
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
pmwallets
Advanced tools
Official PMWallets SDK and CLI: Polymarket smart-money leaderboard, real-time wallet fills over WebSocket with gap replay, webhooks, exports — and a CLI + MCP server so AI agents (Claude Code, Codex, Cursor, …) can follow traders and act on their fills.
Official Python client for PMWallets: the Polymarket smart-money leaderboard computed from the Polygon chain, and the real-time fills of the Polymarket wallets you follow — delivered in order, exactly once, with every gap replayed.
中文说明 · Node.js SDK: pmwallets-node · Ready-to-run copy-trading bot built on it: polymarket-copy-trading-bot-python
pip install pmwallets # Python ≥ 3.10
Create an API key on pmwallets.com/keys.
import asyncio
from pmwallets import AsyncClient, Client, FillStream, FileStateStore
# synchronous REST
with Client(api_key="pmw_...") as pmw:
board = pmw.leaderboard(minWinLo=0.55, minEligible=30, style="taker", status="active", limit=50)
cheap = pmw.leaderboard(bands=[0, 1], minWinLo=0.55) # address unlocks free or in the $1 band (0 = free ... 5)
pmw.subscribe(board["rows"][0]["entityId"], channels=["ws"]) # billed per entity per hour
# every fill of every entity you follow
async def main():
async with AsyncClient(api_key="pmw_...") as pmw:
stream = FillStream(
client=pmw,
store=FileStateStore("stream.json"), # a restart resumes exactly where it stopped
on_fill=lambda fill, meta: print(meta.source, fill["side"], fill["price"], fill["tokenId"]),
on_event=lambda e: e["type"] == "fatal" and print(e["error"]), # e.g. another bot already holds the stream
# takeover=True, # replace whichever API client holds this account's stream (it stops with "replaced")
)
await stream.run()
asyncio.run(main())
Client / AsyncClient | leaderboard, entities, address unlocks (balance or plan), your unlocked addresses (my_addresses), plan and balance, subscriptions, webhook status and deliveries, fills replay (fills, fills_since), trade-history exports |
FillStream | asyncio WebSocket with reconnect and keep-alive; detects missed frames by session/seq and replays them from the last fill delivered; de-duplicates by eventId; anchors behind the chain head on first start; persisted cursor |
verify_webhook(raw_body, signature, secret) | checks x-pmw-signature (HMAC-SHA256 of the raw body) |
One stream per account:
blocked, then fatal, and the stream stops. Pass takeover=True to replace the holder instead; the holder gets replaced, then fatal, and stops (it does not fight back).FillStream identifies itself with a random client_id, so its own reconnects after a network drop replace its own dead connection without needing takeover.1012; the stream reconnects at once (event restarting) and replays anything it missed.HTTPS_PROXY is honoured.
PMWallets' servers are in the United Kingdom. A consumer that also trades on Polymarket should run from Ireland (AWS eu-west-1): Polymarket does not accept API orders from the UK, the US and several EU countries.
The package installs a pmwallets command that prints JSON — for scripts, and for AI agents (Claude Code, Codex,
Gemini CLI, Cursor, WorkBuddy, …) that act on the fills of the traders you follow.
export PMW_API_KEY=pmw_…
pmwallets leaderboard --minWinLo 0.55 --category politics --limit 20
pmwallets subscribe <handle> # billed per hour
pmwallets new-fills # fills since the previous call, each once (poll it)
pmwallets watch # live: one JSON line per fill, with its market and decimal amounts
pmwallets watch --batch-sec 30 --exec 'claude -p "Fills from traders I follow are on stdin. …"'
pmwallets mcp # the same as MCP tools
pmwallets skill # the guide to give your agent (SKILL.md)
watch --exec runs the command once per batch, the fills on its stdin as JSON lines (and in $PMW_BATCH_FILE);
fills that arrive while it runs make the next batch. A batch is handed over at most once: one whose command
fails, times out or is interrupted is kept in pmw-watch/failed/ and never re-run — the agent may already have
placed an order. Restarts resume from where the stream stopped.order buy <tokenId> --usdc 5 --key <eventId> (the same key never orders twice), market, balance, positions.{"command": "uvx", "args": ["pmwallets", "mcp"], "env": {"PMW_API_KEY": "pmw_…"}}.HTTPS_PROXY / NO_PROXY are honoured by the command line.Watcher, MarketLookup, serve_mcp / McpTool, pmwallets_tools.A purchase is access to files: one zstd-compressed CSV per wallet per UTC day, downloadable at once and again later.
order = client.create_export(["0x…"], "2026-09-01", "2026-09-30")
for f in client.export_files(order["id"])["files"]:
data = client.download_export_file(f["wallet"], f["day"]) # .csv.zst
# pandas: pd.read_csv(io.BytesIO(data), compression="zstd")
export_file_url(wallet, day) returns the short-lived link instead; the API key is never sent to the storage host.
Guides
MIT
FAQs
Official PMWallets SDK and CLI: Polymarket smart-money leaderboard, real-time wallet fills over WebSocket with gap replay, webhooks, exports — and a CLI + MCP server so AI agents (Claude Code, Codex, Cursor, …) can follow traders and act on their fills.
We found that pmwallets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.