LibreFang 2026.7.21 Patches Multi-User Data Leaks and Adds MCP Resources

·2 views

LibreFang has released version 2026.7.21, incorporating 61 pull requests from four contributors since the previous release ten days ago. The update addresses critical security issues, including a knowledge graph data leak that could expose one user's memory to another on shared agents, and adds cross-account channel guards to block unauthorized agent-to-channel messages. A four-pass repository-wide security audit identified and resolved more than 15 bugs spanning authorization gaps and token-quota race conditions. New features include per-user LLM provider credentials with spend tracking, operator-controlled provider allowlists, real-time Slack progress updates for long-running tasks, and online editing of HAND.toml manifests from the dashboard. The release also completes MCP integration by implementing the resources primitive, extending agent access beyond tools alone.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Linux Foundation Launches x402 Protocol to Enable AI Agents to Make Payments via HTTP

The Linux Foundation officially launched the x402 Foundation on July 14, 2026, establishing an open-governance body to oversee the x402 protocol, a standard originally contributed by Coinbase. The protocol revives the long-dormant HTTP 402 status code to create a native payment layer within web requests, allowing AI agents to pay for APIs, data, and content autonomously without human involvement. Forty organizations have joined the foundation, including Visa, Mastercard, Stripe, Google, AWS, Coinbase, and Cloudflare, signaling broad industry alignment. Transactions on Base using x402 surpassed 100 million cumulatively through Q1 2026, with payments of $1 or more now accounting for 95% of transferred volume, suggesting a shift toward real commercial use. Settlement via the protocol takes roughly 200 milliseconds using stablecoins such as USDC, compared to one to three days for traditional ACH transfers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic Chose Bun Over Node.js for Claude Code CLI: Here Is Why

Anthropic built its agentic CLI coding assistant Claude Code on Bun rather than the conventional Node.js runtime. A key reason is startup speed: Bun launches in 5–15ms compared to Node's 50–80ms, reducing the perceived lag for a tool invoked repeatedly during development sessions. Bun also simplifies the build pipeline by bundling and compiling TypeScript into a self-contained binary in a single command, eliminating several steps typically required with Node.js tooling. Its package manager installs dependencies 10–25 times faster than npm, making global installs and updates noticeably quicker for end users. The choice reflects broader ecosystem signals that fast startup and streamlined tooling are increasingly prioritised for TypeScript-heavy CLI applications in 2025.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Claims $130K Profit Using Bot to Exploit Polymarket Price Lags

A developer has shared details of an automated trading bot designed to exploit price discrepancies on Polymarket, a prediction market platform. The bot monitors external data feeds and Polymarket order books simultaneously, acting when confirmed real-world events have shifted true probabilities before the market reflects them. The strategy reportedly applies to cryptocurrency, politics, sports, and news-based prediction markets. The developer claims the approach has contributed to $130,000 in cumulative profits, attributing success to speed and reliable data sourcing. The project's code has been made publicly available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Claims $130K+ Trading Bot Profits Using Legged Arbitrage on Polymarket

A developer has shared details of a 'legged' arbitrage strategy used on Polymarket, a prediction market platform. Unlike traditional simultaneous arbitrage, the approach involves buying one underpriced side of a market first, then waiting for sentiment shifts before purchasing the other side at a combined cost under $1.00. The strategy is said to perform best in volatile, non-crypto event markets such as elections, sports playoffs, and news-driven topics. The developer credits careful inventory and timing controls for helping the bot accumulate a reported $130,000-plus track record. Source code for the bot has been published on GitHub.

0 comments Read more at DEV Community