TraceTree

TraceTree catches malware verdicts your scanner is currently hiding from you, a runtime behavioral security scanner that sandboxes, disassembles, and classifies files.

Comment

Inspiration

TraceTree started as a runtime behavioral security scanner — combining radare2 disassembly, YARA rule matching, and an ML classification pipeline to answer a simple question: is this file safe to run? Going into Build Week, the goal was to sharpen a real, working security tool using Codex and GPT-5.6 rather than start from scratch.

What it does

TraceTree scans files through a layered pipeline — static YARA/radare2 analysis feeding into an ML-based classifier — and surfaces a clear verdict (safe / caution / danger) in a Next.js dashboard. An MCP server component lets agentic tools query scan results directly.

How we built it

Using Codex as the primary build tool (with Claude Code as a fallback during rate limits), we used knowledge-graph analysis (Antigravity) to map the existing codebase's architecture and surface cross-layer contract mismatches that weren't visible from code review alone. That analysis uncovered a critical bug: the backend was never emitting "malicious" as a decision string, so genuinely dangerous files were rendering as yellow "caution" instead of red "danger." We traced and fixed this across the orchestrator's AI mesh logic, the Express/TS server, and the frontend store, with tests and TypeScript typechecks passing clean.

Challenges we ran into

Diagnosing a verdict-pipeline bug that spans three files in two languages (Python + TypeScript) required tracing the contract from ML output through the API layer to the UI — exactly the kind of cross-layer bug that's easy to miss in isolated code review. We also learned to keep Codex/Claude prompts narrow and diff-scoped; an early open-ended security scan burned significant credits for minimal signal.

Accomplishments that we're proud of

Fixing a verdict-contract bug where "malicious" files were silently downgraded to "caution" — a real security-relevant defect, not a cosmetic one — and doing it with a clean, tested, three-file diff.

What we learned

Narrow, scoped agent prompts beat open-ended ones. Knowledge-graph tooling is genuinely useful for surfacing wiring bugs across layers that code review alone misses. And reusing an existing project for a hackathon is valid, but requires documenting the pre-existing/new-work split from day one.

What's next for TraceTree

Evolving TraceTree from a CLI/dashboard tool into an always-on desktop app (Electron wrapping the Next.js frontend) that watches your Downloads folder, auto-sandboxes new files in Docker, and surfaces verdicts through a consumer-friendly UI.

Built With

Share this project:

Updates