@offrouter/mcp 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OffRouter
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,111 @@
-# Temporary Holding Version
+# OffRouter MCP
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An MCP server for [OffRouter](https://offrouter.org), private inference for agents.
+
+Every model on OffRouter runs inside a GPU TEE (Intel TDX plus an NVIDIA confidential GPU). Nothing is cached or logged, and every answer comes back with a signed receipt. This server goes one step further: it encrypts your prompt on your own machine, to a key the enclave proves it holds, before anything goes over the network. OffRouter's gateway sits in the middle and only ever sees ciphertext.
+
+That is the main reason to run this locally instead of using the hosted endpoint at `https://offrouter.org/mcp`. A remote MCP server has to read your prompt to build the request. This one never sends it in the clear.
+
+## Quick start
+
+You don't need an account to try it. With no configuration it uses OffRouter's free demo (one model, a few calls a day).
+
+**Claude Code**
+
+```bash
+claude mcp add offrouter -- npx -y @offrouter/mcp
+```
+
+**Claude Desktop, Cursor, Windsurf and other clients**
+
+```json
+{
+  "mcpServers": {
+    "offrouter": {
+      "command": "npx",
+      "args": ["-y", "@offrouter/mcp"],
+      "env": {
+        "OFFROUTER_API_KEY": "off_sk_..."
+      }
+    }
+  }
+}
+```
+
+Then ask your agent something like "use offrouter to verify the enclave" or "ask deepseek-v4-flash on offrouter to review this contract".
+
+**Nothing to install.** If you'd rather not run anything locally, add the hosted server at `https://offrouter.org/mcp` with your key as an `Authorization: Bearer off_sk_...` header. It has the same models, but your prompt reaches the gateway in the clear, and it can't pay per call from a wallet.
+
+## Three ways to pay
+
+Pick one by setting an environment variable. If you set both, the key is used.
+
+| Setup | How it pays | Good for |
+| --- | --- | --- |
+| nothing | Free demo, limited to one model and 5 calls a day | Trying it out |
+| `OFFROUTER_API_KEY` | A prepaid key, billed per token | Everyday use |
+| `OFFROUTER_WALLET_KEY` | Pay per call with x402 from your own wallet | Agents that hold their own funds |
+
+**Prepaid key.** Sign in with a wallet at [offrouter.org/dashboard](https://offrouter.org/dashboard), fund a key, and copy the `off_sk_...` value. Each call is charged the exact token cost.
+
+**Wallet.** Every call is paid on its own with a signed USDC transfer on Base, or USDG on Robinhood Chain. The private key stays in this process and is only used to sign the payment. OffRouter quotes each call as a ceiling (your whole input plus `max_tokens` of output) and refunds the unused part to the same wallet afterwards. This server won't sign anything above `OFFROUTER_MAX_USD`, whatever the server asks for. Use a dedicated wallet with a small balance, not your main one.
+
+## Configuration
+
+| Variable | Default | What it does |
+| --- | --- | --- |
+| `OFFROUTER_API_KEY` | | Prepaid key, starts with `off_sk_` |
+| `OFFROUTER_WALLET_KEY` | | Private key of a wallet to pay per call from |
+| `OFFROUTER_MAX_USD` | `0.10` | Most a single wallet payment can be, in USD |
+| `OFFROUTER_NETWORK` | both | Only pay on `base` or only on `robinhood` |
+| `OFFROUTER_MAX_TOKENS` | `2048` | Output budget when the agent doesn't set one |
+| `OFFROUTER_E2EE` | `on` | Set to `off` to send prompts to the gateway in the clear |
+| `OFFROUTER_BASE_URL` | `https://offrouter.org` | API to talk to |
+
+## Tools
+
+- **list_models** lists the models with context length and price per million tokens.
+- **ask** sends a prompt to one model and returns the answer, what it cost, and a link to its signed receipt.
+- **compare** runs the same prompt on 2 to 4 models in parallel, so you can see the answers and costs side by side.
+- **account** shows the key balance and recent spend, the wallet address and cap, or what's left on the demo.
+- **verify_enclave** checks the enclave from your machine right now and shows the key your prompts are encrypted to.
+- **list_agents** lists the agents published on [OffRouter Studio](https://offrouter.org/studio): what each does, its model, how its runs have gone and whether it has a ready standing. Filter by a search term or to ready agents only.
+- **get_agent** shows one Studio agent in full: its example tasks, latest evaluation, wallet and config hash.
+
+The same calls are on the client, `listAgents()` and `getAgent(id)`, and need no key or wallet: the Studio directory is public.
+
+## How the encryption works
+
+Before the first call, the server fetches an attestation report for a random nonce it just generated and checks it with the enclave gateway's reference verifier:
+
+1. The Intel TDX quote verifies all the way up to Intel's root certificate.
