别再口嗨"让 AI 帮你炒股"了
Vibe-Trading：一句命令给 agent 接上行情、回测、量化研究库和多券商下单
37349 star，MIT 开源，Python + FastAPI 全栈
装上就是你自己的交易中台，策略自己说了算
HKUDS/Vibe-Trading
1 like · 34 views
2 Vibe-Trading.
HKUDS/Vibe-Trading
Trading algorítmico con IA. Analiza el mercado, detecta patrones y ejecuta operaciones sin que tengas que estar mirando la pantalla.
1 like · 29 views
模拟交易结果要复核，代码版本也得一起存。
开源交易工具Vibe-Trading在10月28日给模拟订单加了稳定重放ID和确定性快照，修复还在main，没正式发版。
版本先锁住。你今天拉主分支，明天再跑，差异可能来自代码，提交号也要记进实验记录。
#开源工具
HKUDS/Vibe-Trading
11 views
For Finance + AI agents in Claude, Cursor or n8n:
Run 15 live SEC EDGAR 8-K/10-K, Half-Kelly, Monte Carlo Overfitting & B2B Lead tools via zero-key MCP (`npx -y b2b-lead-quant-mcp`):
rotenkus-dot/b2b-lead-quant-mcp
x.com
1 like · 24 views
Vibe-Trading: A Free, Open-Source AI Trading Agent With 90 Finance Skills
Vibe-Trading is an open-source Python project from HKUDS that turns plain-English finance questions into runnable research: market data, strategy code, backtests, validation and full reports. It ships 90 finance skills, 30 preset agent teams (including an investment committee where a bull and a bear argue before a portfolio manager decides), an Alpha Zoo with 478 pre-built alphas, and a Shadow Account that studies your own trading journal. In this walkthrough we look at what it is, its standout features, how the research workflow works, and how to install and run it yourself.
It's MIT licensed, installs with one pip command (pip install vibe-trading-ai), runs as a terminal app, a web UI or an MCP server, and works with many LLM providers or a local model via Ollama. Repo #2 of 10 in our GitHub repo series.
Repo: HKUDS/Vibe-Trading
Found via @your.aimentor on TikTok
Not financial advice.
Chapters:
0:00 Intro
0:38 What Vibe-Trading is
1:52 Standout features
3:33 How it works
5:02 How to install and use it
6:42 Real-world use cases
7:33 Things to know
8:04 Verdict
262 views
Vibe-Trading's MCP Integration: How a Personal Trading Agent Exposes Tool Boundaries Between Backtesting, Execution, and Risk
Vibe-Trading is a Python framework for personal trading agents that hit 36K stars by exposing a hard problem: how do you let an LLM-powered agent backtest strategies, query market data, and execute trades without accidentally placing real orders during development? The answer is Model Context Protocol (MCP) integration that enforces tool boundaries through permission scoping, credential isolation, and explicit state transitions between simulation and live execution.
This is not a trading strategy library. It is plumbing for multi-agent orchestration in a domain where a misconfigured tool call can drain a brokerage account.
Why Tool Boundaries Matter in Trading Agents
Most agent frameworks treat tools as uniform functions. You register a Python callable, the LLM calls it, you return a result. Trading agents break this model because tools fall into three risk categories:
- Read-only market data: fetching prices, historical bars, news feeds
- Simulation tools: backtesting engines, paper trading accounts, risk calculators
- Live execution: placing orders, canceling positions, transferring funds
The failure mode is obvious. If your agent decides to "test" a strategy by calling place_order() with real credentials during a backtest run, you own that trade. MCP provides a protocol layer that separates tool discovery, permission negotiation, and invocation into distinct phases.
How Vibe-Trading Uses MCP for Permission Scoping
Vibe-Trading exposes trading capabilities through an MCP server that clients (including LLM agents) connect to via JSON-RPC. The server advertises tools with explicit capability flags:
# Simplified MCP tool registration
tools = [
{
"name": "get_market_data",
"description": "Fetch historical price data",
"capabilities": ["read"],
"requires_auth": False
},
{
"name": "run_backtest",
"description": "Simulate strategy on historical data",
"capabilities": ["read", "compute"],
"requires_auth": False
},
{
"name": "place_order",
"description": "Execute live trade",
"capabilities": ["write", "financial"],
"requires_auth": True,
"requires_confirmation": True
}
]
The client negotiates capabilities during the MCP handshake. A backtesting agent connects with ["read", "compute"] permissions. It cannot see place_order() in its tool list. A live trading agent connects with ["read", "compute", "write", "financial"] and must provide broker API credentials scoped to a specific account.
