Claude's Corner: MouseCat, AI Agents That Investigate Fraud

---
description: Build a MouseCat clone, AI-powered fraud investigation agents
---

# Build MouseCat: AI Agents for Fraud Investigation

## What You're Building
An AI-powered fraud investigation platform where LLM agents automatically investigate flagged transactions by querying databases, analyzing user behavior, cross-referencing evidence, and producing explainable decisions. The system learns from each case and generates backtested fraud detection rules.

## Tech Stack
- **Frontend:** Next.js 14 + TypeScript + Tailwind CSS + shadcn/ui
- **Backend:** Next.js API routes + Python (FastAPI) for ML pipeline
- **Database:** Supabase (PostgreSQL) for cases, users, rules, evidence
- **AI/ML:** Claude API (or OpenAI) for investigation agents with tool-calling
- **Key Libraries:** @anthropic-ai/sdk, zod, recharts, react-flow (for evidence graphs)

## Step 1: Project Setup

```bash
npx create-next-app@latest mousecat-clone --typescript --tailwind --app --src-dir
cd mousecat-clone
npx shadcn@latest init
npm install @anthropic-ai/sdk zod @supabase/supabase-js recharts reactflow
```

Create `.env.local`:
```
ANTHROPIC_API_KEY=your_key
NEXT_PUBLIC_SUPABASE_URL=your_url
NEXT_PUBLIC_SUPABASE_ANON_KEY=your_key
SUPABASE_SERVICE_ROLE_KEY=your_key
```

## Step 2: Core Data Models

Run these SQL migrations in Supabase:

```sql
-- Cases table: each flagged transaction becomes a case
CREATE TABLE cases (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  external_id TEXT,
  status TEXT DEFAULT 'open' CHECK (status IN ('open', 'investigating', 'resolved', 'escalated')),
  severity TEXT DEFAULT 'medium' CHECK (severity IN ('low', 'medium', 'high', 'critical')),
  type TEXT NOT NULL,
  transaction_data JSONB NOT NULL,
  user_profile JSONB,
  decision TEXT,
  decision_reasoning TEXT,
  evidence JSONB DEFAULT '[]'::jsonb,
  investigation_log JSONB DEFAULT '[]'::jsonb,
  rules_triggered TEXT[],
  created_at TIMESTAMPTZ DEFAULT NOW(),
  resolved_at TIMESTAMPTZ,
  assigned_to UUID
);

-- Rules table
CREATE TABLE fraud_rules (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name TEXT NOT NULL,
  description TEXT,
  condition JSONB NOT NULL,
  severity TEXT DEFAULT 'medium',
  precision FLOAT,
  recall FLOAT,
  true_positives INT DEFAULT 0,
  false_positives INT DEFAULT 0,
  status TEXT DEFAULT 'candidate' CHECK (status IN ('candidate', 'testing', 'active', 'disabled')),
  generated_from UUID REFERENCES cases(id),
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- Evidence table
CREATE TABLE evidence (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  case_id UUID REFERENCES cases(id) ON DELETE CASCADE,
  type TEXT NOT NULL,
  source TEXT NOT NULL,
  data JSONB NOT NULL,
  risk_signal TEXT,
  summary TEXT,
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- Transactions event store
CREATE TABLE transactions (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id TEXT NOT NULL,
  amount DECIMAL(12,2) NOT NULL,
  currency TEXT DEFAULT 'USD',
  merchant TEXT,
  category TEXT,
  ip_address TEXT,
  device_fingerprint TEXT,
  location JSONB,
  metadata JSONB,
  is_fraudulent BOOLEAN,
  created_at TIMESTAMPTZ DEFAULT NOW()
);
```

