DEV Community: prathyusha k

I built the tool StackOne's CEO said every developer needs

prathyusha k — Wed, 10 Jun 2026 20:05:30 +0000

I wasted 30 minutes debugging my AI agent last month.

Stepped through the orchestration code, checked the prompt,
added console logs everywhere. Turns out the tool call itself
was failing. The agent had nothing to do with it.

Wrong BambooHR subdomain. Silent redirect. isError: false.
Classic.

StackOne's CEO posted about this exact problem — test your
tools via RPC before wiring into your agent. There's no easy
visual tool to do that. So I built one.

The 3 bugs that motivated this

Bug 1 — Accept header
StackOne's MCP server requires both application/json and
text/event-stream in the Accept header. Miss one and it
rejects the connection before processing anything.

Bug 2 — Silent BambooHR failure
isError: false and HTTP 200 — but the employee never
appeared. Wrong subdomain connected in StackOne. The response
was a redirect, not a creation. Always verify in the target
system, not just the response code.

Bug 3 — Wrong Slack tool name
I assumed slack_post_message. StackOne uses
slack_send_message. Never assume tool names match the
provider API. Always call tools/list first.

What I built

StackOne Agent Playground — 4 features, one goal: test
everything before your agent touches it.

RPC Tool Tester
Select integration, pick tool from auto-loaded list, fill
arguments, fire. See full response with isError badge and
latency. No more guessing tool names.

Token Visualizer
Full tool loading = 14,280 tokens. After Tool Discovery =
840 tokens. 94% reduction. Live bar chart with real numbers.

Workflow Simulator
4-step onboarding workflow — Greenhouse and BambooHR mock,
Notion and Slack live. Real pages created, real Slack messages
sent. Full audit trail per step.

Defender Tester
Paste any tool response, scan for prompt injection. Highlights
exact flagged phrases and explains the attack pattern.

One bug I hit building this

// This throws a runtime error in Vite
import { ToolCallResult } from '../types'

// This is correct — interfaces are type-only
import type { ToolCallResult } from '../types'

Classic TypeScript + Vite gotcha. import type tells Vite
the import is for type-checking only, not runtime.

Try it

git clone https://github.com/prathyushak828/stackone-agent-playground
cd stackone-agent-playground
npm install
cp .env.example .env
npm run dev

No backend. Mock mode works without any credentials.

GitHub: https://github.com/prathyushak828/stackone-agent-playground

Previous: AI Employee Onboarding Agent

I Built an AI Agent That Guards Your Credit Cards 24/7

prathyusha k — Thu, 28 May 2026 23:47:25 +0000

Hello, I am Prathyusha. When I decided to build a fraud detection agent, I did not just read about it. I built it from scratch.
This is the story of building FraudGuard AI — an agent that monitors every credit card transaction in real time, detects fraud using Claude AI, and blocks your card while you sleep.

What I Built
An AI agent that monitors all your bank accounts and credit cards in real time — using Claude AI as the fraud detection brain and a custom MCP server as the backbone.

One scan does everything:

http://localhost:3000/scan-all

Output:

Step 1: Fetching transactions... ✓ 10 transactions loaded
Step 2: Running rule checks... ✓ 5 flags raised
Step 3: Analyzing with Claude AI... ✓ Risk scores assigned
Step 4: Handling fraud... ✓ 1 card blocked, 2 emails sent
Step 5: Dashboard updated... ✓ Live feed refreshed

Scan complete in seconds.
Full action log written to memory.

The Problem It Solves
Most fraud alerts arrive after the damage is done:

→ Bank flags a transaction after it goes through
→ You get a notification too late
→ Attacker already has what they need
→ You spend hours disputing and waiting

That is the reality for millions of people every day. This agent catches fraud the moment it happens — and acts on it immediately.

What is MCP?
MCP stands for Model Context Protocol. It is an open standard that lets AI agents connect to external tools in a structured way.

Without MCP:

Agent → custom code → Plaid
Agent → different code → Gmail
Agent → another code → Block API

With a custom MCP server:

Agent → ONE MCP server → Plaid
→ Claude AI
→ Gmail
→ Block handler

One server. All tools. Clean architecture.

The Architecture

Browser / API call
↓
mcp-server.js — exposes all 11 tools
↓
plaid-client.js — fetches transactions
↓
claude-agent.js — fraud analysis
↓ ↓
Rule checks Claude AI (Anthropic API)
↓
block-handler.js — 2AM rule engine
↓ ↓
Auto-block Email approval (Gmail API)
↓
dashboard — live HTML/CSS/JS UI

Built in Node.js. 5 server files. Clean structure.

