Agent Harness Hackathon 2026 — What I built, how I used TrueForge, and what I learned

THE PROBLEM

Ransomware attacks cost organizations over $20 billion every year. Security teams are drowning in 11,000+ alerts per day, most of which are false positives. By the time a human analyst investigates, the encryption has already spread to hundreds of files.

The average response time? Hours. The average recovery cost? $2.73 million.

I wanted to build something that could change that — an AI agent that doesn't just detect threats, but investigates and responds to them autonomously, while still keeping a human in the loop for irreversible actions.

That's how AutoVault was born.

WHAT I BUILT

AutoVault is an autonomous AI security operations agent that runs on TrueForge, the open-source agent harness by TrueFoundry. It detects ransomware in 0.3 seconds, spawns 5 parallel subagents to investigate, and responds autonomously — but always stops to ask a human before doing anything irreversible.

• 23 MCP tools across 4 specialized servers
• 5 parallel subagents that investigate simultaneously
• Daytona sandbox running 20 Python scripts safely
• Multi-step approval workflows with P1-P4 risk scoring
• 13 groundbreaking innovations

HOW I USED TRUEFORGE

TrueForge isn't just a dependency — it's the brain of the entire system. I used every single TrueForge feature, all 12 of them.

MCP TOOLS

I built 4 Python MCP servers using the MCP SDK v2:

1. autovault-mcp (8 tools) — Core security operations like scan_directory, analyze_threat, create_snapshot
2. autovault-network (5 tools) — Network monitoring: get_network_connections, get_listening_ports
3. autovault-forensics (5 tools) — Deep analysis: analyze_file_deep, build_timeline, detect_ransomware
4. autovault-threat-intel (5 tools) — Intelligence: get_mitre_technique, check_known_malicious

Each tool has full input schemas, proper error handling, and returns structured JSON.

SUBAGENTS

TrueForge's subagent system was a game-changer. I spawned 5 specialized agents that run in parallel:

• Process Investigator — Analyzes suspicious processes
• Network Analyzer — Monitors connections, detects C2 servers
• Forensics Analyst — Reconstructs attack timelines
• Threat Hunter — Maps indicators to MITRE ATT&CK
• Incident Responder — Coordinates response playbooks

The speed improvement was dramatic — what took hours now takes seconds.

SANDBOX (DAYTONA)

I wrote 20 Python scripts that run safely in TrueForge's Daytona sandbox:

• 7 core analysis scripts
• 13 innovation scripts (self-healing, red team, knowledge graph, predictive defense)

HUMAN APPROVALS

TrueForge's approval system lets me define 10 rules with risk scoring:

• P1 Critical (Risk 90/100): System lockdown — must get human approval
• P2 High (Risk 50-60/100): Network blocking — human approval required
• P3 Medium (Risk 25-30/100): Firewall changes — optional approval
• P4 Low (Risk 5-10/100): Snapshots, reports — auto-approve

The 7-step workflow ensures nothing irreversible happens without a human saying yes.

SKILLS

I created 4 instruction packs that TrueForge loads dynamically:

• autovault-security — Always loaded
• incident-response — Loaded when threat >= HIGH
• threat-hunting — Loaded in proactive mode
• forensic-analysis — Loaded during investigations

CONTEXT ENGINEERING

TrueForge's context engineering kept the agent efficient:

• Smart compaction preserved recent and critical messages
• Deferred tool loading loaded tools on demand
• Response offloading moved large responses to sandbox

PERSISTENT SESSIONS

The agent saves its state to SQLite every 30 seconds. If the connection drops mid-investigation, it resumes exactly where it left off.

THE 13 INNOVATIONS

1. Human-Like Memory Architecture — Episodic, semantic, procedural, and working memory. The agent remembers past attacks.

2. Predictive Ransomware Defense — Predicts attacks 30 minutes before they happen.

3. Recursive Self-Improvement — The agent improves its own code and algorithms.

4. Collective Intelligence Swarm — Hive mind of agents making decisions together.

5. Neuromorphic Processing — Brain-inspired neural networks with sub-millisecond latency.

6. Self-Healing File System — Automatically restores encrypted files from blockchain backups.

7. AI Red Team vs Blue Team — Two AI teams compete and improve through adversarial training.

8. Knowledge Graph — Graph database mapping relationships between threats, actors, tools, techniques.

9. Federated Learning — Multiple organizations train models without sharing sensitive data.

10. Digital Twin Simulation — Virtual replica for risk-free security testing.

11. Adversarial Robustness — Defends against attacks designed to trick the AI.

12. Natural Language Threat Intelligence — Query threats using plain English.

13. Self-Learning Security Evolution — Detection models evolve using genetic algorithms.

THE QODO CODE REVIEW EXPERIENCE

Every change goes through Qodo review via GitHub Actions. On PR #1, Qodo found:

1. A potential bug in create_threat_card — missing key error handling
2. Error handling gap in execute_lockdown() — no try/except
3. Infinite loop risk in threat detection — no timeout

All three were real issues. I fixed all HIGH findings and documented everything in the README.

WHAT I LEARNED

1. TrueForge Is More Than a Wrapper — The MCP tool system, subagent orchestration, approval workflows, and context engineering are all deep, production-grade features.

2. Parallel Subagents Change Everything — Running 5 investigations simultaneously isn't just faster — it's qualitatively different.

3. Human Approval Is Non-Negotiable — For a security tool, having human approval is critical. TrueForge made this trivial to implement.

4. Qodo Actually Finds Bugs — It understands context and finds issues that surface-level analysis misses.

5. The Sandbox Is Your Safety Net — When running scripts that analyze potentially malicious files, you need a sandbox.

6. Documentation Matters — Writing the README forced me to think about what I actually built and why.

TRY IT YOURSELF

github.com/ItsParthPinjarkar/autovault

git clone https://github.com/ItsParthPinjarkar/autovault.git
cd autovault
pip install -r agent/requirements.txt
pip install -r mcp-server/requirements.txt
bash setup-trueforge.sh
python demo_advanced.py

ACKNOWLEDGMENTS

Built for the Agent Harness Hackathon (August 24-30, 2026).

• TrueForge by TrueFoundry — The agent harness
• Qodo — AI code review
• Codebuff — AI coding assistant

This project was built with AI assistance. All code has been reviewed, tested, and understood by the developer.