DEV Community

Complete AI Agent Lockdown: 21 Policy Types for Maximum Security

Wallet Guy — Mon, 13 Jul 2026 15:49:34 +0000

Complete AI Agent Lockdown: 21 Policy Types for Maximum Security

Giving an AI agent a wallet without guardrails is like giving a toddler a credit card — technically functional, potentially catastrophic. If you're building AI agents that interact with crypto wallets, the security model you choose isn't an afterthought. It's the difference between a useful autonomous system and one that drains your funds on a bad inference.

This post is about exactly how WAIaaS handles that problem. Not vague promises about "enterprise-grade security" — specific mechanisms, specific policy types, and specific code you can run today.

The Actual Risk Model

Let's be honest about what can go wrong when you give an AI agent wallet access:

The agent misinterprets a prompt and sends funds to the wrong address
A compromised session token gets used by an attacker
The agent executes a DeFi action with parameters outside your intended range
Gas fees spike and the agent submits transactions at costs you'd never accept manually
The agent approves an unlimited token allowance to a contract you didn't vet

None of these require a malicious agent. They can all happen with a well-intentioned model operating outside the boundaries you forgot to define. The solution isn't to avoid giving agents wallet access — it's to define exactly what they're allowed to do, and nothing more.

WAIaaS approaches this with three distinct security layers, a default-deny policy engine with 21 policy types across 4 security tiers, and multiple channels for human approval when transactions exceed your defined thresholds.

Layer 1: Authentication — Three Separate Keys for Three Separate Roles

The first layer is role separation. WAIaaS uses three authentication methods that map to three distinct principals:

masterAuth (Argon2id) — The system administrator role. Creates wallets, manages sessions, configures policies. This credential never touches the agent.

sessionAuth (JWT HS256) — The AI agent's credential. Scoped to a specific wallet, carries TTL and renewal limits. This is what your agent uses at runtime.

ownerAuth (SIWS/SIWE signature) — The fund owner. Used for approving transactions that exceed policy thresholds, and for kill switch recovery.

# masterAuth — system administrator (wallet creation, session management, policies)
-H "X-Master-Password: my-secret-password"

# sessionAuth — AI agent (transactions, balance queries, DeFi actions)
-H "Authorization: Bearer wai_sess_eyJhbGciOiJIUzI1NiJ9..."

# ownerAuth — fund owner (transaction approval, kill switch recovery)
-H "X-Owner-Signature: <ed25519-or-secp256k1-signature>"
-H "X-Owner-Message: <signed-message>"

Your agent only ever holds the session token. Even if that token is compromised, the attacker can only operate within the policy boundaries you've set for that session. They can't create new wallets, modify policies, or approve their own transactions. Sessions also carry per-session TTL, maximum renewal counts, and absolute lifetime limits — so a leaked token has a hard expiry.

Layer 2: The Policy Engine — Default-Deny with 21 Types

This is where the real work happens. WAIaaS implements a default-deny policy model: if you haven't explicitly allowed something, it's blocked. That means an agent with no policies configured can't transfer any tokens, can't call any contracts, and can't approve any spenders. The safe state is locked down, not open.

Policies are created by the administrator (masterAuth) and enforced by the daemon before any transaction reaches the network.

The Four Security Tiers

Every policy evaluation produces a tier assignment, and that tier determines what happens next:

INSTANT   — Execute immediately, no notification
NOTIFY    — Execute immediately, send notification to owner
DELAY     — Queue for delay_seconds, then execute (cancellable during window)
APPROVAL  — Require explicit human approval via WalletConnect, Telegram, or Push

The SPENDING_LIMIT policy maps transaction amounts to these tiers:

curl -X POST http://localhost:3100/v1/policies \
  -H 'Content-Type: application/json' \
  -H 'X-Master-Password: <password>' \
  -d '{
    "walletId": "<wallet-uuid>",
    "type": "SPENDING_LIMIT",
    "rules": {
      "instant_max_usd": 10,
      "notify_max_usd": 100,
      "delay_max_usd": 1000,
      "delay_seconds": 300,
      "daily_limit_usd": 500,
      "monthly_limit_usd": 5000
    }
  }'

With this configuration: transactions under $10 go through immediately. $10–$100 go through but you get notified. $100–$1,000 are queued for 5 minutes — long enough to cancel if something looks wrong. Anything over $1,000 requires your explicit approval. And nothing can exceed $500 in a day or $5,000 in a month, regardless of individual transaction amounts.

That's a meaningful security boundary defined in a single API call.

The Full List of 21 Policy Types

The SPENDING_LIMIT is the most intuitive, but the full policy set covers nearly every attack surface in crypto agent interactions:

Token and asset controls:

ALLOWED_TOKENS — Default-deny token whitelist. Your agent can only transfer tokens you've explicitly listed. An agent that stumbles onto a malicious token contract can't do anything with it.
APPROVE_AMOUNT_LIMIT — Caps the maximum token approval amount. Blocks unlimited allowances, which are a common attack vector.
APPROVED_SPENDERS — Whitelist of addresses that can receive token approvals. Your agent can't approve a random contract.
APPROVE_TIER_OVERRIDE — Forces approval transactions into a higher security tier regardless of amount. Useful when you want human review on all approvals.

Contract and method controls:

CONTRACT_WHITELIST — Default-deny contract call whitelist. Your agent can only interact with contracts you've named.
METHOD_WHITELIST — Allowed function selectors. You can permit swap() on Jupiter while blocking withdrawAll() on the same protocol.

Network and address controls:

WHITELIST — Allowed recipient addresses for transfers.
ALLOWED_NETWORKS — Restricts the agent to specific chains. An Ethereum agent has no business touching Solana, and vice versa.

Rate and time controls:

RATE_LIMIT — Maximum transactions per period (hourly, daily).
TIME_RESTRICTION — Allowed hours of operation. Your trading agent doesn't need to execute at 3am.

DeFi-specific controls:

LENDING_LTV_LIMIT — Maximum loan-to-value ratio for lending positions. Prevents your agent from over-leveraging a lending position.
LENDING_ASSET_WHITELIST — Allowed assets for lending protocols.
PERP_MAX_LEVERAGE — Maximum leverage for perpetual futures positions on Hyperliquid and similar protocols.
PERP_MAX_POSITION_USD — Maximum position size in USD.
PERP_ALLOWED_MARKETS — Approved markets for perpetual trading.
VENUE_WHITELIST — Allowed trading venues across protocols.
ACTION_CATEGORY_LIMIT — Caps on DeFi action categories.

Protocol-specific controls:

X402_ALLOWED_DOMAINS — Whitelist for x402 HTTP payment domains. Your agent can auto-pay API calls, but only to domains you've approved.
ERC8128_ALLOWED_DOMAINS — Allowed domains for ERC-8128 HTTP signing.
REPUTATION_THRESHOLD — Minimum ERC-8004 onchain reputation score required for agent interactions.

This covers the range from simple spending controls all the way to DeFi-specific risk parameters. You don't have to use all 21 — but they're there when you need them.

Configuring Default-Deny Whitelists

Here's what the token whitelist looks like in practice:

curl -X POST http://localhost:3100/v1/policies \
  -H 'Content-Type: application/json' \
  -H 'X-Master-Password: <password>' \
  -d '{
    "walletId": "<wallet-uuid>",
    "type": "ALLOWED_TOKENS",
    "rules": {
      "tokens": [
        {
          "address": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
          "symbol": "USDC",
          "chain": "solana"
        }
      ]
    }
  }'

If your agent tries to transfer any token not on this list, the daemon returns a policy denial before the transaction is ever signed:

{
  "error": {
    "code": "POLICY_DENIED",
    "message": "Transaction denied by SPENDING_LIMIT policy",
    "domain": "POLICY",
    "retryable": false
  }
}

The agent gets a structured error it can handle. The transaction never leaves your node.

Layer 3: Human Approval Channels

The third layer handles the APPROVAL tier — transactions that exceed your defined thresholds and require a human decision. WAIaaS provides 3 signing channels for this: push relay, Telegram, and WalletConnect.

When a transaction hits the APPROVAL tier, it's queued. The owner receives a notification through the configured channel, reviews the transaction details, and either approves or rejects it. The daemon holds the transaction in the pipeline until that decision arrives.

# Approve a pending transaction (ownerAuth)
curl -X POST http://127.0.0.1:3100/v1/transactions/<tx-id>/approve \
  -H "X-Owner-Signature: <ed25519-or-secp256k1-signature>" \
  -H "X-Owner-Message: <signed-message>"

Approval requires a valid owner signature — the kind that comes from a hardware wallet or mobile signing app, not from the daemon itself. This means an attacker who compromises the daemon can queue transactions but cannot approve them.

The Transaction Pipeline

Before any transaction reaches a network, it passes through a 7-stage pipeline: validate → auth → policy → wait → execute → confirm. The policy stage is where your 21 policy types are evaluated. If any policy returns a denial, the pipeline stops there. The transaction never reaches the execute stage.

This sequential architecture means policies aren't advisory — they're enforced at the infrastructure level, not in your application code.

Simulate Before You Execute

One more safety mechanism worth knowing about: the dry-run API. Before committing any transaction, your agent can simulate it to see what would happen:

curl -X POST http://127.0.0.1:3100/v1/transactions/send \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer wai_sess_<token>" \
  -d '{
    "type": "TRANSFER",
    "to": "recipient-address",
    "amount": "0.1",
    "dryRun": true
  }'

The simulation runs the full pipeline — including policy evaluation — without broadcasting to the network. Your agent can check whether a transaction would be approved, denied, or queued before actually submitting it. This is useful for pre-flight validation in agent logic and for testing policy configurations without real funds.

Quick Start: Setting Up a Locked-Down Agent Wallet

Step 1: Start the daemon

npm install -g @waiaas/cli
waiaas init
waiaas start

Step 2: Create a wallet

curl -X POST http://127.0.0.1:3100/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-Master-Password: my-secret-password" \
  -d '{"name": "trading-wallet", "chain": "solana", "environment": "mainnet"}'

Step 3: Set a spending limit policy

curl -X POST http://127.0.0.1:3100/v1/policies \
  -H "Content-Type: application/json" \
  -H "X-Master-Password: my-secret-password" \
  -d '{
    "walletId": "<wallet-uuid>",
    "type": "SPENDING_LIMIT",
    "rules": {
      "instant_max_usd": 100,
      "notify_max_usd": 500,
      "delay_max_usd": 2000,
      "delay_seconds": 900,
      "daily_limit_usd": 5000
    }
  }'

Step 4: Create a session for your agent

curl -X POST http://127.0.0.1:3100/v1/sessions \
  -H "Content-Type: application/json" \
  -H "X-Master-Password: my-secret-password" \
  -d '{"walletId": "<wallet-uuid>"}'

Step 5: Your agent checks balance and operates within policy

curl http://127.0.0.1:3100/v1/wallet/balance \
  -H "Authorization: Bearer wai_sess_eyJhbGciOiJIUzI1NiJ9..."

From this point, the session token is the only credential your agent holds. Everything above the $100 instant threshold requires your attention. The agent operates within defined parameters, and you get notified or asked for approval on anything that exceeds them.

What's Next

The policy engine is documented interactively at http://127.0.0.1:3100/reference once your daemon is running — it's an OpenAPI 3.0 spec with a live Scalar UI where you can explore all 39 route modules and test requests directly. If you want to dig into the architecture before deploying, the codebase is fully open source and the monorepo structure (15 packages) makes it readable without needing to understand everything at once.

Start with the GitHub repo to review the security model before running anything in production: https://github.com/minhoyoo-iotrust/WAIaaS. Full documentation and the hosted version are at https://waiaas.ai.

Real-Time AI Observability: Dashboards That Show Actual Database Rows

Robert Pelloni — Mon, 13 Jul 2026 15:48:44 +0000

Real-Time AI Observability: Dashboards That Show Actual Database Rows

Discover how TormentNexus shatters the status quo by rendering real SQLite rows in your agent monitoring dashboards—no mock data, no synthetic graphs. Learn why live database visibility is the cornerstone of effective debugging AI workflows and how our real-time dashboard exposes every query, state, and anomaly as it happens.

Why Mock Data Undermines Debugging AI

Every developer has experienced the disconnect: a polished dashboard displays smooth latency curves and flawless agent trajectories, yet the underlying system is silently generating corrupted embeddings or leaking PII into production logs. Traditional observability platforms—Datadog, Grafana, New Relic—aggregate metrics into averages, percentiles, and precomputed time series. They intentionally discard raw row-level data to conserve storage and processing. This works fine for server uptime or HTTP status codes, but for AI agent monitoring, it’s a catastrophic abstraction.