This is not runtime sandboxing. It is protocol-level filtering. The agent never receives tool definitions it lacks permission to invoke.
State Machine for Backtesting to Live Execution
Vibe-Trading implements a shadow account system that mirrors live positions in a simulation layer. The state machine looks like this:
| State | Allowed Tools | Credential Scope | Failure Behavior |
|-------|---------------|------------------|------------------|
| BACKTEST | Market data, historical bars, risk calculators | None | Log error, continue |
| PAPER | Market data, simulated order placement, shadow positions | Read-only broker API | Log error, continue |
| LIVE_PREVIEW | Market data, order preview (no execution) | Read-only broker API | Halt on API error |
| LIVE_EXECUTE | Full order placement, position management | Read-write broker API | Halt on API error, alert user |
Transitions between states require explicit user confirmation. The agent cannot promote itself from PAPER to LIVE_EXECUTE. The framework enforces this through MCP capability negotiation: the server only advertises execution tools when the client provides a live-scoped credential and the user has enabled live trading in the configuration.
Credential Isolation and Broker API Scoping
Vibe-Trading supports multiple broker integrations (Alpaca, Interactive Brokers, Binance). Each broker connection is a separate MCP resource with its own credential store:
- Paper trading credentials: stored in local config, scoped to sandbox API endpoints
- Live trading credentials: stored in encrypted keyring, scoped to production API endpoints with IP whitelisting
The MCP server validates credentials before advertising tools. If you connect with a paper trading API key, the server filters out all place_order() variants. If you connect with a live key but the account has insufficient buying power, the server returns a capability error before the agent attempts a trade.
This prevents credential leakage across environments. Your agent cannot accidentally use live credentials during a backtest because the backtest client never receives those credentials in the MCP handshake.
Tool Invocation Failures and Retry Logic
Trading APIs fail. Rate limits, network timeouts, and exchange outages are normal. Vibe-Trading's MCP integration handles failures at three levels:
1. Transport failures: MCP client retries with exponential backoff (max 3 attempts)
2. API errors: Broker-specific error codes mapped to MCP error types (RATE_LIMIT, INSUFFICIENT_FUNDS, INVALID_ORDER)
3. Agent-level failures: LLM decides whether to retry, adjust parameters, or escalate to user
The framework does not auto-retry order placements. If place_order() returns an error, the agent receives the full error context (error code, message, remaining rate limit) and must explicitly decide to retry. This prevents runaway retry loops that could place duplicate orders.
Observability and Audit Logging
Every MCP tool invocation is logged with:
- Timestamp and session ID
- Tool name and parameters (sanitized to remove credentials)
- Result or error code
- Agent reasoning (if available from LLM context)
The logs are append-only and include a separate audit trail for state transitions. When an agent moves from PAPER to LIVE_EXECUTE, the framework logs the user confirmation, the credential scope change, and the first tool invocation in live mode.
This is critical for post-mortem analysis. If your agent places a bad trade, you can trace the exact sequence of tool calls, the market data it used, and the LLM reasoning that led to the decision.
Deployment Shape and Security Boundaries
Vibe-Trading runs as a local FastAPI server with a React frontend. The MCP server is embedded in the FastAPI process and listens on localhost:8000 by default. The architecture looks like this:
┌─────────────┐ ┌──────────────┐ ┌─────────────┐
│ React UI │ ◄─────► │ FastAPI │ ◄─────► │ Broker APIs │
│ (browser) │ HTTP │ + MCP Server │ HTTPS │ (Alpaca, │
└─────────────┘ └──────────────┘ │ IB, etc) │
│ └─────────────┘
│ MCP/JSON-RPC
▼
┌──────────────┐
│ LLM Agent │
│ (local or │
│ API-based) │
└──────────────┘
The security boundary is the MCP capability negotiation. The agent cannot bypass the FastAPI server to call broker APIs directly because it does not have the credentials. All credentials are stored server-side and injected into tool calls after permission checks.
For remote deployment (agent running in a cloud VM, UI on local machine), you must add TLS and authentication to the FastAPI server. The MCP protocol itself does not include authentication; it assumes a trusted transport.
