💊 MedShield — Counterfeit Medicine Detection Agent for India

Protecting India's medicine supply, one batch at a time. Google Cloud Rapid Agent Hackathon · Track: MongoDB

---

The problem

Roughly 1 in 4 drugs sold in developing markets are counterfeit or substandard. A chemist in tier-2/tier-3 India has no practical tool to verify a drug batch before dispensing it. The official CDSCO verification route is inaccessible at the last mile, and individual suspicious reports are never connected — so counterfeit clusters spread silently.

The solution

MedShield is an AI agent a chemist can use to verify any medicine by entering a drug name and/or batch number. The agent:

1. Validates the batch-number format.
2. Looks the medicine up in a real verified drug database (253K+ Indian medicines).
3. Cross-checks the manufacturer and runs a production-capacity anomaly check (impossible batch sizes).
4. Checks whether the batch is already CDSCO NSQ-flagged.
5. Positively verifies the batch against the registry — authenticity must be proven, never assumed from the absence of red flags.
6. Detects nearby counterfeit clusters using MongoDB geospatial + vector search.
7. Scores supplier credibility.
8. Returns a clear verdict — GENUINE / UNVERIFIED / SUSPICIOUS / LIKELY COUNTERFEIT / NSQ-FLAGGED — with a confidence score, plain-English reasons, and an auto-generated CDSCO complaint PDF when needed.

Security posture. A real, well-known drug name printed on a box proves nothing — a forger can print anything. MedShield only returns GENUINE when the exact batch is positively confirmed in the verified registry and is consistent with the claimed drug, manufacturer, serial range and dates. A batch it cannot confirm is UNVERIFIED ("we cannot confirm this is genuine"), never a silent pass.

---

Architecture

                ┌─────────────────────────────────────────────┐
                │              Streamlit UI (app.py)            │
                │   Verify tab  •  Map tab  •  metrics/badges   │
                └───────────────┬──────────────────┬───────────┘
                                │                  │ (read-only)
                      agent/runner.py              │
                  (ADK Runner + sessions)          │
                                │                  │
                ┌───────────────▼───────────────┐  │
                │   ADK Agent (Gemini 2.5 Flash- │  │
                │   Lite)     agent/agent.py     │  │
                │  instruction = prompts.py      │  │
                └───┬───────────────────────┬────┘  │
                    │                       │        │
     ┌──────────────▼─────────┐   ┌─────────▼──────────┐
     │   MongoDB MCP server    │   │  8 custom tools     │
     │ (npx, find/aggregate/   │   │  agent/tools.py     │
     │  vector search)         │   │  validators /       │
     └──────────────┬──────────┘   │  pdf_generator      │
                    │              └─────────┬──────────┘
                    │                        │
              ┌─────▼────────────────────────▼─────┐
              │      utils/repositories.py          │  ← all queries
              │  Medicine / Report / Mfr / Supplier │
              └─────────────────┬───────────────────┘
                                │ utils/mongodb.py (pooled client)
                    ┌───────────▼────────────┐
                    │     MongoDB Atlas       │
                    │  medicines · suppliers  │
                    │  manufacturers ·        │
                    │  suspicious_reports     │
                    │  (+2dsphere +vector idx)│
                    └─────────────────────────┘
       Embeddings: Google gemini-embedding-001 (768-dim) — agent/embeddings.py

Design principles. Configuration is centralised (agent/config.py, single source of truth). All persistence goes through a repository layer (utils/repositories.py) — tools and scripts never write raw pymongo. Domain entities and the Verdict/ReportSource enums live in agent/models.py (defined once, used everywhere). Pure logic (batch validation, risk scoring) is I/O-free and unit-testable. This keeps the codebase SRP/DIP/DRY-aligned and easy to extend.

---

Tech stack

Layer	Technology
Agent framework	Google ADK (google-adk)
LLM	Gemini 2.5 Flash-Lite (gemini-2.5-flash-lite)
Embeddings	Google gemini-embedding-001 (768-dim, cosine)
Database	MongoDB Atlas (M0) + Vector Search + 2dsphere
DB tool surface	mongodb-mcp-server (via npx, MCP/stdio)
UI	Streamlit + pydeck
PDF generation	ReportLab
PDF parsing	PyMuPDF (fitz)
Deployment	Google Cloud Run (Docker)
Language	Python 3.11+

---

Data sources (real, not synthetic)

• Indian Medicine Dataset — 253,973 real medicines with manufacturer, composition, price, pack size. https://github.com/junioralive/Indian-Medicine-Dataset
• CDSCO NSQ alerts — monthly "Not of Standard Quality / spurious" drug alert PDFs, parsed for real flagged batches. https://cdsco.gov.in/opencms/opencms/en/Notifications/nsq-drugs/
• Kaggle AZ Medicine Dataset of India — supplementary composition/usage. https://www.kaggle.com/datasets/shudhanshusingh/az-medicine-dataset-of-india

Generated fields (batch numbers, manufacturing/expiry dates, serial ranges, manufacturer capacities, distributor records, and the 15 demo suspicious cases) are clearly produced by the ingestion/seed scripts and are reproducible via a fixed RNG seed.