Tech Stack**

→ Language → Node.js + JavaScript
→ AI Brain → Claude AI (Anthropic API)
→ Bank Data → Plaid API
→ Agent Backbone → Custom MCP Server
→ Notifications → Gmail API
→ Dashboard → HTML + CSS + JS
→ Data → Mock data (safe for GitHub)

The 2AM Rule — My Favourite Feature
The biggest problem with fraud alerts is bad timing. They interrupt you at 3AM and you end up ignoring them. So I built a time-aware rule:

─────────────────────────────────────────
Before 2AM
A fraud alert email is sent with one-click YES / NO buttons.
Click YES → transaction approved, card stays active.
Click NO → card blocked instantly.
─────────────────────────────────────────
After 2AM
Agent auto-blocks the card immediately. No interruptions.
A full morning report arrives when you wake up.
─────────────────────────────────────────

No midnight interruptions. No missed fraud. The agent handles it either way.

3 Real Errors I Hit
These taught me the most about building AI agents.

─────────────────────────────────────────
Error 1 — Gmail OAuth redirect_uri_mismatch

Error 400: redirect_uri_mismatch
Access blocked: This app's request is invalid

Why: Created OAuth credentials as Desktop App type. Desktop Apps do not support redirect URIs, so the OAuth Playground rejected the request.

Fix: Delete the Desktop App credential. Create a new one as Web Application type. Add this exact URI to Authorized Redirect URIs:

https://developers.google.com/oauthplayground
─────────────────────────────────────────
Error 2 — Claude model deprecated

404: model claude-sonnet-4-20250514 not found
The model is deprecated and will reach end-of-life

Why: Used an outdated model string that had been deprecated by Anthropic.

Fix: One line change in claude-agent.js. Updated to the current model:

claude-sonnet-4-6
─────────────────────────────────────────
Error 3 — Gmail not configured fallback

[Gmail] Not configured — logging email to console instead

Why: The .env file still had placeholder values for Gmail credentials. The system silently fell back to console logging instead of throwing an error.

Fix: Complete the full OAuth Playground flow. Make sure all three Gmail values are real in .env:

GMAIL_CLIENT_ID=real_value
GMAIL_CLIENT_SECRET=real_value
GMAIL_REFRESH_TOKEN=1//real_value

Pro tip: Check your terminal for [Gmail] CONFIGURED ✅ on startup. That confirms Gmail is live before you test anything.
─────────────────────────────────────────

What I Learned About Building AI Agents

✓ Always check model names against current Anthropic docs — they deprecate fast
✓ OAuth credentials type matters — Web Application not Desktop App for redirect flows
✓ Use placeholder detection in code — fail loudly when keys are missing
✓ Mock data is not just for testing — it makes your repo safe and instantly runnable
✓ Time-aware logic makes agents feel genuinely intelligent, not just automated
✓ Hybrid detection (rules + AI) is stronger than either approach alone
Results

✓ Plaid connected → 10 mock transactions loaded across 3 accounts
✓ Claude AI running → 82% confidence on Frankfurt fraud detection
✓ Gmail live → Fraud alert email sent with YES / NO buttons
✓ Card blocked → One click in email blocks card instantly
✓ Dashboard live → Real-time feed, alerts, and card controls
✓ GitHub ready → Mock data, .env.example, full README

Final Thought
Building this agent taught me that AI is most powerful when it understands context — not just data. Claude AI did not just flag the Frankfurt transaction because it was foreign. It understood the combination of foreign location, unknown merchant, and 2AM timing together.

That kind of contextual reasoning is what separates an AI agent from a simple rule engine.

And the 2AM rule? That is just good product thinking. The best automation knows when to act and when to ask.

Running With Mock Data vs Your Real Cards
The project ships with mock data by default. This means you can clone it, run it, and see the full fraud detection working instantly — no bank account needed.

What mock data includes

✓ 10 realistic fake transactions across 3 accounts
✓ 2 high-risk scenarios — Frankfurt foreign transaction, CryptoExchange at 3AM
✓ 3 medium-risk scenarios — velocity attack, $1.00 test charge, luxury jewelry store
✓ 5 normal transactions — Starbucks, Shell, Netflix, Whole Foods, Texas Roadhouse
✓ Pre-assigned risk levels and fraud reasons for instant testing

If you want to connect your real cards
You need to replace 3 things in the project:

Step 1 — Get a Plaid account
→ Go to dashboard.plaid.com and create a free developer account
→ Get your PLAID_CLIENT_ID and PLAID_SECRET
→ Add both to your .env file

Step 2 — Replace mock data with live Plaid data
In server/plaid-client.js, the switch is already built in. The file automatically detects whether your Plaid keys are real or placeholders:

→ Placeholder keys → runs on mock data automatically
→ Real Plaid keys → fetches live transactions from your bank

No code changes needed. Just add your real keys to .env and restart.

Step 3 — Connect your bank via Plaid Link
→ Plaid uses OAuth — your bank password is entered directly on your bank's website
→ The app never sees your actual login credentials
→ Plaid never shares raw card numbers — only transaction metadata
→ Start with Plaid Sandbox mode to test with fake bank data first

Important — what Plaid shares vs what stays private

✓ Transaction amounts → shared
✓ Merchant names → shared
✓ Transaction timestamps → shared
✓ Tokenized account IDs → shared
✗ Your actual card number → never shared
✗ Your bank login credentials → never shared
✗ Your CVV or PIN → never shared

This is why Plaid is trusted by apps like Venmo, Robinhood, and thousands of others. Your sensitive details never leave your bank.