When to Use This Pattern
Use MCP-based tool boundaries when:
- Your agent has access to tools with different risk profiles (read vs. write, simulation vs. production)
- You need to enforce permission checks before the agent sees tool definitions
- You want audit logs that trace every tool invocation to a user session
- You are deploying in a domain where a bad tool call has financial or legal consequences
Avoid this pattern when:
- All your tools are read-only or have uniform risk profiles
- You need sub-second latency (MCP adds JSON-RPC overhead)
- Your agent runs in a sandboxed environment with OS-level isolation (containers, VMs)
- You are prototyping and do not yet know what tools you need
Technical Verdict
Vibe-Trading's MCP integration is a working example of permission-scoped tool boundaries in a high-stakes domain. The framework separates tool discovery from invocation, enforces state transitions through capability negotiation, and isolates credentials by environment. This is not theoretical. It is production plumbing for agents that can lose real money.
The trade-off is complexity. You are adding a protocol layer (MCP), a state machine (backtest to live), and a credential store (encrypted keyring). If your agent only needs to fetch market data and log recommendations, this is overkill. If your agent places trades, this is the minimum viable safety boundary.
The failure mode to watch: MCP does not prevent logic errors in your agent. If the LLM decides to place a trade based on stale data or misinterpreted signals, the framework will execute it. Tool boundaries prevent accidental execution. They do not prevent bad decisions.
Source Links
- Vibe-Trading GitHub Repository
- Vibe-Trading Documentation
1 reaction
2. Vibe-Trading: a trading agent you talk to
pip install vibe-trading-ai
> research + backtests in plain English
> 478-factor alpha zoo
> daily paper trading (new in v0.1.17)
> MCP server for Claude & Cursor
2 releases this week ⭐ 36K
HKUDS/Vibe-Trading t.co
1 like · 16 views
Vibe-Trading: Turn Plain English Into a Backtested Strategy #Shorts
Vibe-Trading is an open-source AI trading agent: describe a strategy in plain English and it writes, backtests and reports on it.
Stocks, crypto, futures and forex · 29 data sources · 30 multi-agent team presets · 478 pre-built alphas · export to TradingView and MetaTrader 5. MIT licensed.
Source: x.com (@0xrux)
Repo: HKUDS/Vibe-Trading
Not financial advice.
#AI #AITrading #OpenSource #Backtesting #QuantTrading #Crypto #Shorts
43 views
Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell
---
title: "Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell"
tags: security, ai, llm, appsec
---
Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell
A vector breakdown of CVE-2026-114107 (HKUDS Vibe-Trading 0.1.0 before 0.1.7, fixed in 0.1.7)
Most agent shell bugs need an attacker who can talk to the agent. This one only needs an attacker who can get a document or a web page in front of it. Vibe-Trading hands its model a shell tool that runs whatever command the model emits, as root, with no allow-list and no approval step. So the person who wrote the PDF the agent is summarizing has the same reach as the operator.
What the advisory actually says
From the CVE record (published to NVD October 21, 2026, 01:17 UTC, by VulnCheck), the VulnCheck advisory, and the project's GitHub advisory GHSA-jqmf-mx4f-hfr6:
- Product: HKUDS Vibe-Trading, an AI trading-research agent. Affected: 0.1.0 up to, but not including, 0.1.7. Fixed: 0.1.7.
- Weakness: CWE-1427, Improper Neutralization of Input Used for LLM Prompting. The GitHub advisory also lists CWE-77, CWE-78, CWE-94, CWE-116 and CWE-918.
- Severity: VulnCheck scores it High, CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H). Network-reachable, no privileges, and "passive" user interaction: someone just has to ask the agent to read the attacker's content.
- The bug, in the CVE's words: "remote attackers [can] execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery."
- Related: CVE-2026-114106 covers the same release's file-read tools, which could be steered by path traversal into files like /etc/shadow and /proc/self/environ.
The GitHub advisory groups five findings under one root cause: "LLM-callable tool primitive ships with zero input validation between the LLM and the sink."
The vector: attacker text in, root shell out
1. The attacker writes instructions into content the agent will read later: an uploaded document, a web page, a trade journal.
2. A legitimate user asks the agent to summarize or research that content. The user's own prompt is clean.
3. The model reads the planted instructions and can't reliably separate "text I'm analyzing" from "instructions I should follow," so it emits a call to the shell tool.
4. BashTool (or its async sibling BackgroundRunTool) passes that command straight to subprocess.run(..., shell=True). No parser, no allow-list, no confirmation.
5. The container has no USER directive, so the command runs as root, with whatever keys and network the agent process holds.
The advisory notes a second path to the same tools: in affected versions the session API itself had no working authentication (a separate advisory), so anyone who could reach the port could drive them directly. But it's explicit that fixing authentication alone "leaves prompt-injection RCE on the table."