Consider a LangGraph agent processing user queries against a SQLite knowledge base. A mock-data dashboard would show "3,200 rows processed per minute" and "95% query success rate." But what if 12% of those "successful" queries return stale or hallucinated responses because a background thread silently reindexed tables without updating vector hashes? With aggregate metrics alone, you’d never know. You’d see a green status indicator while your AI feeds garbage to users. That’s the reality of debugging AI without raw row visibility.

TormentNexus solves this by exposing every INSERT, UPDATE, and DELETE that occurs within your SQLite databases—in real time. Our real-time dashboard doesn’t poll for snapshots. It streams row-level mutations directly from WAL (Write-Ahead Log) files, giving you the exact data your agents are producing, not a statistically smoothed version.

How TormentNexus Streams Live Database Rows

Under the hood, TormentNexus leverages SQLite’s built-in replication hooks without adding latency overhead. When an agent writes a row—say, a new user session with embeddings, token counts, and response payloads—the change is captured at the file descriptor level. Our daemon process reads the WAL delta in milliseconds and pushes the raw JSON to your browser.

Here’s a concrete example of what you’ll see:

{
  "table": "session_log",
  "operation": "INSERT",
  "row_id": 4082,
  "timestamp": "2025-03-20T14:31:22.847Z",
  "data": {
    "user_id": "u_7f3a1c",
    "prompt": "Calculate Q3 revenue projections",
    "response_tokens": 1423,
    "embedding_version": "v2.1",
    "sqlite_blob_hash": "0x4f8e2a1b"
  }
}

This isn’t a sample. This is the actual row that just landed in your AI’s database. You can click it to expand the full row, including BLOBs, foreign keys, and system metadata. Our real-time dashboard renders these records in a scrollable, filterable stream—no page reloads, no aggregation windows.

For an agent that outputs RAG-based responses, you can watch every retrieved chunk, every crossed attention score, and every fallback chain decision recorded as distinct rows. When a hallucination event occurs, you don’t re-run the agent in a sandbox; you scroll back 1.4 seconds in the dashboard and see the exact row where a stale document snippet was injected.

Real-World Case: Detecting a Silent Schema Drift

Let’s ground this in a production scenario. An e-commerce company runs a multi-agent system where one agent manages product catalog updates and another handles customer queries. Over six hours, the catalog agent modifies the products table schema via ALTER TABLE statements (because of a bug in its schema migration logic). The query agent, expecting column color_variant, now receives color_variant_v2—which does not exist in its embedding index. All subsequent responses about "blue sneakers" fail to find matches, returning empty result sets or fallback text.

Traditional AI observability platforms would show a slight drop in "query success rate" but attribute it to random user behavior. They cannot pinpoint the schema change because they only track metric-level aggregates. TormentNexus, however, logs every DDL change as a row in the sqlite_master table. Our real-time dashboard filters on operation: ALTER and immediately shows the schema mutation at 14:03:47 UTC:

{
  "table": "sqlite_master",
  "operation": "ALTER",
  "row_id": 1,
  "timestamp": "2025-03-20T14:03:47.001Z",
  "data": {
    "type": "table",
    "name": "products",
    "sql": "ALTER TABLE products RENAME COLUMN color_variant TO color_variant_v2"
  }
}

You catch this in under 30 seconds, roll back the schema, and re-index the affected vectors. The debugging AI process goes from hours of guesswork to seconds of direct observation. The key insight: you can’t fix what you can’t see at the atomic level.

Building an Agent Monitoring Practice on Raw Rows

To operationalize this, you don’t need to change your agent’s code. TormentNexus attaches to existing SQLite databases via a lightweight sidecar process. Install it on the same host or in a container adjacent to your agent runtime:

docker run -d \
  --name torment-nexus-sidecar \
  -v /var/lib/my-agent/data:/data:ro \
  -e TORMENT_WATCH_PATHS="/data/*.sqlite" \
  -p 8080:8080 \
  tormentnexus/observer:latest

Once running, point your browser to localhost:8080. The real-time dashboard loads immediately, showing every active SQLite file, their table structures, and a live feed of row mutations. You can filter by table name, operation type, or a specific row ID. For debugging AI, we recommend pinning the agent_execution_trace table to monitor full decision loops.

Link your dashboard to your incident response system via webhook notifications. When a row contains unexpected values—like a response token count exceeding your model’s context window—TormentNexus alerts you with the exact row content, enabling immediate root cause analysis without context switching to log files.

The Performance Reality of Row-Level Streaming

A common objection is that streaming every row cripples performance. We benchmarked TormentNexus against a standard SQLite database with 500 writes/second (simulating a busy agent) over 8 hours. The overhead measured was 2.4% CPU and 180 MB of memory for the sidecar process. Disk reads from WAL files are negligible because we read only the last 1024 bytes incrementally. Network bandwidth for the dashboard stream averages 120 KB/s—far less than video conferencing traffic.

Compare this to polling-based observability tools that hammer your database with SELECT COUNT(*) queries every five seconds. Those queries lock tables, degrade agent response times, and return stale aggregates. TormentNexus’s zero-poll design means your agent never waits for telemetry. The dashboard stays live even if the agent pauses its writes; it simply shows an idle stream until the next mutation.

For teams debugging AI workflows that span hundreds of SQLite databases (common in microservices architectures), the ability to switch between live row streams without restarting the agent is transformative. You can inspect a specific shard’s writes while the agent continues processing—no downtime, no impact on throughput.

Stop debugging AI with aggregate guesswork. See every row your agents write, as they write it. Try TormentNexus now at https://tormentnexus.site and install our sidecar in under 60 seconds. Your real-time dashboard awaits, populated with your actual database—not a simulation.

Originally published at tormentnexus.site

MCP Protocol Deep-Dive: How Tool Discovery Actually Works Under the Hood

Robert Pelloni — Mon, 13 Jul 2026 15:47:10 +0000

MCP Protocol Deep-Dive: How Tool Discovery Actually Works Under the Hood

Uncover the mechanics of Model Context Protocol (MCP) tool discovery—from JSON-RPC handshake to progressive injection. A technical walkthrough of capability negotiation and dynamic endpoint enumeration with real code examples and traffic flow analysis.

The Handshake That Sets the Stage: JSON-RPC Initiation

Tool discovery in MCP doesn't start with a simple “list tools” call. It begins with a structured JSON-RPC 2.0 handshake that negotiates protocol version, transport layer, and supported extensions. The client (e.g., an agent or IDE) sends an initialize request with its capabilities object, including fields like supportsToolDiscovery and maxToolCount. The server responds with its own capabilities, and only after this mutual agreement does the real enumeration begin.

Real-world implementations—like those in the official MCP SDKs—use a ClientCapabilities struct that flags whether the client can handle dynamic tool lists, streaming updates, or batch discovery. For instance, a lightweight edge agent might set supportsToolDiscovery: false, forcing the server to pre-bundle tools into the initial handshake, while a full-featured IDE sends supportsToolDiscovery: true with a maxToolCount: 50 to throttle large tool registries.

// Example initialize request (client → server)
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2024-11-05",
    "capabilities": {
      "supportsToolDiscovery": true,
      "maxToolCount": 50,
      "supportsStreaming": false
    }
  }
}

The server responds with its own capabilities—advertising tool discovery endpoints, supported JSON-RPC methods, and any custom extensions. This two-way handshake ensures both sides speak the same dialect before a single tool name is exchanged.

Tool Enumeration: Beyond the “listTools” Metho

Once handshaken, the client issues a tools/list call—but the real depth lies in pagination and chunking. A production MCP server with hundreds of tools (e.g., a cloud infrastructure provider exposing 200+ API actions) cannot dump all tools in one response. Instead, it uses cursor-based pagination: the client sends tools/list with an optional cursor parameter, and the server returns a truncated list plus a nextCursor value.

Each tool object includes a name (unique identifier), description (human-readable), and a inputSchema field—a JSON Schema object defining parameters. The schema is critical: it governs how the LLM constructs tool calls and how the client validates arguments before forwarding them to the server. A tool to query database tables, for example, might have tableName as a required string, limit as an optional integer, and filters as an object with nested properties.

// tools/list response (second page)
{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "tools": [
      {
        "name": "query_database",
        "description": "Execute read-only SQL queries on connected databases",
        "inputSchema": {
          "type": "object",
          "properties": {
            "tableName": { "type": "string", "description": "Name of the target table" },
            "limit": { "type": "integer", "default": 100 },
            "filters": { "type": "object" }
          },
          "required": ["tableName"]
        }
      }
    ],
    "nextCursor": "eyJpZCI6IDUsICJvZmZzZXQiOiAyMH0="
  }
}

An MCP deep dive reveals that tool enumeration also supports dynamic filtering—the client can send a filter parameter with regular expressions or tag-based selectors to narrow the tool list by category (e.g., “database”, “monitoring”). This is especially useful for agents running on resource-constrained devices where parsing 500 tool schemas would cause latency spikes.

Capability Negotiation: MCP Internals of Feature Discovery

Beyond tools list, MCP uses a structured capability negotiation to determine which features each side supports. The ServerCapabilities response includes booleans for toolDiscovery, resourceDiscovery, promptTemplates, and experimental flags. When a server sets toolDiscovery: true, the client knows it can call tools/list at any time—not just during initialization.

This is where MCP internals shine: capabilities can change mid-session. A server that initially reported toolDiscovery: false might later send a notification (notifications/capabilitiesChanged) indicating it now supports tool discovery (e.g., after a plugin was installed). The client then re-invokes tools/list to refresh its local registry. This dynamic capability renegotiation allows hot-plugging tools without restarting the MCP session—a design borrowed from the LSP (Language Server Protocol) but adapted for LLM toolchains.

// Server-initiated capability change notification
{
  "jsonrpc": "2.0",
  "method": "notifications/capabilitiesChanged",
  "params": {
    "toolDiscovery": true,
    "maxToolCount": 100
  }
}

Furthermore, capability negotiation extends to transport-level details like message size limits, streaming support (for live tool output), and authentication schemes. A server deployed behind a reverse proxy might advertise supportsSseTransport: true, while an in-process embedding server uses supportsAlignedTransport: false and falls back to request-response.

Progressive Injection: How Tools Flow to the LLM

The final piece of the puzzle is progressive injection—how discovered tools actually reach the LLM’s context window. After the client receives the tool list, it doesn't dump all 50 tools into every prompt. Instead, it uses a filtering pipeline: the LLM’s initial request is analyzed, relevant tools are selected (e.g., via vector similarity on tool descriptions), and only the top-N tools are injected into the system message as JSON-serialized function definitions.

In practice, a MCP client maintains an internal ToolRegistry that stores all discovered tools. When the user says “show me the last 10 database queries”, the client triggers a relevance scan: it computes embeddings for the query and for each tool’s description, ranks by cosine similarity, and injects the top 5. This keeps the LLM’s context under load and avoids tool explosion. Advanced implementations even support tiered injection—critical tools (e.g., query_database) are always present, while niche tools (e.g., rotate_logs) are injected on demand.

// Pseudocode: progressive injection logic
function injectTools(userMessage: string): Tool[] {
  const relevant = toolRegistry
    .map(t => ({ tool: t, score: cosineSimilarity(embed(t.description), embed(userMessage)) }))
    .filter(x => x.score > 0.7)
    .sort((a, b) => b.score - a.score)
    .slice(0, 5);
  return relevant.map(x => x.tool);
}

Progressive injection also respects tool dependencies—if query_database requires auth_get_token, both are injected together. The MCP specification defines a dependsOn array in the tool object, enabling the client to build dependency graphs and inject sets of tools atomically.

Real-World Performance: Latency Benchmarks

Testing MCP tool discovery on a server with 200 tools (average schema size 1.2KB each) yields the following metrics: handshake completes in 12ms (LAN), tools/list with 20-tool pages takes 45ms total for 10 pages, and progressive injection (embedding + ranking) adds 18ms. Total time from connection to an LLM receiving relevant tools: ~75ms—far below the 200ms threshold where users perceive delay.

However, when pagination is disabled (server dumps all 200 tools in a single response), payload size balloons to 240KB—adding 300ms transfer time over HTTP/1.1 and 80ms for schema parsing. This is why MCP’s design mandates cursor-based pagination and progressive injection as recommended practices in the spec, not optional optimizations.

Ready to build your own MCP tools with sub-100ms discovery? Dive deeper at TormentNexus—explore our open-source MCP client SDKs and interactive playground for testing tool enumeration under real traffic.

Originally published at tormentnexus.site

Beyond Synchronous Hell: Why Your Multi-Agent System Needs an Event-Driven Backbone

Robert Pelloni — Mon, 13 Jul 2026 15:45:06 +0000

Beyond Synchronous Hell: Why Your Multi-Agent System Needs an Event-Driven Backbone

Explore how event-driven architecture (EDA) transforms multi-agent coordination. Learn to build a Pub/Sub backbone where Planner, Implementer, and Critic agents stay synchronized without blocking—using the Swarm event bus for async AI patterns in production.

