DinoAlert: Catching Incidents Before the Phone Rings

This is a submission for the MLH x DEV Writing Challenge

What I Built

DinoAlert is an early-warning system for small businesses, built by team Dinobotics. Its tagline: "Detect today, avoid the call." It won Best Use of Solana and Best Use of Tiger Data at Road To Tech 2026.

In many small businesses, "the IT team" is one person, or the owner. Nobody watches dashboards all day, so they find out about a problem the worst way: when an angry customer calls. The Zikit challenge, "Before the phone rings," put a name to it: detect real incidents before they hit, without crying wolf. If you alert on everything, nobody believes you.

DinoAlert ingests per-minute telemetry (CPU, RAM, disk, latency, errors) plus server, firewall and app logs. It learns what "normal" looks like for each company and raises an alert with a confidence level, evidence and a suggested next step, before the incident reaches customers. It also tells real problems apart from things that only look bad, like nightly backups, payroll runs and bulk loads. Those get explained, not alerted.

Everything is shown in a 3D monitoring scene where each component has a visible state. A pink T-Rex mascot announces new alerts out loud, and a built-in assistant explains what's happening in plain language for non-technical users.

Results: on a test dataset with four companies the system had never seen (a dental clinic, a hardware store, a school and a logistics company), DinoAlert warned about 12 of 12 incidents before impact, with a median lead time of about 4 hours and one false alarm. It's real software, not a mockup: it ran in production during the hackathon, and anyone can run it locally and test it with their own data.

How it's built

• Frontend: React 18 and Three.js used directly (no React Three Fiber). The scene lives in a single SceneController class that React drives through methods, so a state change updates colors and labels without rebuilding the scene. Charts are custom SVG instead of a charting library, which saved about 400 KB. Seven views: monitoring, alerts, infrastructure, diagnosis, history, data and settings.
• Accessibility: fully keyboard-accessible, with a 2D fallback when WebGL isn't available. States never rely on color alone: each has an icon, a text label and a distinct shape in the legend. It also respects prefers-reduced-motion.
• Backend: a FastAPI API for ingestion, metrics, alerts and tenants, plus a separate worker that runs the detector minute by minute, using only data up to minute t, never the future.
• Data onboarding: POST /api/ingest accepts a ZIP with one or more companies and creates an isolated tenant per company, so people can try it with their own data without seeing anyone else's.

What I learned

• No peeking into the future. Every alert at minute t can only use data up to t, so the detector had to be fully incremental. We test it by running with data up to t and up to t+k and requiring identical alerts.
• Decoys are hard. Backups and payroll runs look exactly like incidents. We use each company's business context and repeating patterns to tell them apart.
• Dirty data is the norm. Empty cells and telemetry blackouts are treated as missing, never as zero.
• Measure honestly. Our first evaluation was too generous and counted alerts from other incidents as hits. We rebuilt it to be stricter.
• Trust is the product. An alert system is only useful if people trust it, and automated actions are only safe if you can prove who authorized them.
• Watch your cloud bill. Our production VM ended up costing more than we expected, so we shut it down after the event. Since the whole stack runs from one Docker Compose file, anyone can still spin it up locally.

What's next: more lead time on slow incidents (e.g. estimating hours until a disk fills up), a single alert per incident that escalates instead of repeating, and real-time notifications when a high-risk alert appears.

Demo

The live deployment is offline now (see the cost lesson above), but you can run everything locally:

git clone https://github.com/galleto/Dino-Alert
cd Dino-Alert
docker compose --profile local up -d --build
# open http://localhost:3000

• 💻 Repo: github.com/galleto/Dino-Alert

Screenshot

Partner Technologies

Tiger Data (TimescaleDB on Tiger Cloud) 🏆 Best Use of Tiger Data: We didn't use Tiger Data as our main database. We used it as a data manipulation layer, to give our telemetry a different approach. Because it's standard PostgreSQL, data could reach it as a ZIP upload, through the API, or with plain SQL INSERTs, and from there we could query and reshape per-minute metrics and logs with SQL. That flexibility made onboarding a new company easy, and uploads stay isolated per company. Locally, Docker Compose spins up its own TimescaleDB, and for the cloud setup we point DATABASE_URL at Tiger Cloud.

Solana 🏆 Best Use of Solana: Certifies every action taken by the AI or by a user. If an AI can act on a server, someone must be able to prove who authorized each action. Each action and its log is signed with an authorized key and recorded, so the server rejects commands without a valid signature, an intruder without the key can't act, and every action leaves a verifiable trail for audits. The idea of using Solana for this came out of a brainstorm with my teammate Josafath.

Vultr: We used Vultr only for deployment. Production ran on a Vultr VM with Docker Compose (frontend, API and worker), with nginx serving the app and proxying /api. The same compose file runs locally, so what we tested is what we shipped. The VM turned out to be the main cost of the project, so we took it down after the hackathon.

Gemini: Powers the chatbot inside the dashboard. It helps non-technical users understand their alerts and what they can do in the panel, in plain language. For a tool aimed at people who aren't IT experts, this was key.

ElevenLabs: ElevenLabs is built for voices, but we used it to create the notification sounds for our alerts. The T-Rex mascot's phrases are generated in four voices (Tía Paola, Flor, David and Diego), one MP3 per state and voice, and they play when an alert appears or changes severity. Users pick their voice in Settings (David by default). We also handled browsers that block autoplay: the intro audio plays after the first interaction.

Hackathon Experience

We built DinoAlert at Road To Tech 2026, on October 9 and 10 at TecNM Campus Saltillo.

Our team, Dinobotics, had three people:

• Gael (me): team lead. I built most of the project: the detector, backend, frontend and deployment.
• Josafath: helped with the software and brought great ideas, especially using Solana to certify actions.
• Nahomi: designed the 3D dinosaur and built the website.

It was special for me because Road To Tech took place at my own university. I got to build alongside my friends, and I also met people from sister schools, which made the whole event feel like a community more than a competition.

🏆 Results: we didn't win the Zikit challenge, the company challenge DinoAlert was built for. But we won two MLH categories: Best Use of Solana and Best Use of Tiger Data. Our prizes were a SenseCAP T1000-E card tracker for Meshtastic and an Elgato Stream Deck Mini. Our pink plush T-Rex stayed to guard them.