Show HN: Kairos – Open-source risk and fraud decisioning platform

What it claims

Kairos is a TypeScript monorepo from Finic that positions itself as an open-source alternative to Sardine, Sift, Riskified and SEON. It claims two differences from those products: a coding agent connected over MCP does the tuning work of a fraud ML engineer, and Grayson, Finic's hosted decision model, catches fraud before enough labels exist to train a conventional model. Each decide call returns a decision, a risk score and reasons. These draw on the subject's history, the devices, cards and addresses it shares with other subjects, and the session.

How it works

Grayson answers plain-language questions you write, such as "Is this email throwaway?", with calibrated probabilities. It also reads unstructured fields like names, addresses, notes and item titles. Those answers become features next to your numeric fields in logistic regression or gradient-boosted trees (XGBoost-compatible). The trees are trained in Kairos or uploaded. Analysts resolve cases in review queues, and those resolutions become labels.

Experiments use a time-ordered split. Each variant trains on the oldest labeled data, model selection uses the next slice, and testing uses the newest. The report gives ROC-AUC, PR-AUC, gain over a baseline with a 95% interval, and precision and recall at your thresholds. Candidate variants are Grayson alone, logistic regression, gradient-boosted trees, a stack, or Grayson answers combined with your numbers. The agent applies the winner as the workflow's next version. Every MCP action is recorded under the key that made it.

flowchart LR
  E[Events: signups, logins, orders] --> D[decide]
  G[Grayson answers] --> D
  D --> A[approve / step_up / block]
  D --> R[review queue]
  R --> L[labels]
  L --> X[experiment via MCP agent]
  X -->|winner published| D

Evidence

The page gives no benchmark. The only figures, ROC-AUC 0.949 on validation and 0.930 on test for logistic regression plus Grayson answers on a shopify_order workflow, appear in an illustrative agent dialogue. The page names no dataset, size or baseline for them.

How to use it

The hosted service is at kairos.finic.ai. To connect Claude Code (Cursor, Codex and VS Code use the same pattern):

claude mcp add --transport http kairos https://kairos.finic.ai/mcp --header "Authorization: Bearer ksk_…"

The SDKs are @finic-ai/kairos (npm) and finic-kairos (pip). The core API shape:

await kairos.defineAction("withdrawal", { subject: "user", hold: "Should this withdrawal be held because the account shows signs of fraud or takeover?" });
kairos.track("login", { userId: "user_42", deviceId: "dev_9", ipCountry: "GB" });
const decision = await kairos.decide({ type: "withdrawal", userId: "user_42", usd: 900 });

Self-hosting needs Node.js 22, pnpm 10 and a Grayson API key from portal.finic.ai. The server starts its own Postgres.

pnpm install
cp .env.example .env     # set GRAYSON_API_KEY
pnpm kairos dev

This serves the API on port 8787 and the console on 5273. docker compose up --build is the team setup. The CLI imports history from CSV, for example pnpm kairos import events transactions.csv --type transaction --ts created_at --entity user=customer. The stack is Hono on Node.js with Drizzle and Postgres for the server, plus React and Vite for the console. Stripe events arrive through inbound webhooks.

Limits

The code is Apache 2.0, but self-hosting still requires a Grayson key from Finic. Grayson is the component behind the cold-start and unstructured-data claims, so those capabilities depend on Finic's external service. The page describes conventional models as costing nothing per decision and does not state Grayson's per-call cost. The Shopify app is not self-serve: it is available by contacting Finic on Discord or at support@finic.ai. The docs include a "what it does not do" section, but its content is not shown on the page.