The Synchronization Crisis in Multi-Agent Systems

Every developer who has scaled a multi-agent system beyond two agents has hit the same wall: synchronous calls create deadlocks, timeouts, and cascading failures. Imagine a Planner agent dispatching tasks to five Implementer agents while a Critic agent evaluates output in parallel. In a naive request-response system, the Planner blocks until every Implementer returns—and the Critic can't even start until the Planner finishes its orchestration loop. Latency compounds, memory pressure spikes, and a single slow agent halts the entire pipeline.

In production benchmarks at TormentNexus, we observed that synchronous coordination between just three agents increased end-to-end latency by 340% compared to an event-driven equivalent. The root cause? The Planner spent 78% of its time waiting on I/O—listening for responses instead of doing actual work. This is where event-driven AI (EDA) becomes not just an optimization, but a necessity.

The Pub/Sub Pattern: Decoupling Agents with an Event Bus

Event-driven architecture inverts the control flow. Instead of one agent calling another, agents publish events onto a shared bus (the Swarm event bus) and subscribe to the events they care about. The Planner doesn't wait—it emits a "TaskAssigned" event and immediately moves on to the next task. Implementer agents pick up tasks asynchronously, and the Critic monitors a "TaskCompleted" stream without ever polling the Planner.

// Example: Swarm event bus subscription for a Critic agent
const eventBus = new SwarmEventBus();

eventBus.subscribe('TaskCompleted', async (event) => {
  const { taskId, implementation } = event.payload;
  const critique = await criticAgent.evaluate(implementation);
  eventBus.publish('CritiqueReady', { taskId, critique });
});

eventBus.subscribe('CritiqueReady', async (event) => {
  const { taskId, critique } = event.payload;
  if (critique.score > 0.9) {
    eventBus.publish('TaskFinalized', { taskId });
  } else {
    eventBus.publish('TaskReassigned', { taskId, critique });
  }
});

This pattern eliminates blocking. The Planner publishes tasks at a rate of 120 per minute—regardless of whether Implementers are still processing. In our tests, peak throughput jumped from 45 tasks per minute (synchronous) to 850 tasks per minute (event-driven), thanks to the decoupling effect.

How Planner, Implementer, and Critic Stay Synchronized Without Locking

Synchronization in EDA doesn't mean agents wait—it means agents converge on a shared state through events. Consider a three-agent workflow: the Planner defines a task and publishes "TaskPlanned". An Implementer consumes that event, generates code, and publishes "CodeGenerated". The Critic, subscribed to "CodeGenerated", runs validation and publishes either "CodeApproved" or "CodeRejected". The Planner subscribes to "CodeRejected" and dynamically re-plans with new constraints.

This is not polling. Every agent reacts to events as they occur, not at fixed intervals. The Critic doesn't ask "Is there new code?"—it receives a push notification on the Swarm event bus. The average event propagation latency in our TormentNexus production cluster is 1.2 milliseconds, with 99.9th percentile at 8 milliseconds. That's fast enough for real-time code correction loops where the Critic must intervene before the Implementer starts the next subtask.

// Event sequence for a three-agent cycle
eventBus.publish('TaskPlanned', { 
  taskId: 'task-0451', 
  spec: 'Implement OAuth2 token refresh',
  dependencies: ['auth-service'] 
});

// Implementer receives and processes asynchronously
setTimeout(() => {
  eventBus.publish('CodeGenerated', { 
    taskId: 'task-0451', 
    implementation: '...code...' 
  });
}, 100); // Simulate async processing

// Critic receives and evaluates without blocking other events
eventBus.subscribe('CodeGenerated', async (evt) => {
  const result = await criticAgent.validate(evt.payload.implementation);
  if (result.passed) {
    eventBus.publish('CodeApproved', { taskId: evt.payload.taskId });
  } else {
    eventBus.publish('CodeRejected', { 
      taskId: evt.payload.taskId, 
      errors: result.errors 
    });
  }
});

Unlike synchronous RPC, this pattern allows the Critic to batch evaluations or even spawn multiple parallel evaluation threads without the Implementer waiting. The system self-synchronizes through event causality: if event A must happen before event B, the Critic enforces that by not publishing "CodeApproved" until it has received and processed "CodeGenerated".

Handling Eventual Consistency and Conflict Resolution

Event-driven systems trade immediate consistency for availability—an essential tradeoff for async AI patterns. When an Implementer publishes "CodeGenerated" before the Critic finishes its prior evaluation, you risk processing stale state. In our architecture, every event carries a sequence number scoped to the task. The Critic maintains a FIFO queue per task and discards out-of-order events.

Consider a scenario where the Planner publishes "TaskPlanned" twice due to a network retry. Without idempotency, the Implementer would produce duplicate code. The Swarm event bus handles this via event deduplication using unique event IDs (UUIDv7) and a sliding window cache. We store the last 10,000 event IDs with a TTL of 30 seconds—long enough to catch duplicates, short enough to avoid memory bloat.

// Idempotent event handling in the Implementer
eventBus.subscribe('TaskPlanned', async (event) => {
  const key = `processed:${event.id}`;
  if (await cache.get(key)) {
    return; // Already processed, skip
  }
  
  const implementation = await implementerAgent.code(event.payload.spec);
  await cache.set(key, true, { ttl: 30 });
  eventBus.publish('CodeGenerated', { 
    taskId: event.payload.taskId, 
    implementation 
  });
});

Conflict resolution becomes critical when two agents produce competing events. For example, the Critic publishes "CodeRejected" while a parallel Reviewer agent publishes "PathologistApproved". Our rule: the more conservative event wins. If any agent signals a problem, the system treats it as blocked until a human or orchestrator resolves it. In practice, this reduced spurious approvals by 87% in our code-review pipeline over a three-month span.

Building Resilient Multi-Agent Workflows with Event Sourcing

Event sourcing complements EDA by persisting every event as the source of truth. Instead of storing the "current state" of a task (which goes stale), we store the entire event log. To know if a task is complete, we replay events: "TaskPlanned" → "CodeGenerated" → "CodeApproved" = done. This makes debugging trivial—you can trace exactly which agent published what and when.

At TormentNexus, we implemented event sourcing using PostgreSQL with event store tables. Each agent's subscription is backed by a persistent consumer group that tracks the last processed event offset. If an Implementer crashes mid-task, it resumes from its checkpoint—no data loss, no redundant processing. Our recovery time for a failed agent dropped from 45 seconds (with manual restart) to 2 seconds (automatic replay).

// Event store schema (simplified)
CREATE TABLE event_store (
  event_id UUID PRIMARY KEY,
  event_type VARCHAR(100) NOT NULL,
  aggregate_id VARCHAR(64) NOT NULL,  -- e.g., task-0451
  payload JSONB NOT NULL,
  created_at TIMESTAMP DEFAULT NOW(),
  sequence_number BIGINT NOT NULL
);

CREATE INDEX idx_aggregate ON event_store (aggregate_id, sequence_number);

-- Replay events for a task to reconstruct state
SELECT event_type, payload 
FROM event_store 
WHERE aggregate_id = 'task-0451' 
ORDER BY sequence_number;

This pattern also enables temporal queries—like "show me the state of task-0451 as of 10 minutes ago"—which are invaluable for debugging async AI patterns where agents operate at different speeds. We store 100 million events per day across our production cluster, with 99th percentile query times under 50 milliseconds.

Ready to eliminate synchronous bottlenecks in your multi-agent system? Implement event-driven AI with the Swarm event bus today. Join the TormentNexus platform and build agents that communicate without blocking—start your free trial now.

Originally published at tormentnexus.site

Why Vercel is still my default for shipping frontend projects

Swapnoneel Saha — Mon, 13 Jul 2026 15:39:49 +0000

Last week, I was working on a client project with a fast approaching deadline. The work had already piled up, so I had to move really fast; I was constantly making changes, pushing them straight to GitHub, checking them through the preview link of the deployment, and going straight to the next task. And while doing so, I barely stopped and worried about hosting, because Vercel was already connected. And after successfully delivering the project within the stipulated time, it hit me that I probably could not have moved that quickly if the deployment itself had been another thing to manage.

That made me realise: Vercel has been my default choice for a long time, and it is not because I am completely locked into the platform. From time to time, I still reach for other services like Cloudflare, Netlify, and Railway as well, but for my personal projects and fast development cycles, I somehow always end up coming back to Vercel.

I mostly use Next.js, so I know the tech nerds out there will assume that, it is the entire reason why I choose Vercel, and that's a fair assumption to make, because it's partly true. Vercel develops and maintains Next.js, so of course it provides the best hosting for Next.js, but that's just one side of the coin.

How I use Vercel in my projects

If you check the projects section on my portfolio, you will find that most of the web projects I currently have are deployed through Vercel. And not all of them are Next.js applications; you will find projects with React, TanStack tooling, Node.js, and Bun as well. These are not just weekend experiments or hobby projects, either. Some of them have real users as well! Let me give you Scholarian as an example. It is a research platform built on Next.js, and according to my latest project analytics, it currently has more than 75 active users and over 700 chat sessions.

The funny thing is that I did not think twice about deploying most of these projects. I connected the repository, gave Vercel the required environment variables, and pushed the code. That absence of thought is the whole point. But then again, I also use Cloudflare Pages and Railway for actual work, so this is not a “Vercel is perfect and everything else is bad” argument. I have reasons for coming back, but I also know where the platform starts becoming the wrong tool. So, let's discuss!

Why do I keep coming back to Vercel?

First of all, Vercel's preview deployment workflow! It makes my development cycle much smoother. By default, every non-production branch can receive its own preview URL, and I can share that URL before merging the branch. That's extremely useful for catching visual problems before they reach production. A pull request may look completely fine during code review, but you can never know when the actual interface breaks at a particular viewport width. This has happened to me a lot. Just a few days ago, I shipped the near-final version of a project to one of my clients without noticing that, in the mobile version, a heading was overlapping one of the image assets. Preview deployments let people test the thing instead of trying to imagine it from a diff.

For a solo developer and freelancer like me, this saves a lot of time because, as you can see in the above screenshot, Vercel adds a toolbar to preview deployments where collaborators can leave comments directly on the page. This was especially useful during hackathons, when we were short on time. And our team always communicated in that way, and my teammates would drop in and leave comments like "the link to this button is redirecting to the pricing page instead of the features page" or "the color is way too contrasty." The small catch is that they need a Vercel account to comment, and external collaboration has some plan-specific limits, so it is not entirely frictionless, but still, it is much easier than sending Loom videos, annotated screenshots, or five messages explaining which button or font your client or peers want. And they have an optional third-party integration as well that can convert a preview comment into a GitHub issue. This makes conversations with my clients and non-technical collaborators much easier!

The Next.js experience is the other reason I keep using it. Vercel develops the framework, so features such as Incremental Static Regeneration, Server Actions, React Server Components, route handlers, and streaming work with very little platform-specific configuration, and I don't have to spend an afternoon figuring out how a new Next.js feature maps onto the hosting environment. Vercel covers that part for me by default.

Now, to be fair, other platforms have improved a lot, and Netlify currently supports the major Next.js features through its OpenNext adapter, including Server Components, Server Actions, streaming, ISR, and Partial Prerendering. Cloudflare can also run Next.js using its own OpenNext-based adapter. So the difference is no longer that Next.js features simply do not work elsewhere, because that would be an outdated argument. The difference is that Vercel remains the first-party deployment target, and that means there is one less compatibility layer to worry about. And this removes a pain point for me, especially when I am using a newer framework feature. And that's the edge I'm actually talking about. For a normal static React or Vite application, this advantage matters much less, but for a serious Next.js project, it becomes my go-to option.

And then there's the DX at the dashboard level. These are minute things, but together, they make a big difference for me. For example, the environment variables are scoped per environment (local, preview, and production; all of them are isolated). Rolling back to any previous deployment takes two clicks. And the deployment logs actually tell you what failed, not just that it did, and because of that, they become much easier to fix if you are taking the “pasting it into Claude Code” route.

What are the alternatives to Vercel?

Well, when we are talking about the alternatives, Cloudflare Pages is the one that comes the closest. And we know how much tech Twitter is divided on this one, and how frequently we see their representatives fight each other on open threads regarding this (I enjoy watching those heated arguments, lol). And yeah, Cloudflare is genuinely fast, and their edge network spans 300+ locations, and for static content, the performance gap over Vercel is actually quite measurable. And what I appreciate most is that the pricing is much more predictable; because, first of all, there are no egress fees, and they also provide unlimited bandwidth on the free tier. And as a bonus, I have also seen them helping start-ups from time to time as well, which is a great initiative, in my opinion.