Full Code on GitHub
https://github.com/prathyushak828/FraudGuard-AI-AI-powered-fraud-detection-agent

If you are building AI agents that work with real-world APIs and need intelligent decision-making — Claude AI and a custom MCP server is worth your time.

MCP #AI #NodeJS #FraudDetection #Claude #Anthropic #BuildInPublic #SideProject

I build an AI agent using StackOne MCP

prathyusha k — Tue, 05 May 2026 21:18:19 +0000

Hello myself Prathyusha. When I decided to apply to StackOne, I did not send
a resume first. I built something with their platform first.

This is the story of building an AI agent using StackOne MCP.

What I Built

An AI agent that onboards a new employee across
4 enterprise platforms automatically — using
StackOne MCP as the single integration gateway.

One command does everything:

npm run onboard --
example employee name: Priya Sharma

Output:

Step 1: Fetching candidate... ✓ Priya Sharma
Step 2: Creating BambooHR record... ✓ Employee #115
Step 3: Creating Notion page... ✓ Checklist created
Step 4: Sending Slack message... ✓ Team notified

Onboarding complete in seconds.
Audit trail written to audit-log.json.

The Problem It Solves

Most companies onboard employees manually:

HR types data into BambooHR by hand.
Someone creates a Notion doc from scratch.
Manager writes a Slack welcome manually.
IT gets notified separately.

That is 2 to 4 hours of manual work per new hire.
This agent does all of it in seconds.

What is StackOne MCP?

MCP stands for Model Context Protocol.
It is an open standard that lets AI agents
connect to external tools in a structured way.

Without StackOne:
Agent → custom code → BambooHR
Agent → different code → Notion
Agent → another code → Slack

With StackOne MCP:
Agent → ONE endpoint → BambooHR
→ Notion
→ Slack

One API key. One endpoint. 260+ integrations.
Auth, retries, and audit logging handled
automatically by StackOne's Falcon engine.

The Architecture

CLI input
↓
src/index.ts — reads candidate name
↓
src/agent.ts — orchestrates 4 steps
↓
src/stackone.ts — MCP client
↓
api.stackone.com/mcp
↓ ↓ ↓
BambooHR Notion Slack
↓
audit-log.json

Built in TypeScript. 9 files. Clean structure.
Supports multiple candidates in one command:

npm run onboard -- john sarah alex priya

Tech Stack

Language → TypeScript
Runtime → Node.js + tsx
Gateway → StackOne MCP server
HRIS → BambooHR
Docs → Notion
Messaging → Slack
Audit → JSON file

3 Real Errors I Hit

These taught me the most about StackOne MCP.

─────────────────────────────────────────
Error 1 — Missing Accept Header

Not Acceptable: Client must accept both
application/json and text/event-stream

Why: StackOne MCP uses streaming protocol.
Must declare support for both formats.

Fix: Add this header to every request:

"Accept": "application/json, text/event-stream"
─────────────────────────────────────────
Error 2 — Silent BambooHR Redirect

No error thrown. Agent said success.
Employee never appeared in BambooHR.

The response was returning:
"location": "https://www.bamboohr.com"

Instead of:
"location": "https://api.bamboohr.com/
.../mytestorg/.../employees/115"

Why: Wrong BambooHR account connected
in StackOne. Requests went to wrong instance.

Fix: Delete wrong account in StackOne.
Re-link with correct subdomain: mytestorg.
─────────────────────────────────────────
Error 3 — Wrong Slack Tool Name

MCP error -32602: Tool slack_post_message
not found

Why: StackOne names tools differently
from the underlying provider APIs.

Fix: Called tools/list to see all Slack tools.
Correct name was slack_send_message.
Field name was channel_id not channel.

Pro tip: Always use tools/list before
assuming tool names. Saves hours of guessing.
─────────────────────────────────────────
What I Learned About StackOne MCP

Always accept text/event-stream in headers.
Each integration has its own Account ID.
Use tools/list to find exact tool names.
All tools wrap fields inside body object.
Wrong account = silent redirect, not error.
StackOne Logs shows every API call made.

Results

BambooHR → Employee #115 created ✓
Notion → Onboarding page with Day 1 checklist ✓
Slack → Welcome message in #onboarding-alerts ✓
Audit → 4 timestamped entries logged ✓

Final Thought

StackOne MCP made connecting to 4 enterprise
platforms easier than connecting to one platform
the traditional way.

One API key replaced four SDKs.
One endpoint replaced four auth systems.
One integration replaced months of work.

Full code on GitHub:
github.com/prathyushak828/stackone-onboarding-agent

If you are building AI agents that need to touch
enterprise SaaS — StackOne MCP is worth your time.

StackOne #MCP #TypeScript #AIAgents #BuildInPublic