This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Light signalVersion v0.30.4 eliminates manual credential handling code and updates documentation to accurately describe proxy configuration's effect on Polymarket egress as well as EOA mode's diagnostic role.
Why it matters: The removal of manual credential code simplifies setup, while clarified proxy behavior prevents misconfiguration; these changes affect all users upgrading to v0.30.4.
Summary
AI summaryRemoved manual credential code and clarified proxy vs egress handling.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Clarified that proxy configuration does not alter Polymarket egress behavior. Clarified that proxy configuration does not alter Polymarket egress behavior. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Corrected framing of EOA mode as diagnostic fallback, noting possible CLOB rejection. Corrected framing of EOA mode as diagnostic fallback, noting possible CLOB rejection. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Qualified signer-key custody claims, specifying default and precedence rules. Qualified signer-key custody claims, specifying default and precedence rules. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Refactor | Low |
Removed manual credential code for relayer setup. Removed manual credential code for relayer setup. Source: llm_adapter@2026-07-14 Confidence: high |
— |
Full changelog
A two-round multi-agent audit of the polymarket-trading skill against the implementation (69 claims verified, every finding adversarially re-checked) surfaced 24 stale or contradictory statements left behind by the 0.30.0 builder-key-bootstrap and 0.30.3 Finland-egress transitions. All fixed:
- Tool description no longer demands
POLYMARKET_RELAYER_API_KEY/_SECRET/_PASSPHRASE(creds are auto-bootstrapped from the wallet key since 0.30.0) and states the Finland-egress geoblock default. - Dead manual-creds code deleted (-77 lines):
relayerCredsMissing(), the unreachable "get relayer creds" setup branch,deriveDepositWalletNoCreds(), unusedRelayerCredsenv config. - Proxy ≠ egress, consistently: every surface (403 error, setup region line, skill, README, setup guide) now leads with the
POLYMARKET_CLOB_HOSTrepoint and states that a proxy alone doesn't change the Polymarket-facing egress. - EOA mode (
POLYMARKET_SIG_TYPE=0) honestly framed as a diagnostic fallback — the CLOB may reject plain-EOA makers (removes the contradictory "read-only for orders" claim). - Signer-key custody claims qualified:
~/.blockrun/.sessionis the default;BLOCKRUN_WALLET_KEYor an agentwallet.jsontakes precedence — backup notes now point at the key behind the signer addresssetupprints. README env table gains the missingBLOCKRUN_WALLET_KEYrow.
150 tests, typecheck, build, stdio smoke (19 tools) green. No behavior change to trading paths.
Breaking Changes
- Removed requirement for POLYMARKET_RELAYER_API_KEY, _SECRET, and _PASSPHRASE environment variables; credentials are now auto-bootstrapped from the wallet key.
- Deleted dead manual-creds code paths: relayerCredsMissing(), unreachable 'get relayer creds' branch, deriveDepositWalletNoCreds(), and unused RelayerCreds env config.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About blockrunai/blockrun-mcp
Live data for AI agents — search, research, markets, crypto, X/Twitter. Pay-per-call via x402 micropayments.
Related context
Beta — feedback welcome: [email protected]