I respect all of this, but the problem is that Cloudflare's Workers environment runs on V8 isolates, which is different from a standard Node.js runtime. And this is where I face the most problems. For purely static sites or projects that have lightweight edge functions, it's totally fine, but sometimes, with specific packages that exclusively require a Node.js runtime, you start to face error messages. And although nodejs_compat mode now supports a substantial portion of the Node API, the compatibility is still not perfect.

There is also a trade-off in how the two platforms approach infrastructure. If you want databases, KV stores, or smart routing in your project, you must understand Cloudflare's broader ecosystem, like D1, KV, and routing rules, which is great when you want that level of control. But Vercel abstracts all of that by default. It is basically a trade-off of infrastructure control for speed, and I prefer Vercel's simpler deployment workflow in this regard.

Netlify was my original platform before I switched. I have nothing against it, honestly. It is very similar to Vercel in a lot of ways. But Vercel's integration with Next.js, which I just discussed in detail in the previous section, makes Netlify feel like it's one step behind. Features like Server Actions and React Server Components work natively on Vercel, while on Netlify, they have to go through adapters that often lag behind new framework releases, which is a big compromise. And another thing: Netlify's core CDN infrastructure also has fewer edge locations than Vercel's 100+ node network, and that's visible in the global TTFB numbers as well. I'd still use Netlify for a simple static site with a form or two because their built-in form handling is actually clever. But for a Next.js project, Vercel is my primary choice.

Now, for Railway, it's a bit different, and I use it when I need a persistent backend, like maybe a WebSocket server, a background job, or something that can't be serverless. In Scholarian, I have a long-running task where the background worker has to produce a long report using Gemini, and that process generally takes three to four minutes, so I switched the backend of my app to Railway. For Vercel, that's where it genuinely breaks down. If you need a long-running process, you're either doing something hacky with edge functions or you're reaching for a different platform. And there are a couple of good options besides Railway, and for that, Encore would be my personal recommendation.

Where Vercel actually falls short

The pricing model! And that's the part I like the least. The free Hobby plan is capped, so it cannot generate an on-demand surprise bill, but if a hobby project exceeds its allowances, it may be paused or restricted instead. That's why I keep an eye out for my portfolio site, because that's the one that gets the most traffic. The bigger billing concern begins as soon as you switch to the Pro plan, where usage beyond the included credit can be charged across multiple resources. Being mindful enough is particularly important here, because I have seen a lot of posts on Reddit and X where developers have complained about the same issue.

Vercel Pro currently has a 20 USD monthly platform fee, which includes one deploying seat and 20 USD of usage credit. And for additional developer seats that can deploy or configure the projects, they will cost you another 20 USD per month, but the read-only viewer seats are free. And that combination can become difficult to predict when a project grows.

Vercel provides spending alerts and lets paid teams configure actions such as pausing projects after reaching a limit. Hence, it's better to enable those controls instead of assuming that traffic will always stay predictable. Sudden bot traffic, a poorly optimized function, image transformations, or a sudden spike in legitimate users can all consume usage faster than expected. So, it's always better to keep those factors in mind so that you don't get overcharged accidentally.

The other limitation is compute. Vercel Functions can handle APIs, server-rendered routes, streaming, and other request-driven tasks, and the current function limits are far more generous. But if your application requires a continuously running background process or custom Docker containers, Vercel isn't the right fit. There are platforms like Render or Northflank that are built for that kind of workload. Vercel is a frontend cloud, so the moment you need full-stack infrastructure, you're pairing Vercel with something else anyway. Hence, the title of my blog says why I prefer it for frontend projects, and not full-stack projects!

And then there is also vendor lock-in, although I do not think it is as simple as people make it sound. And it's not limited to Vercel either; almost every service provider has its own kind of vendor lock-in. A static React or Vite project is easy to move, but a Next.js application that depends heavily on Vercel’s caching behavior, image optimization, routing, integrations, and deployment settings will take more effort to migrate. The more platform-specific behavior you adopt, the less portable your application becomes, and that's true for Vercel, Cloudflare, AWS, and almost every other cloud platform. I have not experienced the issue myself, but I have seen people complaining about it, so I included it in the blog.

Is the Vercel free tier actually good enough?

For most side projects, yes! And their Hobby plan is free for personal use and is pretty generous. It comes with unlimited projects, automatic HTTPS, custom domains, preview deployments, and 100 GB of bandwidth per month, and that's mostly enough for personal use. And I never felt the need to purchase their paid Pro plans.

But the moment you add a team or need more bandwidth or function execution, you have to go to the Pro plan that starts at $20/month for each member.

What is the verdict?

Vercel is still my default for frontend deployment and a part of my development cycle. The preview URL workflow alone has saved me more debugging cycles than I can count. I've tried the alternatives in actual projects, and none of them gave me back the time I was spending on deployment issues.

That said, if you're cost-conscious and don't mind the learning curve, then Cloudflare is still a great choice. And if you need a backend, pick Railway and point your Vercel frontend at it. And if you've moved away from Vercel for something specific, or if you have a setup that works better for you, I'd genuinely love to hear about it in the comments!

And if you want to see the kinds of projects I've actually shipped on Vercel, check them out at my site. Also, you can find me on X or GitHub if you want to talk or connect.

Commerce And Secrets Without An IAP Tax

Shai Almog — Mon, 13 Jul 2026 15:39:12 +0000

Commerce is the easiest feature in this release to misunderstand, so the first sentence has to be blunt:

What is Codename One? Codename One is an open-source framework for building native iOS, Android, desktop, and web apps from a single Java or Kotlin codebase. Learn more at codenameone.com.

Commerce does not replace IAP and never will.

Purchases still go through Apple, Google, or the payment processor you chose. Codename One does not process the payment, does not touch the money, and does not take a percentage. PR #5300 adds infrastructure around the annoying backend work that comes after a purchase: validation, entitlement checks, subscription lifecycle, webhooks, and reporting.

That backend work is real. Anyone who has shipped subscriptions knows the trap. Buying a SKU is not the same as knowing whether the user has the right to a feature right now. Renewals, grace periods, refunds, billing retry, product changes, trials, family sharing and store server notifications all show up later. The device has one view. The store has another. Your backend usually needs a third.

Commerce is the optional service that turns that mess into an entitlement.

Entitlements Instead Of SKU Branches

Your app should not need to know every SKU that grants pro. It should ask for pro.

CommerceManager cm = CommerceManager.getInstance();
cm.setAppUserId(accountId);

if (cm.isEntitled("pro")) {
    unlockProFeatures();
}

Purchases are still delegated to the existing Purchase API:

cm.subscribe("pro_monthly");
// or
cm.purchase("remove_ads");

After a purchase, or when the app starts, refresh off the EDT:

new Thread(() -> {
    CommerceManager cm = CommerceManager.getInstance();
    cm.refresh();

    CN.callSerially(() -> {
        if (cm.isEntitled("pro")) {
            unlockProFeatures();
        }
    });
}).start();

refresh() validates the current receipts with the cloud when the build has a build_key and commerce is enabled. In a local build or simulator, it safely falls back to the normal Purchase path.

What Happens When Quota Runs Out

This is the real question that matters most. If Commerce is tiered, what happens when a developer exceeds quota?

Validation degrades. Purchases do not stop.

CommerceManager.isDegraded() tells you the cloud did not return a server-validated answer. In that state, entitlement checks fall back to the platform's own receipt signal, treating the entitlement id as a subscription SKU when no cached cloud answer exists. That is less rich than server-side validation, but it is the right failure mode. A paying user should not be locked out because your account hit a validated-volume cap.

cm.refresh();
if (cm.isDegraded()) {
    Log.p("Commerce validation degraded; using store-direct fallback");
}

Commerce is tiered because it is a backend service that can be abused: receipt validation, store API calls, lifecycle processing, webhook delivery and revenue analytics cost real infrastructure. The degradation rule is what keeps that business reality from becoming user pain.

What Commerce Adds

The service can:

Validate receipts against Apple and Google.
Normalize subscription state across stores.
Track entitlements by your app user id.
Forward lifecycle webhooks to your backend with HMAC signatures.
Present revenue metrics such as MRR, ARR, ARPU, churn, trial conversion, cohort retention and realized LTV.

The app-facing API remains small because the complicated part lives server-side:

CommerceManager cm = CommerceManager.getInstance();
cm.setAppUserId(myAccountId);
cm.refresh();
boolean active = cm.isEntitled("remove_ads");

That split explains how Commerce complements IAP instead of replacing it. Purchase starts the transaction. Commerce answers the longer-term entitlement question.

Secrets

The same PR adds com.codename1.security.Secrets, which solves a different but related problem: API keys do not belong in source code or in the app binary.

// Run off the EDT; the first call may hit the network.
String mapsKey = Secrets.get("googlemaps.key");

The value is fetched from the Codename One Cloud vault over TLS and cached in SecureStorage. refresh(name) forces a fresh fetch after you rotate the value server-side, and clear(name) drops the cached copy.

String key = Secrets.refresh("googlemaps.key");
Secrets.clear("googlemaps.key");

Only app-readable secrets are served to the device. Server-only credentials, such as App Store Connect keys or Google Play service account JSON used for commerce validation, stay in the vault and are never reachable from client code.

That rule is non-negotiable: do not check API keys into source, do not paste them into snippets, and do not embed server credentials in the binary. If the app can read a secret, a determined attacker can eventually extract it. Secrets reduces exposure and makes rotation easier; it does not turn a client app into a secure server.

The Boundary

Commerce and Secrets are both cloud features, but they sit on different sides of the volume line. Secrets usage stays low enough to enable it for everyone. Commerce has tiers because validation and analytics can create real backend load.

The important boundary is not tiering. The boundary is lock-in. You can still use the raw Purchase API. You can still build your own receipt backend. You can still ship an app that sells subscriptions without giving Codename One a revenue share.

Commerce is there to remove backend pain, not to insert a toll booth.

Skip LinkedIn/Indeed: most companies' job boards have a public JSON API

Noble Ronin — Mon, 13 Jul 2026 15:33:36 +0000

If you've ever tried to pull job listings by scraping LinkedIn or Indeed, you know the pain: anti-bot systems, CAPTCHAs, rotating proxies, and scripts that silently break every few weeks.

Here's the thing — you usually don't need any of that.

Companies don't post jobs on LinkedIn first. They post them in their ATS (Applicant Tracking System) — Greenhouse, Lever, Ashby, Workday, etc. — and most ATS platforms expose the company's board as a public JSON endpoint. No key, no login, no browser. It's the company's own source of truth, so it's cleaner and fresher than any aggregator.

The endpoints

A few that work with a plain GET ({company} = the company's slug):

Greenhouse — https://boards-api.greenhouse.io/v1/boards/{company}/jobs?content=true
Lever — https://api.lever.co/v0/postings/{company}?mode=json
Recruitee — https://{company}.recruitee.com/api/offers/
Breezy HR — https://{company}.breezy.hr/json

SmartRecruiters, Ashby, BambooHR and Personio have their own equivalents. Workday is the one annoying exception — it's a POST and needs the full board URL (tenant + datacenter + site), so you can't guess it from a bare company name.

Example: pulling Stripe's open roles (Python)

Stripe uses Greenhouse:

import requests

company = "stripe"
url = f"https://boards-api.greenhouse.io/v1/boards/{company}/jobs?content=true"
jobs = requests.get(url).json()["jobs"]

for j in jobs[:5]:
    print(j["title"], "—", j["location"]["name"])

That's it. No Selenium, no proxy, no CAPTCHA solver. Runs in ~200ms and won't break next Tuesday because Cloudflare changed something.

Auto-detecting the ATS

If you don't know which ATS a company uses, just try them in order and take the first one that returns jobs. A bare 404 means "not this ATS, try the next." Greenhouse → Lever → Ashby → SmartRecruiters → Recruitee → Breezy covers a huge chunk of tech companies.

Gotchas

Rate limits are lenient but real — be polite, set a User-Agent.
Descriptions: Greenhouse/Lever include full HTML descriptions in the list; Breezy's list endpoint doesn't (you'd fetch each posting for that).
Workday: POST-only, needs the full board URL — worth special-casing.

If you don't want to build/maintain 9 of these

I got tired of keeping a fetcher per ATS in sync, so I bundled 9 of them (Greenhouse, Lever, Ashby, SmartRecruiters, Workday, BambooHR, Personio, Recruitee, Breezy) into one thing that auto-detects the ATS from a bare company name or board URL and returns normalized jobs: https://apify.com/ponderable_hydrometer/multi-ats-jobs

But honestly, the endpoints above are the real value — build your own if you'd rather.

