Agent Harness Hackathon 2026 — What I built, how I used TrueForge, and what I learned

Parth Pinjarkar — Sun, 30 Aug 2026 09:08:14 +0000

THE PROBLEM

Ransomware attacks cost organizations over $20 billion every year. Security teams are drowning in 11,000+ alerts per day, most of which are false positives. By the time a human analyst investigates, the encryption has already spread to hundreds of files.

The average response time? Hours. The average recovery cost? $2.73 million.

I wanted to build something that could change that — an AI agent that doesn't just detect threats, but investigates and responds to them autonomously, while still keeping a human in the loop for irreversible actions.

That's how AutoVault was born.

WHAT I BUILT

AutoVault is an autonomous AI security operations agent that runs on TrueForge, the open-source agent harness by TrueFoundry. It detects ransomware in 0.3 seconds, spawns 5 parallel subagents to investigate, and responds autonomously — but always stops to ask a human before doing anything irreversible.

23 MCP tools across 4 specialized servers
5 parallel subagents that investigate simultaneously
Daytona sandbox running 20 Python scripts safely
Multi-step approval workflows with P1-P4 risk scoring
13 groundbreaking innovations

HOW I USED TRUEFORGE

TrueForge isn't just a dependency — it's the brain of the entire system. I used every single TrueForge feature, all 12 of them.

MCP TOOLS

I built 4 Python MCP servers using the MCP SDK v2:

autovault-mcp (8 tools) — Core security operations like scan_directory, analyze_threat, create_snapshot
autovault-network (5 tools) — Network monitoring: get_network_connections, get_listening_ports
autovault-forensics (5 tools) — Deep analysis: analyze_file_deep, build_timeline, detect_ransomware
autovault-threat-intel (5 tools) — Intelligence: get_mitre_technique, check_known_malicious

Each tool has full input schemas, proper error handling, and returns structured JSON.

SUBAGENTS

TrueForge's subagent system was a game-changer. I spawned 5 specialized agents that run in parallel:

Process Investigator — Analyzes suspicious processes
Network Analyzer — Monitors connections, detects C2 servers
Forensics Analyst — Reconstructs attack timelines
Threat Hunter — Maps indicators to MITRE ATT&CK
Incident Responder — Coordinates response playbooks

The speed improvement was dramatic — what took hours now takes seconds.

SANDBOX (DAYTONA)

I wrote 20 Python scripts that run safely in TrueForge's Daytona sandbox:

7 core analysis scripts
13 innovation scripts (self-healing, red team, knowledge graph, predictive defense)

HUMAN APPROVALS

TrueForge's approval system lets me define 10 rules with risk scoring:

P1 Critical (Risk 90/100): System lockdown — must get human approval
P2 High (Risk 50-60/100): Network blocking — human approval required
P3 Medium (Risk 25-30/100): Firewall changes — optional approval
P4 Low (Risk 5-10/100): Snapshots, reports — auto-approve

The 7-step workflow ensures nothing irreversible happens without a human saying yes.

SKILLS

I created 4 instruction packs that TrueForge loads dynamically:

autovault-security — Always loaded
incident-response — Loaded when threat >= HIGH
threat-hunting — Loaded in proactive mode
forensic-analysis — Loaded during investigations

CONTEXT ENGINEERING

TrueForge's context engineering kept the agent efficient:

Smart compaction preserved recent and critical messages
Deferred tool loading loaded tools on demand
Response offloading moved large responses to sandbox

PERSISTENT SESSIONS

The agent saves its state to SQLite every 30 seconds. If the connection drops mid-investigation, it resumes exactly where it left off.

THE 13 INNOVATIONS

Human-Like Memory Architecture — Episodic, semantic, procedural, and working memory. The agent remembers past attacks.
Predictive Ransomware Defense — Predicts attacks 30 minutes before they happen.
Recursive Self-Improvement — The agent improves its own code and algorithms.
Collective Intelligence Swarm — Hive mind of agents making decisions together.
Neuromorphic Processing — Brain-inspired neural networks with sub-millisecond latency.
Self-Healing File System — Automatically restores encrypted files from blockchain backups.
AI Red Team vs Blue Team — Two AI teams compete and improve through adversarial training.
Knowledge Graph — Graph database mapping relationships between threats, actors, tools, techniques.
Federated Learning — Multiple organizations train models without sharing sensitive data.
Digital Twin Simulation — Virtual replica for risk-free security testing.
Adversarial Robustness — Defends against attacks designed to trick the AI.
Natural Language Threat Intelligence — Query threats using plain English.
Self-Learning Security Evolution — Detection models evolve using genetic algorithms.

THE QODO CODE REVIEW EXPERIENCE

Every change goes through Qodo review via GitHub Actions. On PR #1, Qodo found:

A potential bug in create_threat_card — missing key error handling
Error handling gap in execute_lockdown() — no try/except
Infinite loop risk in threat detection — no timeout

All three were real issues. I fixed all HIGH findings and documented everything in the README.

WHAT I LEARNED

TrueForge Is More Than a Wrapper — The MCP tool system, subagent orchestration, approval workflows, and context engineering are all deep, production-grade features.
Parallel Subagents Change Everything — Running 5 investigations simultaneously isn't just faster — it's qualitatively different.
Human Approval Is Non-Negotiable — For a security tool, having human approval is critical. TrueForge made this trivial to implement.
Qodo Actually Finds Bugs — It understands context and finds issues that surface-level analysis misses.
The Sandbox Is Your Safety Net — When running scripts that analyze potentially malicious files, you need a sandbox.
Documentation Matters — Writing the README forced me to think about what I actually built and why.

TRY IT YOURSELF

github.com/ItsParthPinjarkar/autovault

git clone https://github.com/ItsParthPinjarkar/autovault.git
cd autovault
pip install -r agent/requirements.txt
pip install -r mcp-server/requirements.txt
bash setup-trueforge.sh
python demo_advanced.py

ACKNOWLEDGMENTS

Built for the Agent Harness Hackathon (August 24-30, 2026).

TrueForge by TrueFoundry — The agent harness
Qodo — AI code review
Codebuff — AI coding assistant

This project was built with AI assistance. All code has been reviewed, tested, and understood by the developer.

DEV Community: Parth Pinjarkar

Agent Harness Hackathon 2026 — What I built, how I used TrueForge, and what I learned