## Step 3: Investigation Agent (Core Feature)

Create `src/lib/agents/investigator.ts`:

```typescript
import Anthropic from '@anthropic-ai/sdk';
import { createClient } from '@supabase/supabase-js';

const anthropic = new Anthropic();
const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY!
);

const INVESTIGATION_TOOLS = [
  {
    name: 'query_user_history',
    description: 'Get transaction history for a user',
    input_schema: {
      type: 'object' as const,
      properties: { user_id: { type: 'string' } },
      required: ['user_id']
    }
  },
  {
    name: 'check_ip_reputation',
    description: 'Check if an IP is associated with fraud/VPNs',
    input_schema: {
      type: 'object' as const,
      properties: { ip_address: { type: 'string' } },
      required: ['ip_address']
    }
  },
  {
    name: 'analyze_device_fingerprint',
    description: 'Check how many accounts share this device',
    input_schema: {
      type: 'object' as const,
      properties: { fingerprint: { type: 'string' } },
      required: ['fingerprint']
    }
  },
  {
    name: 'search_similar_cases',
    description: 'Find past cases with similar patterns',
    input_schema: {
      type: 'object' as const,
      properties: { pattern: { type: 'string' } },
      required: ['pattern']
    }
  },
  {
    name: 'record_evidence',
    description: 'Record evidence found during investigation',
    input_schema: {
      type: 'object' as const,
      properties: {
        type: { type: 'string' },
        source: { type: 'string' },
        data: { type: 'object' },
        risk_signal: { type: 'string', enum: ['high_risk', 'neutral', 'low_risk'] },
        summary: { type: 'string' }
      },
      required: ['type', 'source', 'data', 'risk_signal', 'summary']
    }
  },
  {
    name: 'make_decision',
    description: 'Make a final fraud determination',
    input_schema: {
      type: 'object' as const,
      properties: {
        decision: { type: 'string', enum: ['legitimate', 'fraudulent', 'needs_review'] },
        reasoning: { type: 'string' },
        confidence: { type: 'number' }
      },
      required: ['decision', 'reasoning', 'confidence']
    }
  }
];

export async function investigateCase(caseId: string) {
  const { data: caseData } = await supabase
    .from('cases').select('*').eq('id', caseId).single();
  if (!caseData) throw new Error('Case not found');

  await supabase.from('cases')
    .update({ status: 'investigating' }).eq('id', caseId);

  const messages: Anthropic.MessageParam[] = [{
    role: 'user',
    content: `You are a fraud investigation agent. Investigate this case:
Case ID: ${caseData.id}
Type: ${caseData.type}
Transaction: ${JSON.stringify(caseData.transaction_data)}
User Profile: ${JSON.stringify(caseData.user_profile)}

Use tools to query history, check IPs, analyze devices,
search similar cases, record evidence, and make a decision.`
  }];

  let decision = null;
  while (!decision) {
    const response = await anthropic.messages.create({
      model: 'claude-sonnet-4-20250514',
      max_tokens: 4096,
      tools: INVESTIGATION_TOOLS,
      messages
    });

    for (const block of response.content) {
      if (block.type === 'tool_use') {
        const result = await executeToolCall(block.name, block.input, caseId);
        if (block.name === 'make_decision') decision = block.input;
        messages.push({ role: 'assistant', content: response.content });
        messages.push({
          role: 'user',
          content: [{ type: 'tool_result', tool_use_id: block.id,
            content: JSON.stringify(result) }]
        });
      }
    }
    if (response.stop_reason === 'end_turn' && !decision) break;
  }

  if (decision) {
    await supabase.from('cases').update({
      status: 'resolved', decision: decision.decision,
      decision_reasoning: decision.reasoning,
      resolved_at: new Date().toISOString()
    }).eq('id', caseId);
  }
  return decision;
}
```

## Step 4: Rules Engine

Create `src/lib/rules/engine.ts` to analyze patterns across resolved fraud cases, propose detection rules using Claude, and backtest them against historical transactions.

## Step 5: Case Management API

Create API routes:
- `app/api/cases/route.ts`, list/create cases
- `app/api/cases/[id]/route.ts`, case details
- `app/api/cases/[id]/investigate/route.ts`, trigger investigation
- `app/api/rules/route.ts`, manage rules
- `app/api/rules/[id]/backtest/route.ts`, run backtests

## Step 6: Dashboard UI

Build three views with shadcn/ui:
1. Cases list, filterable table with status, severity, decision
2. Case detail, investigation timeline, evidence, decision reasoning
3. Rules dashboard, precision/recall metrics, backtest results

Use `reactflow` for evidence relationship graphs.

## Step 7: Deploy

```bash
vercel --prod
# Or Docker for on-prem
docker build -t mousecat-clone .
docker run -p 3000:3000 mousecat-clone
```

## Key Insights
- The investigation agent is an LLM tool-calling loop, magic is in tool definitions
- Synthetic label generation requires domain expertise
- Rules engine is AutoML for fraud: generate, test, deploy
- MCP makes agents extensible, new data source = new tool

## Gotchas
- LLM costs: use haiku for routine cases, sonnet for complex
- Backtesting requires point-in-time features (no future leakage)
- On-prem needs SOC 2 compliance + encryption at rest
- Seed with synthetic fraud data to solve cold-start