---

Setup

1. Prerequisites

• Python 3.11+
• Node.js + npm (the agent launches the MongoDB MCP server via npx)
• A Google Gemini API key — https://aistudio.google.com/app/apikey
• A free MongoDB Atlas account

2. MongoDB Atlas — step by step

1. Create an M0 cluster. Atlas → Build a Database → M0 (Free) → pick a cloud/region → Create.
2. Create a database user. Database Access → Add New Database User → username + password (Atlas auth). Save these.
3. Whitelist your IP. Network Access → Add IP Address → 0.0.0.0/0 (allow-all is fine for the hackathon; tighten for prod).
4. Get the connection string. Database → Connect → Drivers → copy the mongodb+srv://… string. Insert your username/password and append the database name medshield:

   mongodb+srv://<user>:<pass>@<cluster>.mongodb.net/medshield?retryWrites=true&w=majority
   

5. The medshield database + collections are created automatically the first time scripts/ingest_data.py writes to them — no manual creation needed.
6. Standard indexes are created automatically by ingestion (ensure_all_indexes()): the compound {batch_number, manufacturer_name} on medicines, a text index on medicines.name, and the 2dsphere index on suspicious_reports.location.
7. Create the Vector Search index manually (Atlas UI): Atlas Search → Create Search Index → JSON Editor → choose the suspicious_reports collection → Vector Search type → name it report_vector_index → paste:

   {
     "fields": [
       {
         "type": "vector",
         "path": "embedding",
         "numDimensions": 768,
         "similarity": "cosine"
       }
     ]
   }

   (Atlas Search indexes cannot be created reliably via pymongo on M0, which is why this one step is manual.)

3. Install & configure

cd medshield
python3.11 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

cp .env.example .env        # then edit .env with real values

.env:

MONGODB_URI=mongodb+srv://<user>:<pass>@<cluster>.mongodb.net/medshield?retryWrites=true&w=majority
MONGODB_DB=medshield
GOOGLE_API_KEY=your_gemini_api_key
GOOGLE_CLOUD_PROJECT=your_gcp_project_id   # only for Cloud Run

4. Ingest data & seed demo cases

# Full ingest (downloads 253K-row CSV + CDSCO PDFs, builds all collections).
python -m scripts.ingest_data --drop

# Quick subset while testing (no embeddings, ~2k medicines):
python -m scripts.ingest_data --limit 2000 --skip-embeddings

# Seed the 15 curated demo suspicious cases (needs the vector index for
# semantic search; geospatial works regardless).
python -m scripts.seed_suspicious --reset

# Seed the 2 genuine, in-registry demo medicines (so the GENUINE demo has a
# real verified batch with future expiry — Augmentin GSK-202503-00421).
python -m scripts.seed_demo_medicines

5. Test the agent

# Fast, no LLM — exercises every tool directly against MongoDB:
python -m scripts.test_agent --tools-only

# Full end-to-end through Gemini + MCP (runs the 3 demo scenarios):
python -m scripts.test_agent

6. Run the UI

streamlit run app.py
# open http://localhost:8501

---

Demo scenarios

#	Input	Expected verdict
1	Augmentin 625 Duo Tablet, batch GSK-202503-00421, city Mumbai	GENUINE — exact batch positively verified in the registry, no nearby flags
2	Augmentin 625 Duo Tablet, batch GSK-202403-99999, city Mumbai	UNVERIFIED — real drug name but the batch is not in the registry; cannot confirm
3	Telmisartan 40mg Tablet, batch GSK-202503-00421, city Delhi	LIKELY_COUNTERFEIT — that batch belongs to a different product (cloned batch number)
4	Telmisartan 40mg Tablet, batch TEL-202309-04412, mfr Hetero Labs, city Hyderabad	NSQ_FLAGGED — matches a seeded CDSCO NSQ flag; complaint generated
5	Ranitidine 150mg Tablet, batch RAN-202310-03021, mfr JB Chemicals, supplier Surya Pharma Supplies, city Mumbai	LIKELY_COUNTERFEIT — 3-city cluster within 200 km; complaint generated

(Scenario 1 relies on scripts/seed_demo_medicines.py; scenarios 3–5 rely on scripts/seed_suspicious.py + seed_demo_medicines.py having been run.)

---

Deploy to Cloud Run

gcloud run deploy medshield \
  --source . \
  --region asia-south1 \
  --allow-unauthenticated \
  --set-env-vars "MONGODB_URI=...,MONGODB_DB=medshield,GOOGLE_API_KEY=..."

The image bundles Node.js so the MCP server runs inside the container.

---

Project layout

medshield/
├── app.py                     # Streamlit UI (Verify + Map tabs)
├── agent/
│   ├── agent.py               # ADK agent (Gemini + MCP + custom tools)
│   ├── runner.py              # shared ADK Runner / streaming helpers
│   ├── tools.py               # 8 custom tools
│   ├── prompts.py             # system prompt (11-step reasoning)
│   ├── embeddings.py          # gemini-embedding-001 wrapper
│   ├── config.py              # single source of truth (settings/weights)
│   └── models.py              # domain entities + Verdict/ReportSource enums
├── utils/
│   ├── mongodb.py             # pooled client + health check
│   ├── repositories.py        # data-access layer (one repo per collection)
│   ├── pdf_generator.py       # CDSCO complaint PDF (ReportLab)
│   └── validators.py          # batch-format validation (pure)
├── scripts/
│   ├── ingest_data.py         # download + parse real data → MongoDB
│   ├── seed_suspicious.py     # 15 curated demo suspicious cases
│   ├── seed_demo_medicines.py # 2 genuine, in-registry demo medicines
│   └── test_agent.py          # CLI test harness
├── data/                      # downloaded datasets + generated PDFs (gitignored)
├── requirements.txt
├── Dockerfile
├── .env.example
└── README.md

---

Disclaimer

MedShield is a decision-support tool, not a legal authority. Verdicts are guidance to help a chemist decide. Final confirmation of a spurious or substandard drug rests with CDSCO and State Drug Control authorities. When in doubt, do not dispense — verify.