Why this class of bug exists: four root causes
1. A general-purpose shell is registered by default
Mechanism. Agent frameworks discover tools automatically and hand the model the whole registry. If one of those tools is "run any shell command," every task the agent does, even a summary, carries the ability to run code.
Evidence. The advisory says all five tools "are members of the auto-discovered tool registry the LLM agent gets at startup," and "the tool registration is unconditional in default config — no operator opt-in flag gates them." It also points out that there are two shell entry points, so "fixing only BashTool leaves this path intact."
What fixes it. Make dangerous tools opt-in, not discovered. A summarizing turn has no business holding a shell at all. If a workflow truly needs one, the operator should switch it on explicitly, for that workflow.
2. The model's judgment is the only gate
Mechanism. When the code between the model and subprocess does nothing, the model's own discretion is the security boundary. Prompt injection exists precisely to beat that discretion.
Evidence. The advisory's wording: "the LLM's own judgement is the only barrier, and that barrier collapses under prompt injection." The command argument is read "directly … (LLM-emitted) with no allowlist, no escaping, no chroot, no seccomp, and no length cap."
What fixes it. Put a deterministic check between the model and the sink: an allow-list of command prefixes, argument parsing with shell=False, and human approval for anything outside the list. The check has to be code, because text the attacker controls can't change code.
3. Untrusted content and privileged tools share one turn
Mechanism. The same model turn that ingests outside content can call tools with real authority. That gives the author of the content the operator's authority.
Evidence. The advisory describes "an authenticated, non-malicious caller using a clean prompt" being "turned into an RCE vector by feeding the agent attacker-controlled content (a malicious PDF, web page, or trade journal)." The same applies to read_url, which forwarded any model-supplied URL with "no schema check, no hostname allowlist, no RFC1918 filter," so planted text could also point the agent at internal services.
What fixes it. Split reading from acting. Turns that process outside content get read-only tools; acting turns don't see raw outside content, or their tool calls need approval the content can't grant. Validate outbound URLs (scheme, host, private address ranges) in code.
4. The blast radius is root in the container
Mechanism. Even a well-gated agent will eventually run something it shouldn't. What it can reach then decides whether that's a nuisance or a breach.
Evidence. "The container has no USER directive, so successful execution runs as uid=0(root)." The related CVE-2026-114106 shows the same release could read /proc/self/environ, which is where API keys in environment variables live.
What fixes it. Run as a non-root user, keep secrets out of the agent's environment, and limit outbound network access to what the workflow needs.
How this connects to other agent tool bugs
Recent approval-gate bugs had a gate that checked too little, or a gate that went silent on headless surfaces. This one never had a gate. Same lesson, simplest form: if the only thing between untrusted text and a shell is the model's opinion, the attacker is the one with the shell.
Defensive takeaways you can check this week
- Upgrade. If you run Vibe-Trading 0.1.0 through 0.1.6, move to 0.1.7, per the GitHub advisory.
- Rotate if exposed. If an affected version read outside documents or URLs, or its port was reachable by others, rotate the LLM and data-provider keys in its environment and review its shell history and outbound traffic.
- Inventory your own agents' shell tools. Search for shell=True and equivalents reachable from a model tool call. For each, ask whether it's registered by default and what code, not prompt, stands in front of it.
- Gate outbound fetches. Any "read this URL" tool should reject non-HTTP schemes and private, loopback and link-local addresses before it fetches.
- Drop root. Add a non-root USER to agent containers and keep long-lived secrets out of their environment.
- Test the injection path. Add a test that feeds the agent a document containing an instruction to call its shell tool and asserts the call is refused, not just that the model "usually ignores it."
Sources
- NVD entry for CVE-2026-114107
- VulnCheck advisory
- Vibe-Trading GitHub advisory GHSA-jqmf-mx4f-hfr6
- NVD entry for CVE-2026-114106
---
If you're building agent backends and want a checklist for this kind of trust boundary, the Trust Boundary pack covers it.
This article was drafted with AI assistance and edited by a human. All facts come from the advisories and CVE record linked above.
5 Free GitHub Repos That Replace a $30K Wall Street Terminal #wallstreet #daytrading
Wall Street pays ~$30K a year for tools like these. All 5 are free and open source.
01 OpenBB (free data platform): OpenBB-finance/OpenBB
02 FinceptTerminal (Bloomberg-style terminal): Fincept-Corporation/FinceptTerminal
03 Vibe-Trading (AI quant agent): HKUDS/Vibe-Trading
04 QuantConnect Lean (pro backtester): QuantConnect/Lean
05 My 2 NQ strategies: dropping soon. Subscribe so you don't miss them.
Learn to day trade NQ step by step: artillerytrades.gumroad.com
Educational only, not financial advice. Futures trading involves substantial risk of loss.
