Kairos Open-Source Fraud Decisioning Platform: Real-Time Risk Scoring Tuned by Coding Agents

Kairos is an open-source, Apache-2.0 fraud and risk decisioning platform from Finic. It evaluates sign-ups, logins, orders, payments and payouts in real time, returning approve, step up, review or block with a risk score and the reasons behind the decision.

Kairos positions itself as an open-source alternative to Sardine, Sift, Riskified and SEON. Its two main differentiators are agent-first tuning through MCP and decision models designed to catch fraud before a team has enough labels to train traditional machine-learning models.

What Kairos does

Kairos makes a real-time decision in one call. The response includes an outcome, a risk score and reasons derived from the subject's history, the devices, cards and addresses it shares with others, and the current session.

Kairos organizes fraud operations around three core capabilities:

  • Real-time decisions: one call returns approve, step up, review or block, with a risk score and reasons.
  • Workflows: a workflow can ask a decision model, score with a model, branch, call webhooks, open cases and decide again later.
  • Queues and cases: human reviewers work through cases, and their resolutions become labels for future model training.

Kairos keeps every decision together with the signals behind it. That record supports review, explanation and model improvement.

Agent-first tuning over MCP

Kairos exposes an MCP server so coding agents such as Claude Code, Cursor, Codex and VS Code can read decisions and build workflows. Every agent action is recorded under its key.

The intended workflow is that a coding agent performs the work of a fraud ML engineer:

  1. Build the workflow. The agent defines what to decide, which questions to ask a decision model, and which fields to score.
  2. Design experiments. The agent proposes variants such as a decision model alone, logistic regression on the customer's numbers, gradient-boosted trees, a stack of models, or the decision model's answers combined with the customer's numbers in one model.
  3. Let Kairos run the experiments. Kairos trains each variant on the oldest labeled data, chooses on the next portion and tests on the newest. It reports ROC-AUC, PR-AUC, the gain over a baseline with a 95% interval, and precision and recall at configured thresholds.
  4. Pick the winner and ship it. The agent explains its choice, applies the winning variant as the workflow's next version, and returns when new labels arrive.

The README includes an illustrative agent interaction in which chargebacks have risen and the agent is asked to find a better model for shopify_order and publish it if it wins. The agent designs six variants, runs an experiment, and reports that logistic regression on the order's numbers plus Grayson's answers wins with ROC-AUC 0.949 on validation and 0.930 on test, then publishes it as v6. Those figures are an example from the README, not an independent benchmark.

Decision models and traditional ML together

Kairos is built around Grayson, Finic's decision model. A user asks Grayson questions in plain language, such as whether a shipping address looks like a reshipper or whether an email is throwaway, and Grayson answers with calibrated probabilities.

Grayson is designed for cases where traditional ML is weak:

  • Few labels: Grayson works on day one, before a team has the thousands of chargebacks a supervised model needs.
  • Unstructured data: Grayson reads descriptions, emails, names, addresses, notes and item titles, which a gradient-boosted tree cannot directly consume.
  • Explanations: every answer corresponds to a question the user wrote, so every decision can state why.

Traditional models remain strong where decision models are weak. Logistic regression and gradient-boosted trees learn a customer's own outcomes precisely from the customer's own numbers, and they cost nothing per decision. Kairos supports logistic regression and XGBoost-compatible gradient-boosted trees trained inside Kairos or uploaded from outside.

Kairos lets teams combine both approaches. Grayson's answers become features next to the customer's own fields in a logistic regression or gradient-boosted tree, and experiments show which combination performs best on the customer's data.

Developer surface and deployment

Kairos provides SDKs for TypeScript (@finic-ai/kairos) and Python (finic-kairos), a CLI, an HTTP API and Docker-based self-hosting.

For Kairos Cloud, a user signs up at kairos.finic.ai, creates a sandbox environment and a secret key, and can then send events. To connect an agent, the user opens Settings › MCP in the console, enables the tool groups the agent needs, and creates a key. A Claude Code connection uses an HTTP MCP endpoint with a bearer token.

For self-hosting, Kairos requires Node.js 22, pnpm 10 and a Grayson API key from portal.finic.ai. No separate database setup is required because the server starts its own Postgres. The local development command is pnpm kairos dev, which runs the API on http://localhost:8787 and the console on http://localhost:5273. For a team deployment, the repository provides docker compose up --build.

The CLI supports signing up against a local server, logging in to a remote profile, creating secret keys, defining actions, importing events from CSV, running decisions and running workflows. The repository also includes integrations for Shopify orders and inbound webhooks from providers such as Stripe.

The codebase is split into apps/server for the HTTP API and MCP server, apps/console for the React and Vite web console, apps/cli for the kairos command, packages/core for the decision path and model scorers, packages/sdk and packages/sdk-python for clients, and packages/eval for the evaluation suite and experiments. Tests run with pnpm test, and the Python SDK tests run with pnpm test:python.

Licensing and community reaction

Kairos is licensed under the Apache License 2.0. At the time of writing, the Hacker News Show HN post had 37 points and 4 comments.

One commenter welcomed the project despite not needing it personally:

Not something I need but super cool that this is both open source and shows the realtime flow.

— @edude03

Another commenter noted a naming conflict:

There's a meta linux distribution with that name already :( https://kairos.io/

— @Messier43

The existing Kairos meta Linux distribution at kairos.io means the fraud and risk platform shares its name with an unrelated open-source project, which can affect discoverability and search results.

Sources