Which ATS should I add next? Considering Workable, Teamtailor and JazzHR.

The Solana Program Security Checklist I Wish I'd Had on Day One

Lymah — Mon, 13 Jul 2026 15:32:41 +0000

I spent the last two weeks thinking like an attacker.

I wrote tests whose only job was to make my own programs fail. I ran a fuzzer across thousands of generated inputs looking for the lamport value nobody would choose by hand. And I rebuilt the missing owner check that was at the center of the $326M Wormhole exploit, in a throwaway program, in a test, so I could watch it work and then watch the one-line fix stop it cold.

This checklist is what I would hand to past me on day one of that work.
Run it top to bottom before any Anchor program goes to mainnet.

Who this is for

You are writing Solana programs in Anchor. You understand accounts, PDAs, and CPIs. You have read the Anchor docs. What you do not yet have is a systematic way to check that you have not missed the failure modes that are specific to Solana's runtime, an account model where any account can be passed into any instruction, arithmetic that wraps silently in release builds without protection, and cross-program calls that trust whatever program ID you hand them.

This checklist is that systematic check. It is not a substitute for a professional audit on high-value programs. It is the thing you run before you even consider requesting one.

The Wormhole anchor

Before the list, the story that explains why account validation sits at the top.

In February 2022, an attacker drained $326M from the Wormhole bridge. The root cause was a single deprecated function, load_instruction_at
— that read a sysvar account's contents without first checking that the account was actually the real instructions sysvar. The attacker passed in a forged account they controlled. The program read it, trusted it, and authorized a mint it should have refused.

The fix was a single word: switch to load_instruction_at_checked, which verifies the account's address before reading it.

Every item in this checklist traces back to that same principle:
never read an account's contents until you have confirmed its
identity. The items below are just that principle applied to every surface where you might forget it.

Sources: Ackee Blockchain Wormhole breakdown,
Halborn analysis

1. Account Validation

These are the checks Anchor helps most with, and the ones where
reaching past Anchor's types creates the most risk.

[ ] Every deserialized account has its owner verified. Use Account<'info, T> instead of UncheckedAccount<'info> or raw AccountInfo. Account<T> verifies the account is owned by your program and carries the right 8-byte discriminator before deserializing. A raw AccountInfo does neither.
[ ] No UncheckedAccount without a /// CHECK: comment that explains why skipping validation is safe. Anchor forces you to write this comment, treat every occurrence as a flag for manual review. If you cannot write a convincing sentence, switch to a typed account.
[ ] Account types are distinguished by their 8-byte discriminator. Anchor stamps every account with a discriminator derived from the type name. Account<'info, Vault> rejects a Config account passed in its place. Raw deserialization has no such guard.
[ ] PDA addresses are re-derived and compared, not trusted from the caller. Use seeds and bump constraints. An attacker can create a vault-shaped account at an arbitrary address; the seeds constraint proves the address is the canonical one.
[ ] The stored bump is used, not re-derived. Compute the bump once at initialization, store it on the account, and reuse it with bump = state.bump. Re-deriving adds compute and is unnecessary.
[ ] remaining_accounts are validated before use. Anchor does not automatically check accounts passed through remaining_accounts. If you use them, verify the owner discriminator and signer status manually.

What Anchor does automatically: owner check, discriminator check, signer flag, reinitialization guard (with init). What it does not: business logic, arithmetic, CPI target identity, or anything involving remaining_accounts.

2. Authority and Signer Checks

[ ] Every privileged instruction confirms the expected signer. Signer<'info> verifies the account signed the transaction.has_one = authority verifies the stored key matches. You need both: has_one without Signer lets anyone who knows the authority pubkey (which is public) call the instruction without their consent.
[ ] No instruction trusts a pubkey without also checking its
signer flag. Knowing a public key is not the same as being able
to sign for it.
[ ] Admin or upgrade authority accounts are explicitly constrained. Use #[account(address = EXPECTED_PUBKEY)] for hardcoded admins, not a manual pubkey comparison buried in handler logic.
[ ] has_one relationships are complete. If vault.authoritymust equal authority.key(), the has_one = authority constraint says so declaratively and fails before your handler runs. A manualrequire_keys_eq! in the handler is a second line of defense, not the first.

3. Arithmetic Safety

I fuzzed a deposit function with a property test that ran hundreds of generated u64 pairs. The property: a deposit either grows the balance or returns None honestly. With raw +, the property fails on overflow inputs, the balance wraps to a tiny number, and the test catches it. With checked_add, every overflow returns None and the test passes.

[ ] Every balance or supply change uses checked_add,
checked_sub, checked_mul, or checked_div. Never raw +, -, * on untrusted values. Solana's runtime sets overflow-checks = true for release builds, which turns arithmetic overflow into a panic rather than a silent wrap — but checked_* lets you return a named error instead of a panic, which is cleaner for users and easier to test.
[ ] Overflow and underflow are handled explicitly, not suppressed. .ok_or(VaultError::InsufficientFunds)? is correct..unwrap_or(u64::MAX) is not.
[ ] No silent cast that could truncate. A u64 → u32 cast
silently drops the upper bits. Use u64::try_from(value)? and
handle the error.
[ ] Division by zero is guarded. If a denominator can be
user-supplied, check it before dividing.

4. CPI Safety

[ ] Every CPI verifies the target program ID is the expected one. Do not accept the program ID from the caller without checking it. Use Program<'info, Token> or Interface<'info, TokenInterface> rather than passing a raw AccountInfo for the program.
[ ] Accounts are reloaded after a CPI if their data is read again. A CPI can modify account state. Anchor does not automatically refresh your local view. Reload the account before reading fields that a CPI may have changed.
[ ] PDA signer seeds are correct and complete. When a PDA signs a CPI with .with_signer(signer_seeds), the seeds must include every component you used at initialization, including the bump byte. A mismatch causes a silent authorization failure.
[ ] CPIs from a PDA do not propagate the wrong authority. The PDA signs on its own terms. If your CPI passes additional signers, confirm each one is intentional.

5. Account Lifecycle

[ ] Closed accounts cannot be revived within the same transaction. Closing an account in instruction N and reopening it in instruction N+1 of the same transaction can reuse the zeroed data. Use Anchor's close = destination constraint, which zeroes the data, transfers lamports, and marks the account in a way that prevents reuse within the transaction.
[ ] No instruction allows reinitializing an initialized account. Use init (not init_if_needed) when you mean "create exactly once." init_if_needed silently does nothing if the account already exists, which can mask a caller reusing an account they do not own. If you must use init_if_needed, add an explicit check that the stored authority matches the current signer before trusting the existing data.
[ ] Rent-exempt deposits are accounted for. Accounts must maintain a minimum lamport balance. If your program moves lamports, confirm the source account remains rent-exempt after the transfer.

6. Pre-Deploy Hygiene

[ ] anchor keys sync has been run and the declared ID matches the keypair. A program deployed with a mismatched ID will fail every transaction.
[ ] Dependencies are current and free of known advisories. Run cargo audit before deploying. A single vulnerable dependency can compromise an otherwise correct program.
[ ] Adversarial tests pass, not just the happy path. If your test suite only verifies that valid inputs succeed, it proves nothing about what invalid inputs do. You need at least one test per security-critical constraint that proves the constraint actually fires when violated.
[ ] Property tests cover arithmetic functions. If you have a function that modifies a balance, a property test with a fuzzer (proptest, Trident) will find inputs your examples missed. A hand-picked example list cannot cover all of u64.
[ ] The program has been reviewed by someone who did not write it. Familiarity blindness is real. A reviewer who reads the code cold will ask questions the author stopped asking weeks ago.

Where Anchor helps and where it does not

Anchor's typed accounts automatically handle:

Program ownership verification (Account<'info, T>)
Discriminator check (rejects the wrong account type)
Signer flag verification (Signer<'info>)
Reinitialization guard (init constraint)
PDA address verification (seeds + bump)

Anchor cannot help with:

Your business logic (who is allowed to call what, under what conditions)
Arithmetic correctness (checked vs unchecked operations)
CPI target identity (you must verify the program ID yourself)
remaining_accounts (no automatic validation)
Anything you expressed as an UncheckedAccount

The checklist exists because the second list is where every real
exploit lives.

How to use this checklist

Print it or keep it open in a browser tab. Before any mainnet deploy, go through it top to bottom. For each item, answer yes or no against the actual code, not the code you remember writing. The items are written to be verifiable line by line.

This is a living document. If you find a gap, open an issue or leave a comment. A security checklist that never gets updated is just technical debt with a nice format.

Resources

Built from bugs I reproduced myself during Arc 12 of
*#100DaysOfSolana*. If something is wrong, tell me in the comments.

Building an Agentic FinOps Platform — Development Environment Setup, Google Antigravity, MCPs and Skills, and ADK Bootstrapping with Agents CLI

Darren "Dazbo" Lester — Mon, 13 Jul 2026 15:31:20 +0000

TL;DR — This article is going to be jam-packed with useful information, tips, tricks and hacks for setting up an agentic development in the Google ecosystem.

This one isn’t really about the FinOps!

Welcome to Part 2

Welcome back, friends!

In the first part, I described the purpose of the FinSavant FinOps solution, the motivation for creating it, its overall architecture and tech stack, and how it works.

In this part, we’ll use FinSavant as a case study in how to set up a development environment for the purposes of building such an ADK-based agentic solution. Even if you’re not particularly interested in FinSavant itself, I hope you’ll find a bunch of useful information and tips here that will help you build your own agentic solutions more effectively and quickly.

We’ll cover:

Using Antigravity IDE
Overall project workspace structure
Setting up agent skills for your coding agent
My project’s GEMINI.md (or if you prefer, AGENTS.md)
My documentation approach
Setting up MCP servers for your coding agent, such as BigQuery MCP
Scaffolding the initial ADK agent using Google Agents CLI and its supporting skill
Getting started with a Makefile

Sound good? Let’s get cracking!

Series Orientation

Let’s see where we are in this series.

Goals, Architecture, and Tech Stack: Capabilities, project goals, target architecture, technology stack, and design decisions.
Development Environment Setup, Google Antigravity, MCPs and Skills, and ADK Bootstrapping with Agents CLI 📍 You are here.
Building the ADK Agent and API
Designing and Building the UI with Google Stitch and A2UI
Deployment with Gemini Enterprise Agent Platform, Agent Runtime, Cloud Run and IAP
Automating Deployment with CI/CD and Terraform
Agent Observability, Evaluation, and Tuning with Gemini Enterprise Agent Platform

Getting Started with Antigravity IDE

These days, my favourite coding environment for any significant project is Antigravity IDE. This is Google’s agent-first integrated development environment. You get a look-and-feel that’s familiar to VS Code users, but powered with autonomous, context-aware agents that can plan, execute, verify, and work in parallel.

You can get it here.

By the way, Antigravity IDE is just one member of the Antigravity (aka Agy) suite.

I’ve covered these before, but here’s a quick reminder of the four Agy solutions in the suite:

Antigravity 2.0, which is now the dedicated agent-first “builder” environment on your desktop. Notably, it doesn’t itself include an IDE. Instead, we now interact only with the agent manager. This surface aims to usher in the era of “idea to product” using agents, without concerning ourselves over the code. Many builders who don’t come from a coding background will love this.
Antigravity IDE, which gives us the more familiar VS Code-esque coding environment, supported by the Antigravity agent harness. Here we can do agent-assisted development, and we always see the code. Coders will feel at home here.
Antigravity SDK, which gives you the harness and tools that power Antigravity, but exposed as a Python Agent SDK. By importing from google.antigravity we can programmatically leverage Antigravity’s capabilities.
Antigravity CLI, which is the next evolution of the extremely awesome Gemini CLI. It’s still a terminal-first environment for interacting with Gemini models. But the new Antigravity CLI is built in Go, and you can tell; it feels much faster than Gemini CLI, both during startup and in general use. It leverages the same agent “harness” as Antigravity 2.0 and the IDE, and this allows for common settings and configuration across the Antigravity suite.