#shorts #daytrading #nasdaq #futurestrading #algotrading #github #quant #tradingview
5 likes · 622 views
Mentions
别再口嗨"让 AI 帮你炒股"了 Vibe-Trading：一句命令给 agent 接上行情、回测、量化研究库和多券商下单 37349 star，MIT 开源，Python + FastAPI 全栈 装上就是你自己的交易中台，策略自己说了算 HKUDS/Vibe-Trading
2 Vibe-Trading. HKUDS/Vibe-Trading Trading algorítmico con IA. Analiza el mercado, detecta patrones y ejecuta operaciones sin que tengas que estar mirando la pantalla.
模拟交易结果要复核，代码版本也得一起存。 开源交易工具Vibe-Trading在10月28日给模拟订单加了稳定重放ID和确定性快照，修复还在main，没正式发版。 版本先锁住。你今天拉主分支，明天再跑，差异可能来自代码，提交号也要记进实验记录。 #开源工具 HKUDS/Vibe-Trading
For Finance + AI agents in Claude, Cursor or n8n: Run 15 live SEC EDGAR 8-K/10-K, Half-Kelly, Monte Carlo Overfitting & B2B Lead tools via zero-key MCP (`npx -y b2b-lead-quant-mcp`): rotenkus-dot/b2b-lead-quant-mcp x.com
Vibe-Trading: A Free, Open-Source AI Trading Agent With 90 Finance Skills Vibe-Trading is an open-source Python project from HKUDS that turns plain-English finance questions into runnable research: market data, strategy code, backtests, validation and full reports. It ships 90 finance skills, 30 preset agent teams (including an investment committee where a bull and a bear argue before a portfolio manager decides), an Alpha Zoo with 478 pre-built alphas, and a Shadow Account that studies your own trading journal. In this walkthrough we look at what it is, its standout features, how the research workflow works, and how to install and run it yourself. It's MIT licensed, installs with one pip command (pip install vibe-trading-ai), runs as a terminal app, a web UI or an MCP server, and works with many LLM providers or a local model via Ollama. Repo #2 of 10 in our GitHub repo series. Repo: HKUDS/Vibe-Trading Found via @your.aimentor on TikTok Not financial advice. Chapters: 0:00 Intro 0:38 What Vibe-Trading is 1:52 Standout features 3:33 How it works 5:02 How to install and use it 6:42 Real-world use cases 7:33 Things to know 8:04 Verdict
Vibe-Trading's MCP Integration: How a Personal Trading Agent Exposes Tool Boundaries Between Backtesting, Execution, and Risk Vibe-Trading is a Python framework for personal trading agents that hit 36K stars by exposing a hard problem: how do you let an LLM-powered agent backtest strategies, query market data, and execute trades without accidentally placing real orders during development? The answer is Model Context Protocol (MCP) integration that enforces tool boundaries through permission scoping, credential isolation, and explicit state transitions between simulation and live execution. This is not a trading strategy library. It is plumbing for multi-agent orchestration in a domain where a misconfigured tool call can drain a brokerage account. Why Tool Boundaries Matter in Trading Agents Most agent frameworks treat tools as uniform functions. You register a Python callable, the LLM calls it, you return a result. Trading agents break this model because tools fall into three risk categories: - Read-only market data: fetching prices, historical bars, news feeds - Simulation tools: backtesting engines, paper trading accounts, risk calculators - Live execution: placing orders, canceling positions, transferring funds The failure mode is obvious. If your agent decides to "test" a strategy by calling place_order() with real credentials during a backtest run, you own that trade. MCP provides a protocol layer that separates tool discovery, permission negotiation, and invocation into distinct phases. How Vibe-Trading Uses MCP for Permission Scoping Vibe-Trading exposes trading capabilities through an MCP server that clients (including LLM agents) connect to via JSON-RPC. The server advertises tools with explicit capability flags: # Simplified MCP tool registration tools = [ { "name": "get_market_data", "description": "Fetch historical price data", "capabilities": ["read"], "requires_auth": False }, { "name": "run_backtest", "description": "Simulate strategy on historical data", "capabilities": ["read", "compute"], "requires_auth": False }, { "name": "place_order", "description": "Execute live trade", "capabilities": ["write", "financial"], "requires_auth": True, "requires_confirmation": True } ] The client negotiates capabilities during the MCP handshake. A backtesting agent connects with ["read", "compute"] permissions. It cannot see place_order() in its tool list. A live trading agent connects with ["read", "compute", "write", "financial"] and must provide broker API credentials scoped to a specific account. This is not runtime sandboxing. It is protocol-level filtering. The agent never receives tool definitions it lacks permission to invoke. State Machine for Backtesting to Live Execution Vibe-Trading implements a shadow account system that mirrors live positions in a simulation layer. The state machine looks like this: | State | Allowed Tools | Credential Scope | Failure Behavior | |-------|---------------|------------------|------------------| | BACKTEST | Market data, historical bars, risk calculators | None | Log