WatchTower - Powered by SerpApi

WatchTower is a security guard on your wrist—detecting threats across the internet and warning you before they hit your stack.

Comment

Android Kotlin FastAPI SerpApi Jetpack Compose GCP Firebase

⌚ WatchTower — DevPost Submission Details

This document details the hackathon submission description for WatchTower, designed to give judges a clear, compelling, and in-depth understanding of the project's inspiration, technical implementation, and future directions.

💡 Inspiration

In the modern tech landscape, security vulnerabilities (CVEs) and zero-day exploits emerge daily in popular open-source software, cloud platforms, and developer libraries. When these vulnerabilities are disclosed, time is the ultimate factor: developers and IT teams who find out about exploits hours or days late leave their infrastructure wide open to active compromise.

Most security professionals discover critical threats reactively — by scanning social feeds, reading daily newsletters, or checking alerts during business hours. We wanted to build a proactive solution: "A Security Guard on Your Wrist."

Our goal was to design a real-time, context-aware intelligence network that continuously monitors the internet for threats matching a team's exact tech stack, triages the risk via AI, and delivers haptic notifications directly to a Wear OS smartwatch.

🔍 What it does

WatchTower is a multi-platform threat intelligence suite comprised of a Python FastAPI backend, an Android companion phone app, and a Wear OS smartwatch app. Together, they form a real-time intelligence loop:

  1. Targeted Monitoring: Developers specify their exact infrastructure stack (e.g., Kubernetes, Node.js, Python, AWS) and corporate domains (e.g., acme-corp.com) on the companion app.
  2. 14-Engine Parallel Scans: The backend automatically triggers parallel, multi-source searches across 14 distinct engines (powered by SerpApi) — querying Google Search, News, Scholar, Trends, Exploit-DB, and paste bins for credential leaks.
  3. AI Triage & Dynamic Scoring: WatchTower enriches raw findings with NVD (National Vulnerability Database) severity, EPSS (Exploit Prediction Scoring System) exploitability, and CISA KEV active exploitation data. An AI engine (Groq/Gemini) then processes these findings, filters noise, writes a concise 2-line watch-friendly summary, and calculates a dynamic Threat Score (0–100).
  4. Instant Wear OS Sync: Alerts are synchronized to the Wear OS device, vibrating the user's wrist with customized haptic patterns based on threat severity (CRITICAL, WARNING, INFO). A color-coded gauge complication updates directly on the watch face.
  5. 1-Click DevOps Actions: From the mobile dashboard, users can immediately generate formatted Markdown security advisories, file GitHub Issues via API, or dispatch alert payloads to Slack and PagerDuty webhooks.

The Threat Score Matrix

The Threat Score is calculated dynamically on the backend and mapped as follows:

Score Range Status Indicator Severity Level Recommended Action Watch Complication Color
0 – 30 🟢 Safe Minimal Risk Routine monitoring; no immediate action needed Green Gauge
31 – 60 🟡 Warning Moderate Risk Review newly published security advisories and patches Yellow Gauge
61 – 100 🔴 Critical High Risk Immediate Action Required: Patch stack dependencies or mitigate zero-day Red Gauge

🛠️ How we built it

We built WatchTower from the ground up using a modern, decoupled stack:

Architecture Flow Graph

graph TD
    %% Define Nodes
    SA[SerpApi Service: 14 Parallel Search Engines] -->|Raw OSINT Data| BE(FastAPI Backend Server)
    NVD[NVD/EPSS Database] -->|CVSS & EPSS Scores| BE
    BE -->|AI Grounding Context| AI[Groq / Gemini AI Triage Engine]
    AI -->|2-Line Summaries & Risk Score| BE

    BE -->|SQLite & GCP Firestore| DB[(Dual-Layer Persistence)]
    BE -->|WebSockets: /ws/alerts| MOB[Android Companion App]

    %% Dual Sync pairing
    MOB -->|Wearable DataClient: Local Bluetooth| WATCH[Wear OS Smartwatch App]
    MOB -->|Firebase Realtime Database Cloud Sync| WATCH

    %% Complications and Notifications
    WATCH -->|Complications API| FACE[Watch Face Complication Gauge]
    WATCH -->|Vibration API| HAP[Severity-based Wrist Haptics]

1. The Real-Time Backend (backend/main.py)

  • Core API & Sockets: Written in Python using FastAPI and Uvicorn for high performance and native support for async operations and WebSockets (/ws/alerts).
  • Parallel Intelligence Scanners (backend/serp_scanner.py): Executes 14 distinct SerpApi search queries concurrently using a ThreadPoolExecutor to achieve ludicrous speed searches under 250ms.
  • AI Triage Engine (backend/ai_triage.py): Leverages Groq & Gemini APIs to generate watch-compatible threat summaries and calculate composite risk scores.
  • Enricher & Logger (backend/nvd_enricher.py & backend/firestore_logger.py): Connects to the NVD REST API and persists scan audit logs to a local SQLite database and cloud-based GCP Firestore.

