DEV Community

Parth Pinjarkar
Parth Pinjarkar

Posted on

Agent Harness Hackathon 2026 — What I built, how I used TrueForge, and what I learned

#trueforge #qodo #aisecurity #hackathon

THE PROBLEM

Ransomware attacks cost organizations over $20 billion every year. Security teams are drowning in 11,000+ alerts per day, most of which are false positives. By the time a human analyst investigates, the encryption has already spread to hundreds of files.

The average response time? Hours. The average recovery cost? $2.73 million.

I wanted to build something that could change that — an AI agent that doesn't just detect threats, but investigates and responds to them autonomously, while still keeping a human in the loop for irreversible actions.

That's how AutoVault was born.

WHAT I BUILT

AutoVault is an autonomous AI security operations agent that runs on TrueForge, the open-source agent harness by TrueFoundry. It detects ransomware in 0.3 seconds, spawns 5 parallel subagents to investigate, and responds autonomously — but always stops to ask a human before doing anything irreversible.

  • 23 MCP tools across 4 specialized servers
  • 5 parallel subagents that investigate simultaneously
  • Daytona sandbox running 20 Python scripts safely
  • Multi-step approval workflows with P1-P4 risk scoring
  • 13 groundbreaking innovations

HOW I USED TRUEFORGE

TrueForge isn't just a dependency — it's the brain of the entire system. I used every single TrueForge feature, all 12 of them.

MCP TOOLS

I built 4 Python MCP servers using the MCP SDK v2:

  1. autovault-mcp (8 tools) — Core security operations like scan_directory, analyze_threat, create_snapshot
  2. autovault-network (5 tools) — Network monitoring: get_network_connections, get_listening_ports
  3. autovault-forensics (5 tools) — Deep analysis: analyze_file_deep, build_timeline, detect_ransomware
  4. autovault-threat-intel (5 tools) — Intelligence: get_mitre_technique, check_known_malicious

Each tool has full input schemas, proper error handling, and returns structured JSON.

SUBAGENTS

TrueForge's subagent system was a game-changer. I spawned 5 specialized agents that run in parallel:

  • Process Investigator — Analyzes suspicious processes
  • Network Analyzer — Monitors connections, detects C2 servers
  • Forensics Analyst — Reconstructs attack timelines
  • Threat Hunter — Maps indicators to MITRE ATT&CK
  • Incident Responder — Coordinates response playbooks

The speed improvement was dramatic — what took hours now takes seconds.

SANDBOX (DAYTONA)

I wrote 20 Python scripts that run safely in TrueForge's Daytona sandbox:

  • 7 core analysis scripts
  • 13 innovation scripts (self-healing, red team, knowledge graph, predictive defense)

HUMAN APPROVALS

TrueForge's approval system lets me define 10 rules with risk scoring:

  • P1 Critical (Risk 90/100): System lockdown — must get human approval
  • P2 High (Risk 50-60/100): Network blocking — human approval required
  • P3 Medium (Risk 25-30/100): Firewall changes — optional approval
  • P4 Low (Risk 5-10/100): Snapshots, reports — auto-approve

The 7-step workflow ensures nothing irreversible happens without a human saying yes.

SKILLS

I created 4 instruction packs that TrueForge loads dynamically:

  • autovault-security — Always loaded
  • incident-response — Loaded when threat >= HIGH
  • threat-hunting — Loaded in proactive mode
  • forensic-analysis — Loaded during investigations

CONTEXT ENGINEERING

TrueForge's context engineering kept the agent efficient:

  • Smart compaction preserved recent and critical messages
  • Deferred tool loading loaded tools on demand
  • Response offloading moved large responses to sandbox

PERSISTENT SESSIONS

The agent saves its state to SQLite every 30 seconds. If the connection drops mid-investigation, it resumes exactly where it left off.

THE 13 INNOVATIONS

  1. Human-Like Memory Architecture — Episodic, semantic, procedural, and working memory. The agent remembers past attacks.

  2. Predictive Ransomware Defense — Predicts attacks 30 minutes before they happen.

  3. Recursive Self-Improvement — The agent improves its own code and algorithms.

  4. Collective Intelligence Swarm — Hive mind of agents making decisions together.

  5. Neuromorphic Processing — Brain-inspired neural networks with sub-millisecond latency.

  6. Self-Healing File System — Automatically restores encrypted files from blockchain backups.

  7. AI Red Team vs Blue Team — Two AI teams compete and improve through adversarial training.

  8. Knowledge Graph — Graph database mapping relationships between threats, actors, tools, techniques.

  9. Federated Learning — Multiple organizations train models without sharing sensitive data.

  10. Digital Twin Simulation — Virtual replica for risk-free security testing.

  11. Adversarial Robustness — Defends against attacks designed to trick the AI.

  12. Natural Language Threat Intelligence — Query threats using plain English.

  13. Self-Learning Security Evolution — Detection models evolve using genetic algorithms.

THE QODO CODE REVIEW EXPERIENCE

Every change goes through Qodo review via GitHub Actions. On PR #1, Qodo found:

  1. A potential bug in create_threat_card — missing key error handling
  2. Error handling gap in execute_lockdown() — no try/except
  3. Infinite loop risk in threat detection — no timeout

All three were real issues. I fixed all HIGH findings and documented everything in the README.

WHAT I LEARNED

  1. TrueForge Is More Than a Wrapper — The MCP tool system, subagent orchestration, approval workflows, and context engineering are all deep, production-grade features.

  2. Parallel Subagents Change Everything — Running 5 investigations simultaneously isn't just faster — it's qualitatively different.

  3. Human Approval Is Non-Negotiable — For a security tool, having human approval is critical. TrueForge made this trivial to implement.

  4. Qodo Actually Finds Bugs — It understands context and finds issues that surface-level analysis misses.

  5. The Sandbox Is Your Safety Net — When running scripts that analyze potentially malicious files, you need a sandbox.

  6. Documentation Matters — Writing the README forced me to think about what I actually built and why.

TRY IT YOURSELF

github.com/ItsParthPinjarkar/autovault

git clone https://github.com/ItsParthPinjarkar/autovault.git
cd autovault
pip install -r agent/requirements.txt
pip install -r mcp-server/requirements.txt
bash setup-trueforge.sh
python demo_advanced.py

ACKNOWLEDGMENTS

Built for the Agent Harness Hackathon (August 24-30, 2026).

  • TrueForge by TrueFoundry — The agent harness
  • Qodo — AI code review
  • Codebuff — AI coding assistant

This project was built with AI assistance. All code has been reviewed, tested, and understood by the developer.

Top comments (0)