error, continue | | PAPER | Market data, simulated order placement, shadow positions | Read-only broker API | Log error, continue | | LIVE_PREVIEW | Market data, order preview (no execution) | Read-only broker API | Halt on API error | | LIVE_EXECUTE | Full order placement, position management | Read-write broker API | Halt on API error, alert user | Transitions between states require explicit user confirmation. The agent cannot promote itself from PAPER to LIVE_EXECUTE. The framework enforces this through MCP capability negotiation: the server only advertises execution tools when the client provides a live-scoped credential and the user has enabled live trading in the configuration. Credential Isolation and Broker API Scoping Vibe-Trading supports multiple broker integrations (Alpaca, Interactive Brokers, Binance). Each broker connection is a separate MCP resource with its own credential store: - Paper trading credentials: stored in local config, scoped to sandbox API endpoints - Live trading credentials: stored in encrypted keyring, scoped to production API endpoints with IP whitelisting The MCP server validates credentials before advertising tools. If you connect with a paper trading API key, the server filters out all place_order() variants. If you connect with a live key but the account has insufficient buying power, the server returns a capability error before the agent attempts a trade. This prevents credential leakage across environments. Your agent cannot accidentally use live credentials during a backtest because the backtest client never receives those credentials in the MCP handshake. Tool Invocation Failures and Retry Logic Trading APIs fail. Rate limits, network timeouts, and exchange outages are normal. Vibe-Trading's MCP integration handles failures at three levels: 1. Transport failures: MCP client retries with exponential backoff (max 3 attempts) 2. API errors: Broker-specific error codes mapped to MCP error types (RATE_LIMIT, INSUFFICIENT_FUNDS, INVALID_ORDER) 3. Agent-level failures: LLM decides whether to retry, adjust parameters, or escalate to user The framework does not auto-retry order placements. If place_order() returns an error, the agent receives the full error context (error code, message, remaining rate limit) and must explicitly decide to retry. This prevents runaway retry loops that could place duplicate orders. Observability and Audit Logging Every MCP tool invocation is logged with: - Timestamp and session ID - Tool name and parameters (sanitized to remove credentials) - Result or error code - Agent reasoning (if available from LLM context) The logs are append-only and include a separate audit trail for state transitions. When an agent moves from PAPER to LIVE_EXECUTE, the framework logs the user confirmation, the credential scope change, and the first tool invocation in live mode. This is critical for post-mortem analysis. If your agent places a bad trade, you can trace the exact sequence of tool calls, the market data it used, and the LLM reasoning that led to the decision. Deployment Shape and Security Boundaries Vibe-Trading runs as a local FastAPI server with a React frontend. The MCP server is embedded in the FastAPI process and listens on localhost:8000 by default. The architecture looks like this: ┌─────────────┐ ┌──────────────┐ ┌─────────────┐ │ React UI │ ◄─────► │ FastAPI │ ◄─────► │ Broker APIs │ │ (browser) │ HTTP │ + MCP Server │ HTTPS │ (Alpaca, │ └─────────────┘ └──────────────┘ │ IB, etc) │ │ └─────────────┘ │ MCP/JSON-RPC ▼ ┌──────────────┐ │ LLM Agent │ │ (local or │ │ API-based) │ └──────────────┘ The security boundary is the MCP capability negotiation. The agent cannot bypass the FastAPI server to call broker APIs directly because it does not have the credentials. All credentials are stored server-side and injected into tool calls after permission checks. For remote deployment (agent running in a cloud VM, UI on local machine), you must add TLS and authentication to the FastAPI server. The MCP protocol itself does not include authentication; it assumes a trusted transport. When to Use This Pattern Use MCP-based tool boundaries when: - Your agent has access to tools with different risk profiles (read vs. write, simulation vs. production) - You need to enforce permission checks before the agent sees tool definitions - You want audit logs that trace every tool invocation to a user session - You are deploying in a domain where a bad tool call has financial or legal consequences Avoid this pattern when: - All your tools are read-only or have uniform risk profiles - You need sub-second latency (MCP adds JSON-RPC overhead) - Your agent runs in a sandboxed environment with OS-level isolation (containers, VMs) - You are prototyping and do not yet know what tools you need Technical Verdict Vibe-Trading's MCP integration is a working example of permission-scoped tool boundaries in a high-stakes domain. The framework separates tool discovery from invocation, enforces state transitions