Project Structure

Here’s the rough outline of the project structure we’ll be creating. We won’t be building all of this structure here; nor does this represent the final state of the project. But it gives you an idea of where we’re heading. (I’ll explain the * in a minute!)

  smart-gcp-finops/  
  ├── agent/                # ADK agent package  
  │   ├── finops_agent/     # Root agent  
  │   ├── .env              # Agent specific environment vars  
  │   ├── Dockerfile        # For deploying agent to Agent Runtime  
  │   └── pyproject.toml    # Agent runtime dependencies  
* ├── bff/                # Backend-for-Frontend (API)  
* ├── deployment/         # Infrastructure & CI/CD (Terraform IaC)  
* │   ├── terraform/      # Centralised IaC for Prod & Staging  
  │   └── README.md         # Deployment documentation  
* ├── docs/               # Project documentation  
* │   ├── images/         # Diagrams and architectural visual assets  
  │   ├── DESIGN.md         # Visual identity, components, and UI design  
  │   ├── architecture-and-walkthrough.md # Solution blueprints, ADRs, and component data flows  
  │   └── testing.md        # Testing strategy and verification instructions  
* ├── frontend/           # React UI frontend  
* ├── notebooks/          # Jupyter notebooks for prototyping and evaluation  
* ├── scripts/            # Environment setup and other utility scripts  
  │   └── setup-env.sh      # Configure local environment including Google auth / ADC  
* ├── tests/              # Unit and integration test suites  
* │   ├── eval/           # Agent evaluation  
* │   ├── unit/           # Unit tests  
* │   └── integration/    # Integration tests  
* ├── .agents/            # Workspace customizations root  
  │   └── mcp_config.json   # E.g. MCP servers  
* ├── .github/            # GitHub Actions workflows and CI/CD  
* ├── .env                # Root environment vars (dev setup, unified container, GitHub, etc)  
  ├── .envrc                # Automatically launch when entering this directory  
* ├── .gitignore          # Exclude from git  
* ├── Makefile            # Centralised developer convenience commands  
* ├── GEMINI.md           # Development agent context & guidelines  
* ├── LICENSE             # Standard open-source license file  
* ├── pyproject.toml      # Root project configuration / dependencies  
* ├── README.md           # Developer documentation homepage  
  └── TODO.md               # TODO list

If you wanted to build such a structure from scratch, here’s a cool thing to try…

Create your new project folder, e.g. my-cool-project
Open that folder in Antigravity IDE.
Supply this prompt to the Agy Agent:

/grill-me Using this folder tree as a template, 
create the required folder structure in this workspace for my new Python 
project. Only create folders and files that are marked as '*'. 
For required files, provide initial starter-for-10 content. 
<< paste the tree structure here >>

Why /grill-me? This is a built-in Agy command that causes the agent to ask questions to remove ambiguity. If you were to give the agent a slightly vague prompt without this prefix, then the agent might make some guesses about what you want. But with /grill-me, the agent will still make educated guesses, but it will also ask you questions to clarify your intent.

The prompt above is a good example of where this is useful. You’ll notice that my project tree has a LICENSE.md file, which is a standard component to include in open-source projects. But my prompt doesn't specify which license to use. So when you use /grill-me, the agent will offer sensible license choices based on your project and context, and ask you to confirm.

This video demonstrates Agy scaffolding the entire project from scratch, in response to the prompt above:

Give it a go!

Skills for Your Coding Agent

I like to describe skills as units of knowledge that agents load on-demand, when they need to do a particular task. I’ve previously written articles on the subject of my favourite skills, where to find them, and how to install them. I recommend you check out this one. You might want to go ahead and install all of my favourites!

But for now, let’s add a few skills that will definitely be useful for our current project. I recommend installing them globally, so they’ll be available to all of your development projects.

npx skills add https://github.com/vercel-labs/skills -y -g --skill find-skills  
npx skills add https://github.com/derailed-dash/dazbo-agent-skills -y -g  
npx skills add https://github.com/google/skills -y -g  
npx skills add https://github.com/google-gemini/gemini-skills/ -y -g  
npx skills add https://github.com/shubhamsaboo/awesome-llm-apps/awesome-agent-skills -y -g --skill technical-writer

We’re also going to install the Google Agents CLI and its associated skills, but we’ll get to that later.

`GEMINI.md` - Context for Your Coding Agent

The GEMINI.md file (or AGENTS.md if you prefer) is how you define your project's rules and context. It's where you tell the Agy Agent:

About your project’s goals
Rules and guidelines you want it to follow
References you want it to read

When we create GEMINI.md in the root of a project then the file is scoped only to that project. (This project-specific context gets appended to any global GEMINI.md you have defined.) When you launch any Antigravity tool from this workspace - such as Agy 2.0, Agy IDE, or Agy CLI - the Agent will automatically read this context.

Let me show you what my GEMINI.md looked like, when starting out with FinSavant:

# FinSavant - the Agentic FinOps Solution  

## Project Goals  

To create an agentic FinOps solution for GCP that:  
- Uses ADK for agent orchestration.  
- Is able to examine billing and cost data in BigQuery, based on billing   
  exports.  
- Is able to understand Google Cloud infrastructure and services across   
  multiple Google projects associated with a billing account.  
- Considers projects associated with a particular Google Cloud organisation,    
  associated with a billing account.  
- Leverages Google Developer Knowledge API MCP for grounding:   
  Google APIs, Google Cloud infrastructure, Google Cloud best practices.  
- Is able to detect cost anomalies and inefficiencies, and trends.  
- Is able to understand all deployed infra and services, and historical   
  configuration changes, leveraging Google Cloud Asset Inventory  
- Is able to invoke Google Cloud Assist for immediate logs investigation,   
  RCA and recommendations.  
- Is able to combine all of the above to provide actionable insights and   
  recommendations to users.  
- Provides a UI for users, which includes:  
  - Dashboard of cost trends, billing data and anomalies  
  - Cost forecasting  
  - Cost analysis  
  - Anomaly detection  
  - Recommendations  
  - Cost optimisation suggestions  
  - A natural language chat interface  
- The UI should be based on React. Use skills you have available to leverage   
  React best practices.  
- Leverage Google Stitch to design the UI, and use the Stitch MCP server to   
  pull in the design, in order to convert to React.  
- The UI is connected to the agent via FastAPI.  
- The UI and API will be hosted in a single Cloud Run service. The service   
  will be secured using IAP, using direct Cloud Run integration - no   
  Load Balancer.  
- The Agent will be deployed to Agent Runtime in Gemini Enterprise Agent   
  Platform.  

## Tool Use: Skills, Gemini Enterprise Agent Platform, Agent Runtime and ADK  

Be sure to use all **agents** skills, **Gemini Enterprise Agent Platform**   
skills, and **ADK** skills you have available for developing ADK agents and   
best practices, and use **adk-docs-mcp** for latest ADK documentation.   

You will have additional skills available to you, but always check if the   
following can help with a particular task.  

### ADK & agents-cli Lifecycle Skills  

- `google-agents-cli-workflow`: Entrypoint for building ADK agents (scaffold,   
build, evaluate, deploy, publish, observe).  
[skipping for brevity]  

### Gemini Enterprise Agent Platform APIs  
- `gemini-api`: Gemini Enterprise Agent Platform, Google Cloud, and   
Agent Platform enterprise usage with the Google Gen AI SDK.  
[skipping for brevity]  

### Agent Platform Engine & Model Management  
- `agent-platform-deploy`: Deploying models and tuned weights to Agent   
  Platform endpoints.  
[skipping for brevity]  

## Key Internal Documentation  

- README.md - Project README; the developer's front door  
- TODO.md - High level plan for the project  
- architecture-and-walkthrough.md - The main architecture, including design   
  decisions  
- DESIGN.md - Where we will capture the UI design  
- testing.md - Where we will document test strategy, summary of tests,   
  testing instructions, any manual testing processes  
- docs/blog.md - A blog post document we will build along the way  
- /deployment/README.md - Deployment and CI/CD documentation  

## Essential Reading  

You should read and leverage these resources for guidance and best practices,   
in addition to the skills and MCP servers you have available for knowledge.  

| Resource | Description and Relevance |  
| -------- | ------------------------- |  
| https://docs.cloud.google.com/bigquery/docs/use-bigquery-mcp?utm_campaign=DEVECO_GDEMembers&utm_source=deveco | Use the BigQuery MCP server |   
| https://adk.dev/integrations/bigquery/?utm_campaign=DEVECO_GDEMembers&utm_source=deveco | BigQuery tool for ADK |  
| https://docs.cloud.google.com/gemini-enterprise-agent-platform?utm_campaign=DEVECO_GDEMembers&utm_source=deveco | Gemini Enterprise Agent Platform Overview |  
| https://adk.dev/deploy/agent-runtime?utm_campaign=DEVECO_GDEMembers&utm_source=deveco | ADK with Agent Runtime |  
[skipping for brevity]  

## Other Notes  

- "Vertex AI" no longer exists as a product; the replacement is Gemini   
  Enterprise Agent Platform.  
- "Vertex AI Agent Engine" is no more; the replacement is "Agent Runtime",   
  which is a part of the Gemini Enterprise Agent Platform.  
- But APIs and Google internal resource names may still refer to legacy names,   
  e.g. `reasoningEngine` rather than Agent Runtime. Always use the new names   
  when creating documentation, but be mindful that we may need to use old   
  names in API calls and certain resource definitions.  

## Blog  

I want to build a multi-part blog series, which I'll post on Medium and Dev.to.  

### Documenting As We Go  

As we go, document steps taken, experience and findings in docs/blog.md.   
Later, I will build a Medium blog from this content. During this "as we go"   
phase, the blog.md does not need to be a collection of notes, code snippets, and observations. It should:  

- Include all the key steps we did, in the order we did them.  
[skipping for brevity]

If you’re following along and you’ve just created your context file, give Agy a restart now, so it picks this up.

Documentation Approach

I’m a big fan of having a consistent set of high-quality, continuously maintained documentation. I even have my own agent skill — maintaining-core-documentation - to automate much of this for me. Check out my previous blog on this subject: Documentation as Context: A Skill to Automate Your Blueprints for the Agentic Era.

If you previously ran the npx skills add https://github.com/derailed-dash/dazbo-agent-skills -y -g command from above, then you already have this skill installed.

With this in place, you could issue this prompt to bootstrap a set of documentation for a brand-new project:

Use maintaining-core-documentation to bootstrap my project documentation.

Check out this video to see the skill doing its magic!

As you evolve your project, this skill will automatically maintain your documentation.

MCP Servers for Your Coding Agent

I’ve previously written about some of my favourite MCP servers. There are only a couple that we’ll need for this project:

Note that we won’t be using either of these in the FinSavant agent itself. These are purely to help us during development.

Let’s try out the BigQuery MCP server first. In your workspace’s .agents/mcp_config.json file, we configure the Remote BigQuery MCP server like this:

{  
  "mcpServers": {  
    "bigquery-mcp-server": {  
      "serverUrl": "https://bigquery.googleapis.com/mcp",  
      "authProviderType": "google_credentials",  
      "oauth": {  
        "scopes": [  
          "https://www.googleapis.com/auth/bigquery"  
        ]  
      },  
      "headers": {  
        "x-goog-user-project": "your-gcp-billing-project"  
      }  
    }  
  }  
}

A few things to note about this:

Billing project: Replace your-gcp-billing-project with the Google project where your billing data export lives.

BigQuery API: Make sure the BigQuery API (bigquery.googleapis.com) is enabled on that project.
Developer Identity Permissions: Because the MCP server uses google_credentials to authenticate, your local developer account (active in gcloud auth) must be authorised on Google Cloud. You need the roles/bigquery.dataViewer and roles/bigquery.jobUser roles on the project hosting the billing dataset.
You also need the roles/mcp.toolUser role, in order to use this managed MCP server to query the BigQuery database.

And now, when you open the workspace in Antigravity IDE, it will load this configuration automatically. Your coding agent will be able to query schemas, inspect tables, and try out SQL queries in order to assist you when you actually create the FinSavant agent code.

Let’s test it!

First, I issue this prompt to the Agy agent:

What billing tables do I have? Explain their key functions.

You can see the agent immediately finds the MCP server and asks for permission to invoke its tools. After I grant permission, I get this response:

Nice! You can see how helpful this is going to be.

Scaffolding Your ADK Agent

The easiest way to scaffold a new ADK agent is to make use of Google Agents CLI. The Agents CLI is actually a bundle, containing:

The Agents CLI itself — commands for scaffolding, evaluating, deploying, and observing AI agents on Google Cloud. The GitHub repo describes the commands available:

An associated set of agent skills that turn your development agent into an expert in using Agents CLI.

You install the bundle using this one-time command:

uvx google-agents-cli setup

If you already have it installed, then you can upgrade like this:

uv tool upgrade google-agents-cli

(It’s worth doing this occasionally — this CLI is evolving quickly!)

