TraceTree

What the company appears to be: TraceTree is a runtime behavioral security scanner that uses static analysis (radare2, YARA) and machine learning classification to assess file safety. It presents assessments (safe/caution/danger) in a Next.js dashboard and includes an MCP server for querying scan results. The project was built as part of a hackathon using AI tools like Codex and GPT-5.6.

What changed: The author states that the project evolved from a basic security scanner into a more complete tool, with a focus on fixing a critical bug in how assessments were rendered — specifically, malicious files were being downgraded to caution instead of danger. This was fixed through AI-assisted debugging and cross-layer contract analysis.

The single most important open question: Is there any evidence of real-world usage or adoption beyond the hackathon context? The description does not indicate whether this tool has been deployed in production environments, tested with users, or integrated into existing security workflows.

The description states that TraceTree is a runtime behavioral security scanner. It combines:

• Static analysis using radare2 and YARA rules
• An ML-based classifier
• A Next.js dashboard for displaying assessments (safe/caution/danger)
• An MCP server component to allow agentic tools to query scan results

It also includes an Electron-based desktop app that watches the Downloads folder, auto-sandboxes new files in Docker, and surfaces assessments through a consumer-friendly UI.

Evidence:

• "TraceTree scans files through a layered pipeline — static YARA/radare2 analysis feeding into an ML-based classifier"
• "surfaces a clear assessment (safe / caution / danger) in a Next.js dashboard"
• "An MCP server component lets agentic tools query scan results directly"
• "Evolving TraceTree from a CLI/dashboard tool into an always-on desktop app"

Inference: The product appears to be a hybrid of static and dynamic analysis, with AI-assisted development and debugging.

The author states that the project started as a runtime behavioral security scanner, aiming to answer "is this file safe to run?" It evolved during the hackathon to incorporate AI tools like Codex and GPT-5.6 for building and debugging.

Evidence:

• "TraceTree started as a runtime behavioral security scanner — combining radare2 disassembly, YARA rule matching, and an ML classification pipeline"
• "Going into Build Week, the goal was to sharpen a real, working security tool using Codex and GPT-5.6 rather than start from scratch"

Inference: The positioning has shifted from a basic scanner to a more refined, AI-enhanced version of a security tool, with an emphasis on correctness and debugging.

The description does not clearly identify the target customer or ideal customer profile (ICP). It mentions that the tool is intended for use in a desktop app that watches Downloads folders and surfaces assessments through a consumer-friendly UI.

Evidence:

• "Evolving TraceTree from a CLI/dashboard tool into an always-on desktop app"
• "auto-sandboxes new files in Docker, and surfaces assessments through a consumer-friendly UI"

Inference: The target user appears to be a consumer or individual user, not enterprise or B2B. However, this is speculative without further evidence.

There is no evidence of a business model or pricing structure in the description.

Evidence:

• No mention of monetization, licensing, subscriptions, or pricing tiers
• The project was built for a hackathon and is described as a proof-of-concept

Inference: The tool appears to be a prototype or demo with no commercial model evident.

The project uses:

• Languages: Python, TypeScript, Node.js, React, Next.js
• Tools: radare2, YARA, Docker, FastAPI, GPT-5.6, Codex, Claude Code, Antigravity (knowledge graph analysis)
• Architecture: Multi-layered pipeline with static and ML components; backend API layer; frontend dashboard

Evidence:

• "Built with (author-declared): codex, css, docker, fastapi, gpt-5.6, machine-learning, mcp, nextjs, node.js, python, radare2, react, security, tailwind, typescript, yara"
• "We used knowledge-graph analysis (Antigravity) to map the existing codebase's architecture"
• "The backend was never emitting 'malicious' as a decision string"

Inference: The tool is built with modern stack and integrates AI for development and debugging. It shows some sophistication in handling cross-layer bugs.

There is no evidence of traction, revenue, or customer adoption beyond the hackathon context.

Evidence:

• "This project was submitted to the OpenAI 2026 hackathon"
• No mention of users, customers, or real-world deployment
• No data on usage, performance, or impact

Inference: The tool is in a very early stage and has not demonstrated any traction or market validation.

The description does not provide information about competitors or the broader security scanning landscape.

Evidence:

• No mention of existing tools or platforms in this space
• No comparison to other malware scanners or behavioral analysis systems

Inference: The competitive context is unknown, and there is no indication of how TraceTree would differentiate itself from existing solutions.

1. No commercial traction or adoption: The tool was built for a hackathon and lacks evidence of real-world usage.
2. Unproven business model: No indication of monetization or pricing strategy.
3. Limited team size: Only one member (Tejas Prasad) is listed, which may limit scalability or depth of development.
4. AI dependency: Heavy reliance on AI tools like Codex and GPT-5.6 raises questions about long-term viability if those tools change or become unavailable.

Evidence:

• "Team size: 1"
• "This project was submitted to the OpenAI 2026 hackathon"
• No mention of revenue, customers, or product-market fit

1. What is the current status of the desktop app? Is it functional and tested?
2. Are there any plans for monetization or commercial deployment?
3. How does TraceTree compare to existing tools in the malware detection space?
4. Has the tool been tested with real-world files or scenarios beyond the hackathon?
5. What are the long-term technical dependencies, especially around AI tools like Codex and GPT-5.6?