2. The Android Companion App (app/src/main/java/com/tensormind/watchtower/MainActivity.kt)

  • Modern UI & Micro-Animations: Developed in Kotlin using Jetpack Compose and Material Design 3. We integrated the Lottie Compose library to bring the interface to life:
    • The Pulse Radar: A custom, pulsing radar scanning animation that displays while background queries are running.
    • Dynamic Success Checkmark: A smooth, morphing success checkmark animation that triggers upon successful pair validation.
    • Connection Pingers: Circular waves pulsing on the settings tab to show active device-to-device communication status.
  • Dual-Sync pairing:
    • Local Sync: Utilizes the Google Play Services Wearable Data Layer API (WearSyncManager) to sync threat parameters and push haptic vibrations via local Bluetooth loopbacks.
    • Remote Cloud Sync: Employs a 6-digit verification code system mapped via a Firebase Realtime Database bridge (FirebasePairingManager), enabling remote syncing even if the phone and watch are on different networks.
sequenceDiagram
    autonumber
    participant Watch as Wear OS Watch
    participant Firebase as Firebase RTDB Bridge
    participant Phone as Android Phone
    participant Backend as FastAPI Backend

    Note over Watch, Phone: Initial Setup / Pairing
    Watch->>Backend: Generate pairing code (POST /api/pair/generate)
    Backend->>Firebase: Create pending session
    Backend-->>Watch: Return 6-digit code
    Note over Watch: Watch displays 6-digit code
    Phone->>Backend: Verify 6-digit code (POST /api/pair/verify)
    Backend->>Firebase: Update session to PAIRED
    Backend-->>Phone: Return success & Watch ID

    Note over Phone, Backend: Live Scanning
    Phone->>Backend: Trigger Scan (POST /scan)
    Backend->>Backend: Parallel SerpApi OSINT & AI Triage
    Backend-->>Phone: Return Threat Score & Alert Cards
    Phone->>Firebase: Push latest scan data
    Firebase-->>Watch: Trigger realtime database listener
    Note over Watch: Wrist vibrates & UI card updates

3. The Wear OS Watch App (wear/src/main/java/com/tensormind/watchtower/wear/WearActivity.kt)

  • Wearable Interface: Built using Wear Compose optimized for circular watch faces.
  • Complications: Provides a custom circular complication utilizing the Wear OS Complication API (ThreatScoreComplicationService) to display the color-coded Threat Score directly on native watch faces.
  • Background Listener (WatchTowerWearListenerService): A background listener service that handles incoming alert intents and wakes up the watch interface.

🚧 Challenges we ran into

1. Grounding AI to Eliminate Hallucinations

Traditional LLMs suffer from knowledge cutoff dates and are prone to hallucinating CVE details (e.g., misstating affected versions or CVSS vectors). We solved this by grounding our AI models with SerpApi. The table below demonstrates the result of this solution:

Feature Static LLM (Without SerpApi) WatchTower AI (With SerpApi)
Vulnerability Detection ❌ Stale. Blind to newly published 0-day exploits. 🟢 Real-time. Detects exploits within minutes of index.
CVE Detail Accuracy ❌ Poor. Hallucinates CVSS vectors and affected versions. 🟢 Exact. Grounded in authoritative NVD databases.
Leak & Breach Awareness ❌ Zero. Cannot access public paste sites or dumps. 🟢 Comprehensive. Scans Pastebin and dark-web indexes.
Exploit Wave Warning ❌ None. No trend telemetry. 🟢 Active. Flags search term surges on Google Trends.
Verdict Stale / High Risk Real-Time Protection & Triage

2. Battery-Efficient Synchronization

Constantly polling backend servers from a Wear OS device destroys battery life. To solve this, we decoupled the watch from direct backend polling:

  • The companion phone app handles the heavier backend interactions and live scans.
  • The phone pushes lightweight, compressed JSON payloads to the watch using the Google Play Services DataClient layer, which automatically batches data to optimize battery usage.
  • For remote syncing, the backend uses Firebase RTDB to push changes instantly to a lightweight watch-level cloud listener only when data changes.

3. Emulator Network Routing

Android Virtual Devices (AVD) utilize isolated loopback interfaces, making it tricky to communicate with a FastAPI backend running on the host machine. We solved this by implementing:

  • Standard loopback fallbacks (10.0.2.2 and 10.0.3.2).
  • Integrated instructions and configuration constants supporting ADB port forwarding commands: bash adb forward tcp:8000 tcp:8000 This cleanly maps the emulator's port 8000 back to the host machine.

🏆 Accomplishments that we're proud of

  • High Performance Parallel Scans: Orchestrated a 14-engine parallel scanning system using a thread pool that queries, aggregates, and filters live search data in a fraction of a second.
  • Clean Circular Wear OS Layouts: Designed highly readable Wear Compose alert cards and detail scroll containers optimized for circular screens.
  • Color-Coded Complication Integration: Successfully bound the active threat score state to a system-wide watch face complication that updates dynamically.
  • Dual-Sync Pairing System: Implemented a robust pairing flow combining offline Bluetooth syncing with Firebase cloud syncing, allowing seamless cross-device alerts.
  • Grounding Ground-Truth Proof: Built the /api/compare/llm-vs-serp comparison endpoint, allowing judges to test and witness firsthand how grounding AI with SerpApi live data prevents hallucinations.

📖 What we learned

  • AI Grounding is Essential: Grounding AI with real-time, verified web search results is a necessity for security domains where stale data or hallucinated CVE info can lead to massive infrastructure breaches.
  • Wearable Interface Optimization: Designing interfaces for Wear OS requires stripping away visual clutter and focusing strictly on concise, high-impact data points.
  • Haptic Intentionality: Simple screen notifications are easy to ignore; custom vibration patterns (like double long pulses for CRITICAL RCE alerts) are extremely effective for grabbing immediate developer attention.

🚀 What's next for WatchTower

  • CI/CD Stack Discovery: Integrate WatchTower directly into GitHub Actions or GitLab CI runners, automatically parsing configuration files (e.g., package.json, requirements.txt, docker-compose.yml) to update the monitored stack dynamically.
  • Active Patch Actioning: Add an "Apply Patch" option directly onto the watch details card, letting developers trigger automated patch pull requests or deployment rollbacks from their wrists.
  • Hacker Intelligence Feeds: Expand the SerpApi parallel scanner to track Telegram exploit channels, hacker forums, and closed leak databases for even faster zero-day notifications.

Built With

  • kotlin
Share this project:

Updates

Submission history