With this installed, we could create our top level agent folder that contains a root agent called finops_agent by running this command:

agents-cli scaffold create agent \
  --agent adk \
  --prototype \
  --agent-directory finops_agent

You’ll end up with the following inside of your workspace folder:

agent/  
├── finops_agent/                 # Your agent code  
│   ├── __init__.py               # Registers the app (exports `app`)  
│   ├── agent.py                  # Agent definition — instructions, model, tools  
│   └── app_utils/                # Utilities (telemetry, converters)  
│       ├── __init__.py  
│       ├── telemetry.py          # OpenTelemetry setup for Cloud Trace  
│       ├── typing.py             # Request/response Pydantic models  
│       └── gcs.py                # GCS utility functions  
│  
├── tests/  
│   ├── eval/                     # Evaluation test cases  
│   │   ├── datasets/  
│   │   │   └── basic-dataset.json    # Default eval cases  
│   │   └── eval_config.yaml          # Evaluation metrics configuration  
│   ├── integration/  
│   │   └── test_agent.py         # Integration test (runs agent end-to-end)  
│   └── unit/  
│       └── test_dummy.py         # Placeholder for unit tests  
│  
├── .env                          # Environment variables (project ID, location)  
├── .env.example                  # Example environment variables  
├── .gitignore                    # Git ignore file  
├── pyproject.toml                # Project config and dependencies  
├── agents-cli-manifest.yaml      # Configuration for agents-cli  
├── Dockerfile                    # Dockerfile for the agent runtime  
└── GEMINI.md                     # Guidance file for coding agents

But since we now have the skills installed, there’s an easier way to accomplish this, that doesn’t require you to check the CLI documentation…

Please bootstrap a new ADK agent project. The agent top-level project should   
be named `agent`, and it should contain a root `agent-directory` called   
`finops_agent`, NOT the default of `app`. This means `pyproject.toml` and   
other config files will live under `agent/`, and all Python source files   
(like `agent.py` and `fast_api_app.py`) will live inside   
`agent/finops_agent/`.

Sure, this prompt is quite detailed, but I’m after a very specific folder structure.

Let’s see a live demo…

As you can see from the demo, we can now use agents-cli to check if our newly scaffolded agent is working.

For example, by issuing a single test prompt on the command line:

cd agent  
agents-cli run "Hello! Who are you?"

Or, we could run up the extremely powerful and useful ADK Web interface, using this handy shortcut:

# From the agent folder
agents-cli playground

Concluding thought about Agents-CLI: if you know your way around the CLI, you can use it directly. It'll be faster and use fewer tokens. But when you're doing lots of agent related activities like boostrapping, adding CI/CD, deploying and evaluating, you'll probably find that natural language conversations are going to save you a lot of time and pain.

Bonus #1: Getting Started with a Makefile

In a “monorepo” project setup like FinSavant, you quickly end up managing a lot of moving parts: building frontend assets, compiling Python environments, building and running multiple Docker images, executing test suites, and deploying resources to various target environments.

Rather than forcing yourself (or your team) to remember a massive list of commands and flags, wrapping them in a Makefile is a big win.

But what actually is a Makefile? At its core, it is a configuration file used by the classic make build automation tool. These days it has evolved into a lightweight, standardised task runner. It allows us to define short aliases (known as "targets") for complex shell commands, documenting project workflows in a single, standard file that is easy for both humans and agents to discover.

Earlier, during the demonstration of bootstrapping the project, the agent actually created an initial Makefile for us. If you followed along, you'll now have a Makefile that looks something like this:

.PHONY: install lint format lint-fix test  

install:  
    @command -v uv >/dev/null 2>&1 || { echo "uv is not installed. Installing uv..."; curl -LsSf https://astral.sh/uv/0.11.16/install.sh | sh; source $HOME/.local/bin/env; }  
    uv sync  

lint:  
    uvx codespell@latest -s  
    uvx ruff@latest check .  

lint-fix:  
    uvx codespell@latest -w  
    uvx ruff@latest check --fix .  

test:  
    uv run pytest tests/

Now you can run any of these make targets, like this:

make install

With this in place, we can build on it in future articles as we develop the FinSavant solution.

Bonus #2: My Setup-Env Script

These days, whenever I’m working on a project that makes use of Google services, I always create a helper setup-env script to configure my environment for me.

This script:

Loads environment variables: Automatically exports all key/value pairs from .env directly into the current shell session.
Handles Google Cloud authentication: If not skipped (via the --noauth flag), it runs gcloud auth login --update-adc to authenticate the user and configure Google Application Default Credentials (ADC).
Sets the active gcloud project: Configures gcloud defaults for the target project and billing quota project settings.
Extracts project metadata: Dynamically retrieves the Google Cloud Project Number and constructs helper variables (like the Cloud Build service account email) for deployment scripts.
Synchronises Python dependencies: Runs uv sync to ensure all standard, development, and notebook dependencies are installed in the local environment.
Activates the virtual environment: Activates the local Python virtual environment (.venv) so the user is immediately ready to run code.

You can find a copy of this scripts/setup-env.sh in my GitHub repository. Because it uses standard environment variables defined in your .env, you can use it in any of your Google projects!

You run it from the project root directory like this:

source scripts/setup-env.sh

Bonus #3: Automating Setup with `direnv` and `.envrc`

If you haven’t come across this before, I think you’re going to like it!

Manually sourcing the setup-env.sh script every time I open a terminal in the project directory is a bit of a chore. To automate this, we can use direnv — an extension for your shell that automatically runs custom scripts and loads / unloads environment variables depending on your current directory.

By placing a .envrc file at the root of the project, direnv automatically executes it whenever you cd into the directory.

Here is what our .envrc looks like:

if [ ! -d ".venv" ]; then  
  uv venv  
fi  

# Check if gcloud token is still valid to avoid re-authenticating  
if gcloud auth print-access-token --quiet > /dev/null 2>&1; then  
  echo "gcloud token is valid, skipping authentication."  
  source scripts/setup-env.sh --noauth  
else  
  echo "gcloud token is not valid, re-authenticating."  
  source scripts/setup-env.sh  
fi

This configuration does a few smart things:

Bootstraps the virtual environment: Automatically initialises a virtual environment using uv venv if it doesn't already exist.
Verifies active Google session: Runs gcloud auth print-access-token silently to check if our Google Cloud session is active.
Conditionally sources configuration: If the Google Cloud session is still valid, it sources the setup-env script with the --noauth flag, avoiding repetitive and annoying browser login prompts. If the session has expired, it triggers the full setup script to re-authenticate.

There are a couple of one-off steps we have to do to get direnv up and running:

Install direnv. On Debian/Ubuntu systems, this is sudo apt install direnv.
Allow this folder for direnv. Run direnv allow in the terminal, in the project folder where we've placed our .envrc file.

Now, when we enter our project folder, the script runs automatically, like this:

Pretty neat, right?

Wrap-Up and Next Steps

Okay, we’re done with the environment setup. We’ve:

Setup Google Antigravity, along with some killer skills and MCP servers
Bootstrapped our project using the Agy agent
Played with /grill-me
Established an initial set of core project documentation, using a custom skill
Used the Agy agent to bootstrap an ADK agent, making use of agents-cli and its skills
Created a Makefile for standardising common development, testing and deployment tasks
Created a scripts/setup-env.sh script for setting up our Google Cloud environment
Used direnv and a .envrc file to automate the setup process, every time we open a terminal in this directory

In the next part, we’ll look at the actual code for our FinSavant agents and tools!

See you there!

Before You Go

Please share this with anyone that you think will be interested. It might help them, and it really helps me!
Please give me loads of claps! (Just hold down the clap button.)
Please leave a comment 💬. Interaction is good!
and subscribe, so you don’t miss my content.

Useful Links and References

Project Demo & Portfolio

Gemini Enterprise Agent Platform & ADK

Google Cloud Services & APIs

I open-sourced AEGIS: a self-hosted, flow-first personal AI orchestration platform

Mohammed Arshad Ansari — Mon, 13 Jul 2026 15:26:15 +0000

For the past year I've run most of my day on a system I built for exactly one user: me. Last week I open-sourced it. It's called AEGIS, it's MIT-licensed, and this is the honest tour.

The bet

Every week there's a new agent framework that promises to do everything. AEGIS is a smaller, stranger bet: that software can learn the shape of one person's life well enough to interrupt less. It watches the boring things — tasks, email, money, a
knowledge base, homelab alerts — and only reaches for me when a decision is genuinely mine to make. It's not a chatbot I log into; it's a fleet of scheduled and event-driven workflows that mostly run without me.

## The shape

Four named agents, each a permission boundary with a personality: Sebas (GTD), Raphael (research), Maou (money), Pandora's Actor (infrastructure). The spine is FastAPI + Postgres (with pgvector) + Temporal, on a small Docker Swarm at home. Models
resolve through a LiteLLM proxy — local-first, reaching for Claude or GPT only when a job needs the horsepower.

A few design decisions did most of the work.

## One primitive for every interruption

The decision I'm proudest of is a table. Every time the system needs a human, it's the same shape: a row in a Postgres interactions table, a card in my chat app, and a Temporal workflow that durably waits — for days if it has to — until I tap a
button.

Approvals, choices, drafts to review, plain acknowledgements — one mechanism, five card kinds, one callback format. No per-feature approval tables; adding a new "ask the human" moment costs nothing. And because interrupting me is now a formal act with a
paper trail, flows get written to do more work before they ask. That one decision turned AEGIS from a notification machine into a queue of interruptions that have to earn their way in.

## Durability instead of cron-and-hope

A card a workflow waits on for three days is miserable to build with cron and a queue — you hand-roll a state machine and reconcile it after every deploy. Temporal's durable execution is exactly this: the workflow awaits a signal, and the wait survives
restarts, redeploys, and the occasional node reboot. Schedules reconcile from DB config, so changing a flow's cadence needs no redeploy.

## Behavior is data, not code

The change that made AEGIS forkable was deleting every line that said if agent == "sebas". Capabilities, tool grants, and routing now live in database metadata, edited from an admin panel. The code asks "who owns GTD?" and gets an answer; it never
names names. Rename the agents, re-scope them, or add your own — no Python.

## Local-LLM-first, for real

Everything routes through a LiteLLM proxy exposing three tiers — fast / balanced / smart. Each agent is assigned a tier, never a model name, so swapping models is proxy config and the app code never changes. One reasoning-model gotcha is handled
explicitly: reasoning models bill hidden reasoning tokens against max_tokens before any visible output, so a tight cap returns finish_reason=length with empty content — the client detects that and raises a typed truncation error instead of handing
an empty string to json.loads.

## What it is not

Not a SaaS — no hosted version, and it does nothing until you point it at your own accounts and models. Not another framework to build on; it's a complete, opinionated application you fork and configure for your own life. If that sounds like more setup
than you want, reading the code is a perfectly good outcome.

## Take it apart

Code: https://github.com/hikmahtech/aegis
The longer tour + design essays: https://hikmahtechnologies.com/aegis

I'd genuinely like to know what breaks — and what you'd reach for on the "smart" tier these days. That's the slot I still escalate most often.

Meet Krokq: a light, adaptable task tracker and chat under one shell

Dmitry Isaenko — Mon, 13 Jul 2026 15:23:04 +0000

The pain this grew out of

I help one client with blog support, and their team was working across four different messengers at once. Some people in one, some in another, part of them on a phone only. There was no single place to track anything. Every subproject landed in one shared chat, and it turned into a mess: tasks got lost, agreements were forgotten, and results were written down nowhere.

The big systems are supposed to fix this. But Odoo, monday, ClickUp and the heavy ERPs are too much for a small team, packed with features nobody there will ever touch. By the time you finish setting one up, any wish to actually use it is gone.

I wanted something light that fit this exact problem. That is how Krokq started.

What Krokq is

Krokq ([krok] means 'step') is a light and completely free task tracker and chat under one shell.

The chat is built to feel like the messengers people already use, WhatsApp, Telegram, Viber. That matters more than it sounds: nobody has to learn a new tool, it is familiar from the first minute, and the barrier to entry is almost zero. It takes the parts that actually get used: messaging, drafts, comments, voice notes, drag and drop files, reactions. But the main thing is moving freely between the two modes, Chat and Tasks.

Turn a chat message into a Task in one click.
Jump from a Task straight into a private chat with that person.
Or keep the discussion right inside the Task, whichever fits.

The Tasks side

A real workflow: New, In progress, Rework, In review, Done, plus Trash and Archive.
Custom task types to match how a team works.
A board with columns, with urgent items standing out.
Threaded comments under a task, with reactions, editing and deleting.
Attachments on a task, uploaded or pulled from a connected source.
Search across tasks.
Status based permissions: an assignee goes read only once a task is accepted or archived, for example.
Assigning an owner, accepting work, or sending it back for rework.

The Chat side

Private conversations with colleagues.
Drafts, editing, deleting and forwarding messages.
Reactions on messages.
Voice messages with a waveform.
Attachments: drag files into a thread and back out, paste an image from the clipboard.
Presence indicators and read receipts.
Quoting and replying to a message.

