsmith
  • mcp
  • minicpm-v
  • nebius-token-factory
  • nemotron-nano
  • nemotron-ultra
  • neon
  • nvidia-nemotron
  • postgresql
  • python
  • render
  • tavily
  • uvicorn
  • whatsapp
Share this project:

Updates

Submission history