through capability negotiation, and isolates credentials by environment. This is not theoretical. It is production plumbing for agents that can lose real money. The trade-off is complexity. You are adding a protocol layer (MCP), a state machine (backtest to live), and a credential store (encrypted keyring). If your agent only needs to fetch market data and log recommendations, this is overkill. If your agent places trades, this is the minimum viable safety boundary. The failure mode to watch: MCP does not prevent logic errors in your agent. If the LLM decides to place a trade based on stale data or misinterpreted signals, the framework will execute it. Tool boundaries prevent accidental execution. They do not prevent bad decisions. Source Links - Vibe-Trading GitHub Repository - Vibe-Trading Documentation
2. Vibe-Trading: a trading agent you talk to pip install vibe-trading-ai > research + backtests in plain English > 478-factor alpha zoo > daily paper trading (new in v0.1.17) > MCP server for Claude & Cursor 2 releases this week ⭐ 36K HKUDS/Vibe-Trading t.co
Vibe-Trading: Turn Plain English Into a Backtested Strategy #Shorts Vibe-Trading is an open-source AI trading agent: describe a strategy in plain English and it writes, backtests and reports on it. Stocks, crypto, futures and forex · 29 data sources · 30 multi-agent team presets · 478 pre-built alphas · export to TradingView and MetaTrader 5. MIT licensed. Source: x.com (@0xrux) Repo: HKUDS/Vibe-Trading Not financial advice. #AI #AITrading #OpenSource #Backtesting #QuantTrading #Crypto #Shorts
Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell --- title: "Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell" tags: security, ai, llm, appsec --- Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell A vector breakdown of CVE-2026-114107 (HKUDS Vibe-Trading 0.1.0 before 0.1.7, fixed in 0.1.7) Most agent shell bugs need an attacker who can talk to the agent. This one only needs an attacker who can get a document or a web page in front of it. Vibe-Trading hands its model a shell tool that runs whatever command the model emits, as root, with no allow-list and no approval step. So the person who wrote the PDF the agent is summarizing has the same reach as the operator. What the advisory actually says From the CVE record (published to NVD October 21, 2026, 01:17 UTC, by VulnCheck), the VulnCheck advisory, and the project's GitHub advisory GHSA-jqmf-mx4f-hfr6: - Product: HKUDS Vibe-Trading, an AI trading-research agent. Affected: 0.1.0 up to, but not including, 0.1.7. Fixed: 0.1.7. - Weakness: CWE-1427, Improper Neutralization of Input Used for LLM Prompting. The GitHub advisory also lists CWE-77, CWE-78, CWE-94, CWE-116 and CWE-918. - Severity: VulnCheck scores it High, CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H). Network-reachable, no privileges, and "passive" user interaction: someone just has to ask the agent to read the attacker's content. - The bug, in the CVE's words: "remote attackers [can] execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery." - Related: CVE-2026-114106 covers the same release's file-read tools, which could be steered by path traversal into files like /etc/shadow and /proc/self/environ. The GitHub advisory groups five findings under one root cause: "LLM-callable tool primitive ships with zero input validation between the LLM and the sink." The vector: attacker text in, root shell out 1. The attacker writes instructions into content the agent will read later: an uploaded document, a web page, a trade journal. 2. A legitimate user asks the agent to summarize or research that content. The user's own prompt is clean. 3. The model reads the planted instructions and can't reliably separate "text I'm analyzing" from "instructions I should follow," so it emits a call to the shell tool. 4. BashTool (or its async sibling BackgroundRunTool) passes that command straight to subprocess.run(..., shell=True). No parser, no allow-list, no confirmation. 5. The container has no USER directive, so the command runs as root, with whatever keys and network the agent process holds. The advisory notes a second path to the same tools: in affected versions the session API itself had no working authentication (a separate advisory), so anyone who could reach the port could drive them directly. But it's explicit that fixing authentication alone "leaves prompt-injection RCE on the table." Why this class of bug exists: four root causes 1. A general-purpose shell is registered by default Mechanism. Agent frameworks discover tools automatically and hand the model the whole registry. If one of those tools is "run any shell command," every task the agent does, even a summary, carries the ability to run code. Evidence. The advisory says all five tools "are members of the auto-discovered tool registry the LLM agent gets at startup," and "the tool registration is unconditional in default config — no operator opt-in flag gates them." It also points out that there are two shell entry points, so "fixing only BashTool leaves this path intact." What fixes it. Make dangerous tools opt-in, not discovered. A summarizing turn has no business holding a shell at all. If a workflow truly needs one, the operator should switch it on explicitly, for that workflow. 