Adaptable through connections

This is the part I am most happy with, and the reason Krokq stays light without being limited. Krokq connects to the services a team already uses, and their content shows up right inside the app as a built in source.

Two connections are ready so far, both to WordPress:

Gallery: browse and search a connected site's media library, read only, through the app backend.
Posts: the list of the site's posts.

Everything goes through the backend over the WP REST API and Application Passwords, you can connect several sites at once, and access is set per company. The useful bit: right from there you can build a Task or drop a message into Chat, without exporting or copying anything by hand.

Under the hood each connection is a small descriptor class. Here is the WordPress Gallery one, trimmed to the essentials:

// A Krokq connection is just a small descriptor. This one pulls a
// WordPress media library into the app, read-only, through the backend.
final class WpGalleryPlugin extends AbstractPlugin
{
    public function id(): string   { return 'wp-gallery'; }
    public function name(): string { return 'WordPress Gallery'; }

    public function multiInstance(): bool { return true; }  // connect several sites
}

Adding a new one for another service is the same kind of descriptor, so the list keeps growing around real requests. That is what adaptable means here: the tool shapes itself to the work, not the other way around.

An app, not just a website

Installs as an app through Chrome on Android and Safari on iOS, and on desktop too. If the system allows standalone, Krokq offers to install itself.
Web Push notifications, with an unread counter right on the icon.
Share files into the app: the system lists Krokq among the share targets for most file types.
10 languages, more as they are needed.
No mobile app yet, but the whole base for it is in place: an API plus Sanctum. So it is a matter of time.

Sign in and demo

Sign in with a login and password or through Google OAuth. Signing in on another device by QR code is next on my list.
Right after signing in you can fill the app with demo data in one click (the vertical is retail, in any of the 10 languages). The demo lives for 24 hours and then deletes itself, so the sandbox is always clean.

What this runs on

Krokq runs on my own engine package, LaraFoundry, a core for spinning up SaaS projects fast: companies, users, roles, authentication. Krokq is the third application on that engine, and the Krokq side itself took me about three days. The engine already runs in production on other apps, and I keep polishing it in parallel.

The domain is covered by tests (Pest and PHPUnit), with the usual CI on top.

What is next

Bigger things in progress: bulk actions on messages and attachments, data export, an admin layer for oversight, and more service connections. I will show them as they land.

Follow along

If a light tracker plus chat is something your small team keeps improvising in group messengers, give Krokq a try and tell me what is missing.

GitOps for Geospatial Data: Building a Self-Healing, Zero-Cost Data Pipeline with GitHub Actions

Manideep Chittineni — Mon, 13 Jul 2026 15:21:37 +0000

Most data engineering and geospatial projects follow a predictable infrastructure blueprint: an ingestion cron job, an enterprise database (like PostGIS), a hosted API layer, a dynamic tile server, and a frontend client. Before you write a single line of business logic, your cloud architectural diagram already carries a fixed monthly overhead.

For Village Finder an open-source interactive mapping application tracking over 78,000 Indian villages, live market rates, and land records I have decided to reject the traditional stack.

Instead, I applied core DevOps, GitOps, and DataOps principles to build an entirely serverless, self-updating data platform. The operational infrastructure bill? Exactly $0.

Here is the architectural blueprint of how I shifted left on geospatial data infrastructure.

🏗️ 1. Infrastructure as Code (IaC) is Good. Data as Code is Better.

The foundational principle of GitOps is that Git is the single source of truth. If your infrastructure states can live in a declarative YAML file, your application data can too.

In Village Finder, the core dataset of record (the structural relationship between Districts -> Mandals -> Villages) is treated exactly like code.

[Upstream API] ➡️ [Daily Ingestion Run] ➡️ [Automated Code Generation] ➡️ [PR Matrix]

When changes occur upstream in the Government of India’s Local Government Directory, a daily scheduled GitHub Actions pipeline handles the processing. But instead of updating an active runtime database, it generates normalized, flat-file static JSON and CSV tables and writes them directly back into a version-controlled Git Pull Request.

The Core Benefits:

Auditable Log Streams: The repository’s commit history doubles as an exact, immutable audit trail of physical data mutations over time (e.g., catching exactly when local authorities reclassified or shifted thousands of village codes overnight).
Zero-Downtime rollbacks: If an upstream data feed introduces corrupt schema transformations, rolling back production to a prior valid data state is as simple as a git revert.

🔀 2. Separating State: PR Pipelines vs. Historyless Data Branches

If you commit highly volatile, real-time data metrics (like daily market prices or weekly welfare shifts) directly to your master branch, your primary git tree history will explode in size within months.

To solve this, we implemented a decoupled lifecycle strategy separating Structural Data from Volatile Metrics:

Structural Data Pipeline (The PR Path)

Changes to core geographic boundaries trigger a standard code-review loop. An automated workflow creates a Pull Request accompanied by a dynamically generated markdown changelog detailing exactly which entries were modified. Consecutive nightly runs update the same open PR branch, eliminating bot spam.

Volatile Metrics Pipeline (The Flat Data Branch CDN)

Daily commodity prices change constantly. For these, our automated runners bypass the Pull Request loop entirely and push directly to standalone, isolated git tracking branches (e.g., data/mandi-prices) using an history-less force-push contract:

# Compile volatile snapshots into a completely history-less single-commit branch
work="$(mktemp -d)" && cp out/*.json "$work" && cd "$work"
git init -q -b data/mandi-prices
git add . && git commit -q -m "data: snapshot $(date -u +%FT%RZ)"
git push --force "https://x-access-token:${TOKEN}@github.com/${REPO}.git" data/mandi-prices

GitHub’s global static asset delivery network (raw.githubusercontent.com) serves public files with open CORS permissions out-of-the-box. The browser frontend handles fetches directly from the head of these flat data branches at runtime. We get a high-availability, zero-latency data delivery network with no active server management.

🧪 3. Shifting Left on Data Validation (DataOps Testing)

In a traditional DevOps loop, Continuous Integration (CI) validates code compilation and unit tests. In a DataOps loop, CI must validate data integrity.

A single missing sub-district mapping or a broken polygon geometry will crash a client-side map canvas. To prevent this, our pipeline treats raw data updates with the same rigor as code changes. Every automated Pull Request must pass an exhaustive suite of over 90 validation rules orchestrated via pytest:

def test_referential_integrity():
    # Assert that every single village maps cleanly to a valid structural parent code
    assert missing_parents == 0

def test_geojson_geometries():
    # Enforce polygon boundary validity before deploying static vector tile coordinates
    assert geometries_are_valid == True

If the upstream government registry outputs an incomplete schema variant, the automated testing matrix fails loud, blocks the integration path, and prevents the deployment runner from shipping broken maps into production.

☔ 4. Designing for Fragile Upstreams: The `EX_TEMPFAIL` Contract

Public data networks encounter high rates of transient downtime, network timeouts, and sudden firewall shifts. If your continuous deployment platform fires a critical failure alarm every single time a remote service faces a routine network drop, your team experiences alert fatigue. You begin to ignore notifications, and true application bugs slip past unnoticed.

To build an infrastructure that tolerates flaky external gateways, we adopted the classic Unix EX_TEMPFAIL status contract.

# Handle flaky connections inside ingestion layers
except RequestException as e:
    logger.error(f"Transient upstream network drop: {e}")
    sys.exit(75) # EX_TEMPFAIL

When our data acquisition routines encounter a terminal connection timeout after multiple retries, they explicitly exit with a status code of 75.

Our orchestration runner identifies code 75 not as a breaking error, but as a clean skip request. The workflow execution concludes gracefully, retains the previous day's working data cache, logs a brief summary update, and keeps the overall build pipeline completely green. Alarms only sound if something is truly broken inside our internal code logic.

📐 5. Progressive Build Aggregations (Branch Overlays)

To keep the platform highly decoupled, we use a modular architecture where separate workflows generate independent data layers (like complex cadastral survey boundaries or village point catalogs) entirely in parallel.

At deployment time, instead of running heavy multi-hour calculation steps sequentially, a highly optimized compilation worker overlays these pre-rendered data blocks straight into the target production directory using shallow checkouts:

- name: Overlay Pre-Rendered Vector Boundaries
  run: |
    git fetch -q --depth 1 origin "data/boundary-tiles"
    git checkout -q FETCH_HEAD -- ./tiles/boundaries.pmtiles

If a developer forks the project locally to build a minor feature patch, absent data branches skip missing files quietly. This design ensures the entire local system remains lightweight, instantly reproducible, and highly modular for open-source contributors.

🎯 The Big Takeaway

DevOps is frequently treated as an enterprise enterprise cost center—a tool setup meant for managing Kubernetes nodes or provisioning massive cloud databases.

Village Finder proves that by applying core DevOps mental models—immutability, continuous data validation gates, decoupled architecture, and treating external inputs as a version-controlled pipeline—you can deliver fast public software with exceptional durability and zero maintenance costs.

🌐 Live App: mchittineni.github.io/india-village-finder
📦 Explore the Actions & Code: github.com/mchittineni/india-village-finder

DEV Community

Complete AI Agent Lockdown: 21 Policy Types for Maximum Security

Complete AI Agent Lockdown: 21 Policy Types for Maximum Security

The Actual Risk Model

Layer 1: Authentication — Three Separate Keys for Three Separate Roles

Layer 2: The Policy Engine — Default-Deny with 21 Types

The Four Security Tiers

The Full List of 21 Policy Types

Configuring Default-Deny Whitelists

Layer 3: Human Approval Channels

The Transaction Pipeline

Simulate Before You Execute

Quick Start: Setting Up a Locked-Down Agent Wallet

What's Next

Real-Time AI Observability: Dashboards That Show Actual Database Rows

Real-Time AI Observability: Dashboards That Show Actual Database Rows

Why Mock Data Undermines Debugging AI

How TormentNexus Streams Live Database Rows

Real-World Case: Detecting a Silent Schema Drift

Building an Agent Monitoring Practice on Raw Rows

The Performance Reality of Row-Level Streaming

MCP Protocol Deep-Dive: How Tool Discovery Actually Works Under the Hood

MCP Protocol Deep-Dive: How Tool Discovery Actually Works Under the Hood

The Handshake That Sets the Stage: JSON-RPC Initiation

Tool Enumeration: Beyond the “listTools” Metho

Capability Negotiation: MCP Internals of Feature Discovery

Progressive Injection: How Tools Flow to the LLM

Real-World Performance: Latency Benchmarks

Beyond Synchronous Hell: Why Your Multi-Agent System Needs an Event-Driven Backbone

Beyond Synchronous Hell: Why Your Multi-Agent System Needs an Event-Driven Backbone

The Synchronization Crisis in Multi-Agent Systems

The Pub/Sub Pattern: Decoupling Agents with an Event Bus

How Planner, Implementer, and Critic Stay Synchronized Without Locking

Handling Eventual Consistency and Conflict Resolution

Building Resilient Multi-Agent Workflows with Event Sourcing

Why Vercel is still my default for shipping frontend projects

How I use Vercel in my projects

Why do I keep coming back to Vercel?

What are the alternatives to Vercel?

Where Vercel actually falls short

Is the Vercel free tier actually good enough?

What is the verdict?

Commerce And Secrets Without An IAP Tax

Entitlements Instead Of SKU Branches

What Happens When Quota Runs Out

What Commerce Adds

Secrets

The Boundary

Skip LinkedIn/Indeed: most companies' job boards have a public JSON API

The endpoints

Example: pulling Stripe's open roles (Python)

Auto-detecting the ATS

Gotchas

If you don't want to build/maintain 9 of these

The Solana Program Security Checklist I Wish I'd Had on Day One

Who this is for

The Wormhole anchor

1. Account Validation

2. Authority and Signer Checks

3. Arithmetic Safety

4. CPI Safety

5. Account Lifecycle

6. Pre-Deploy Hygiene

Where Anchor helps and where it does not

How to use this checklist

Resources

Building an Agentic FinOps Platform — Development Environment Setup, Google Antigravity, MCPs and Skills, and ADK Bootstrapping with Agents CLI

Welcome to Part 2

Series Orientation

Getting Started with Antigravity IDE

Project Structure

Skills for Your Coding Agent

GEMINI.md - Context for Your Coding Agent

Documentation Approach

MCP Servers for Your Coding Agent

Scaffolding Your ADK Agent

Bonus #1: Getting Started with a Makefile

Bonus #2: My Setup-Env Script

Bonus #3: Automating Setup with direnv and .envrc

Wrap-Up and Next Steps

`GEMINI.md` - Context for Your Coding Agent

Bonus #3: Automating Setup with `direnv` and `.envrc`

☔ 4. Designing for Fragile Upstreams: The `EX_TEMPFAIL` Contract