THE PROBLEM
Ransomware attacks cost organizations over $20 billion every year. Security teams are drowning in 11,000+ alerts per day, most of which are false positives. By the time a human analyst investigates, the encryption has already spread to hundreds of files.
The average response time? Hours. The average recovery cost? $2.73 million.
I wanted to build something that could change that — an AI agent that doesn't just detect threats, but investigates and responds to them autonomously, while still keeping a human in the loop for irreversible actions.
That's how AutoVault was born.
WHAT I BUILT
AutoVault is an autonomous AI security operations agent that runs on TrueForge, the open-source agent harness by TrueFoundry. It detects ransomware in 0.3 seconds, spawns 5 parallel subagents to investigate, and responds autonomously — but always stops to ask a human before doing anything irreversible.
HOW I USED TRUEFORGE
TrueForge isn't just a dependency — it's the brain of the entire system. I used every single TrueForge feature, all 12 of them.
MCP TOOLS
I built 4 Python MCP servers using the MCP SDK v2:
Each tool has full input schemas, proper error handling, and returns structured JSON.
SUBAGENTS
TrueForge's subagent system was a game-changer. I spawned 5 specialized agents that run in parallel:
The speed improvement was dramatic — what took hours now takes seconds.
SANDBOX (DAYTONA) I wrote 20 Python scripts that run safely in TrueForge's Daytona sandbox:
HUMAN APPROVALS
TrueForge's approval system lets me define 10 rules with risk scoring:
The 7-step workflow ensures nothing irreversible happens without a human saying yes.
SKILLS
I created 4 instruction packs that TrueForge loads dynamically:
CONTEXT ENGINEERING
TrueForge's context engineering kept the agent efficient:
PERSISTENT SESSIONS
The agent saves its state to SQLite every 30 seconds. If the connection drops mid-investigation, it resumes exactly where it left off.
THE 13 INNOVATIONS
Human-Like Memory Architecture — Episodic, semantic, procedural, and working memory. The agent remembers past attacks.
Predictive Ransomware Defense — Predicts attacks 30 minutes before they happen.
Recursive Self-Improvement — The agent improves its own code and algorithms.
Collective Intelligence Swarm — Hive mind of agents making decisions together.
Neuromorphic Processing — Brain-inspired neural networks with sub-millisecond latency.
Self-Healing File System — Automatically restores encrypted files from blockchain backups.
AI Red Team vs Blue Team — Two AI teams compete and improve through adversarial training.
Knowledge Graph — Graph database mapping relationships between threats, actors, tools, techniques.
Federated Learning — Multiple organizations train models without sharing sensitive data.
Digital Twin Simulation — Virtual replica for risk-free security testing.
Adversarial Robustness — Defends against attacks designed to trick the AI.
Natural Language Threat Intelligence — Query threats using plain English.
Self-Learning Security Evolution — Detection models evolve using genetic algorithms.
THE QODO CODE REVIEW EXPERIENCE
Every change goes through Qodo review via GitHub Actions. On PR #1, Qodo found:
All three were real issues. I fixed all HIGH findings and documented everything in the README.
WHAT I LEARNED
TrueForge Is More Than a Wrapper — The MCP tool system, subagent orchestration, approval workflows, and context engineering are all deep, production-grade features.
Parallel Subagents Change Everything — Running 5 investigations simultaneously isn't just faster — it's qualitatively different.
Human Approval Is Non-Negotiable — For a security tool, having human approval is critical. TrueForge made this trivial to implement.
Qodo Actually Finds Bugs — It understands context and finds issues that surface-level analysis misses.
The Sandbox Is Your Safety Net — When running scripts that analyze potentially malicious files, you need a sandbox.
Documentation Matters — Writing the README forced me to think about what I actually built and why.
TRY IT YOURSELF github.com/ItsParthPinjarkar/autovault
git clone https://github.com/ItsParthPinjarkar/autovault.git cd autovault
pip install -r agent/requirements.txt
pip install -r mcp-server/requirements.txt
bash setup-trueforge.sh
python demo_advanced.py
ACKNOWLEDGMENTS
Built for the Agent Harness Hackathon (August 24-30, 2026). This project was built with AI assistance. All code has been reviewed, tested, and understood by the developer.