Efi Rand

Building 📊 | 90+ Bubble plugins | 15K+ MRR from no-code | Israel no-code community leader |

[Efi Rand @EfiRand]

Most multi-agent stacks I see have a critical blind spot:

The audit log can't tell you which agent did what.

If one of your agents' OAuth tokens leaks tonight, every call will show "token valid, call succeeded." The legitimate ones. The attacker's. Identical.

Your CISO will catch this in five minutes. Your auditors in five days. The attacker in zero.

We built the fix.

CloudSignal. Identity-bound MQTT for AI agents. Every publish carries the agent's claim, broker-enforced. The audit log answers "who", by construction.

24-second walkthrough below.

https://t.co/iPt1guvRSj · open spec: https://t.co/2hzFJFqJkA

[Efi Rand @EfiRand]

Is your app powered by Next.js? Stop and check this.

CVE-2026-44578 dropped this week. CVSS 8.6. WebSocket Upgrade SSRF, unauthenticated, self-hosted instances only.

A crafted Upgrade header lets attackers reach internal services, cloud metadata, admin panels - anything your Next.js server can touch.

This is what you inherit when your agent stack runs over HTTP and WebSockets. A2A, custom WS handlers, tool calls routed through Next.js endpoints - one CVE at the web tier and your whole agent pipeline is exposed.

MQTT.Agent takes a different angle. Agents publish to claim-bound topics. The broker enforces who can write where before any app code runs.
No URLs to forge. Different attack surface entirely.

Specs have bugs too. This just removes a whole class of them from the equation.

Check your version. If you're on an affected one, upgrade today.
https://t.co/2hzFJFqJkA

[Efi Rand @EfiRand]

Just published an open spec for security and connectivity in multi-agent systems: https://t.co/2hzFJFqJkA

Orchestrated multi-agent systems are taking over. The debate is about which topology wins - nano claw, paperclip, claude agents.

But the moment teams try to ship this to production, security blocks adoption.

The problems stem from the near-unlimited autonomy agents get to act and talk to each other. They speak MCP and A2A to exchange data and invoke tools, but those protocols don't handle the critical parts: authentication, identity verification, integration with enterprise IdPs, recovery from network failures, offline tolerance, session resume.

I got to this conclusion building CloudSignal - my real-time messaging platform built on MQTT. Customers started running multi-agent systems on top of it, and it became obvious that MQTT 5 already solves most of these problems.

It was designed from day one for IoT at scale: millions of devices with per-device identity, broker-level ACLs, offline durability, session resume, QoS. The requirements coming out of agent systems map almost 1:1 to what MQTT was built for.

The spec takes those primitives and adapts them to the agent world:

• Per-agent identity via multi-provider JWT (Auth0, Clerk, Cognito, Keycloak, or bring your own)
• Wire-level enforcement - agent-a cannot impersonate agent-b
• Offline tolerance and task recovery in the transport
• Tool calls (MCP) and agent-to-agent (A2A) on one wire
• Working SDKs on npm, MIT, today
• Broker-agnostic, spec is open (CC-BY-4.0)

SDKs run against any compliant broker - Mosquitto, EMQX, HiveMQ, NanoMQ, self-host or managed. CloudSignal is one managed option with enterprise auth built in.

If you're shipping multi-agent systems and hitting the security wall, take a look:
https://t.co/2hzFJFqJkA

Feedback welcome.

[Efi Rand @EfiRand]

Quick demo of @cloudsignal/collaborate in action

[Efi Rand @EfiRand]

Building real-time features in @lovable, @v0, or @base44_ shouldn't mean writing a WebSocket server.
We shipped 3 drop-in npm packages. Live cursors, presence, push notifications, offline delivery. No backend code.
Sub-10ms latency. MQTT under the hood.

[Efi Rand @EfiRand]

@moshe_primo פרימו, זה שאתה מטומטם כבר יודעים, למה אתה מתעקש להוכיח את זה כל פעם מחדש?

[Efi Rand @EfiRand]

@urieli17 עוד לא שם.
אין דרך לראות קבצים , אין צפיה ברמת פרוייקט. העבודה בין סשנים לא מופרדת כראוי.
פשוט לא

[Efi Rand @EfiRand]

@tiktokperiferia זה צבא לבנון או מצריים?

[Efi Rand @EfiRand]

@warpdotdev You mean , keep the issues recurring.. It could’ve been such a great product.

[Efi Rand @EfiRand]

@Amalia_Ozer נשמע שאבא שלו עבריין כמו שאתם אוהבים אצלכם, את יודעת , כאלה עם סמרטוט ראש שמבריחים סיגריות לעזתיים שמגיעים לחמאס. אז מה מפריע לכם?

[Efi Rand @EfiRand]

Most apps don’t really need to be on App Store. PWA is the way forward for most mobile versions

[Elon Musk @elonmusk]

iOS App Review delays are getting ridiculous

[Naor Narkis נאור נרקיס @NaorNarkis]

Raise your voice for the freedom of Israel's women.

@GilaGamliel
@limor_sonhrmelh
@iditsilman
@oritstrock
@netanyahu

[Efi Rand @EfiRand]

@tiktokperiferia זה גם חלק מ10 המצוות, חשוב לציין

[Efi Rand @EfiRand]

@attilus כמה שאתה מטומטם , הבושה של העליה הרומנית

[Efi Rand @EfiRand]

@srishticodes Any one who worked with Claude code knows this is bullshit and has almost no impact on the quality of the delivery. Just know your stack and apply specific rules and methodologies for it. That’s how real ai engineering works

[rwlk @sherlock_hodles]

I am writing an article about elderly vibecoders

If you are coding AI agents and are over 24 please DM me

[Efi Rand @EfiRand]

@vankempter @george_nqu What worked for us (4 apps now) , all at once. Migration path should be how to steer users off gradually.

[Efi Rand @EfiRand]

@asafsagi @TheSharkLady ממש לא נכון. כנס לאינסטגרם ותראה את הסרטוני חתולים. זו הסיבה האמיתית