2. The model's judgment is the only gate Mechanism. When the code between the model and subprocess does nothing, the model's own discretion is the security boundary. Prompt injection exists precisely to beat that discretion. Evidence. The advisory's wording: "the LLM's own judgement is the only barrier, and that barrier collapses under prompt injection." The command argument is read "directly … (LLM-emitted) with no allowlist, no escaping, no chroot, no seccomp, and no length cap." What fixes it. Put a deterministic check between the model and the sink: an allow-list of command prefixes, argument parsing with shell=False, and human approval for anything outside the list. The check has to be code, because text the attacker controls can't change code. 3. Untrusted content and privileged tools share one turn Mechanism. The same model turn that ingests outside content can call tools with real authority. That gives the author of the content the operator's authority. Evidence. The advisory describes "an authenticated, non-malicious caller using a clean prompt" being "turned into an RCE vector by feeding the agent attacker-controlled content (a malicious PDF, web page, or trade journal)." The same applies to read_url, which forwarded any model-supplied URL with "no schema check, no hostname allowlist, no RFC1918 filter," so planted text could also point the agent at internal services. What fixes it. Split reading from acting. Turns that process outside content get read-only tools; acting turns don't see raw outside content, or their tool calls need approval the content can't grant. Validate outbound URLs (scheme, host, private address ranges) in code. 4. The blast radius is root in the container Mechanism. Even a well-gated agent will eventually run something it shouldn't. What it can reach then decides whether that's a nuisance or a breach. Evidence. "The container has no USER directive, so successful execution runs as uid=0(root)." The related CVE-2026-114106 shows the same release could read /proc/self/environ, which is where API keys in environment variables live. What fixes it. Run as a non-root user, keep secrets out of the agent's environment, and limit outbound network access to what the workflow needs. How this connects to other agent tool bugs Recent approval-gate bugs had a gate that checked too little, or a gate that went silent on headless surfaces. This one never had a gate. Same lesson, simplest form: if the only thing between untrusted text and a shell is the model's opinion, the attacker is the one with the shell. Defensive takeaways you can check this week - Upgrade. If you run Vibe-Trading 0.1.0 through 0.1.6, move to 0.1.7, per the GitHub advisory. - Rotate if exposed. If an affected version read outside documents or URLs, or its port was reachable by others, rotate the LLM and data-provider keys in its environment and review its shell history and outbound traffic. - Inventory your own agents' shell tools. Search for shell=True and equivalents reachable from a model tool call. For each, ask whether it's registered by default and what code, not prompt, stands in front of it. - Gate outbound fetches. Any "read this URL" tool should reject non-HTTP schemes and private, loopback and link-local addresses before it fetches. - Drop root. Add a non-root USER to agent containers and keep long-lived secrets out of their environment. - Test the injection path. Add a test that feeds the agent a document containing an instruction to call its shell tool and asserts the call is refused, not just that the model "usually ignores it." Sources - NVD entry for CVE-2026-114107 - VulnCheck advisory - Vibe-Trading GitHub advisory GHSA-jqmf-mx4f-hfr6 - NVD entry for CVE-2026-114106 --- If you're building agent backends and want a checklist for this kind of trust boundary, the Trust Boundary pack covers it. This article was drafted with AI assistance and edited by a human. All facts come from the advisories and CVE record linked above.
5 Free GitHub Repos That Replace a $30K Wall Street Terminal #wallstreet #daytrading Wall Street pays ~$30K a year for tools like these. All 5 are free and open source. 01 OpenBB (free data platform): OpenBB-finance/OpenBB 02 FinceptTerminal (Bloomberg-style terminal): Fincept-Corporation/FinceptTerminal 03 Vibe-Trading (AI quant agent): HKUDS/Vibe-Trading 04 QuantConnect Lean (pro backtester): QuantConnect/Lean 05 My 2 NQ strategies: dropping soon. Subscribe so you don't miss them. Learn to day trade NQ step by step: artillerytrades.gumroad.com Educational only, not financial advice. Futures trading involves substantial risk of loss. #shorts #daytrading #nasdaq #futurestrading #algotrading #github #quant #tradingview