+2. The report covers our nonce, so it was made just now and is not a replay, and it binds the enclave's key set.
+3. The boot log replays to the measured launch file, which pins the open source [enclave gateway](https://github.com/Dstack-TEE/private-ai-gateway) at a specific commit.
+
+If any of these fail, nothing is sent. If they pass, each message is encrypted to the enclave's X25519 key (HKDF-SHA256, then AES-256-GCM, with a fresh ephemeral key for every field). Each ciphertext is bound to the request's nonce and timestamp and to the model, so it can't be replayed or redirected to a different model. The answer comes back encrypted to a one-time key this server made for that request, and it's decrypted here. If the answer doesn't decrypt, it wasn't made by the enclave for your request, and the server throws it away.
+
+The verified key is cached until shortly before it expires. If the enclave rejects a request, usually because its key rotated, the server checks the enclave again and retries once.
+
+## What stays visible
+
+To be clear about what this does and doesn't hide:
+
+- The gateway can't read your messages or the answers.
+- The gateway still sees which model you picked, settings like `max_tokens` and `temperature`, the size of the ciphertext, the token counts the enclave reports, timing, your IP address, and who paid.
+- With a wallet, the payment itself is a normal onchain transfer, so it's public.
+- Your MCP client (Claude, Cursor and so on) sees the prompt and the answer, because that's where they come from and go to. This server protects the hop from your machine to the model.
+
+## Development
+
+```bash
+npm install
+npm test
+npm run build
+OFFROUTER_API_KEY=off_sk_... npm run dev
+```
+
+Requires Node 20 or newer.
+
+## License
+
+MIT

package/dist/attest.js

@@ -0,0 +1,74 @@
+// Finds the enclave's encryption key without taking the gateway's word for it.
+//
+// We ask for an attestation report that covers a random nonce we just made up,
+// then check it with the enclave gateway's reference verifier: the Intel TDX
+// quote has to verify up to Intel's root, the report has to cover our nonce
+// and the key set, and the boot log has to replay to the measured launch file.
+// Only then do we use a key from it. A key from a report that fails any of
+// those could belong to anyone, including the gateway.
+import { verifyComposeMeasurement, verifyQuote, verifyReportBinding } from '@phala/aci-verifier';
+import { randomBytes } from 'node:crypto';
+import { chooseKey } from './e2ee.js';
+const failed = (checks) => checks
+    .filter((c) => !c.ok)
+    .map((c) => c.detail || c.name)
+    .join('; ');
+export class AttestationError extends Error {
+}
+export async function verifyEnclave(baseUrl) {
+    const nonce = randomBytes(32).toString('hex');
+    const res = await fetch(`${baseUrl}/v1/private/attestation?nonce=${nonce}`, { headers: { accept: 'application/json' } });
+    if (!res.ok)
+        throw new AttestationError(`the attestation endpoint answered ${res.status}`);
+    const report = (await res.json());
+    const quote = await verifyQuote(report);
+    if (!quote.ok)
+        throw new AttestationError(`the hardware quote did not verify: ${quote.detail || 'no reason given'}`);
+    const binding = await verifyReportBinding(report, nonce);
+    if (!binding.ok || !binding.keyset || !binding.workloadKeysetDigest) {
+        throw new AttestationError(`the report does not cover our nonce and key set: ${failed(binding.checks) || 'no key set bound'}`);
+    }
+    const code = await verifyComposeMeasurement(report);
+    if (!code.ok)
+        throw new AttestationError(`the boot measurement does not match: ${failed(code.checks) || 'no reason given'}`);
+    const keyset = binding.keyset;
+    if (keyset.not_after * 1000 < Date.now())
+        throw new AttestationError('the key set has expired');
+    const key = chooseKey(keyset.e2ee_public_keys);
+    if (!key)
+        throw new AttestationError('the enclave offers no encryption key this client supports');
+    const src = report.attestation.source_provenance;
+    const commit = typeof src?.repo_commit === 'string' && /^[0-9a-f]{40}$/.test(src.repo_commit) ? src.repo_commit : null;
+    const compose = String(report.attestation.evidence?.app_compose ?? '');
+    const pinned = commit && compose.includes(commit) ? commit : null;
+    const repo = typeof src?.repo_url === 'string' ? (/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+?(?=\.git$|$)/.exec(src.repo_url)?.[0] ?? null) : null;
+    return { key, keyset: binding.workloadKeysetDigest, notAfter: keyset.not_after, commit: pinned, repo, verifiedAt: Date.now() };
+}
+/**
+ * Keeps one verified enclave key around so we don't re-run the full check on
+ * every call. It is dropped when the key set is close to expiring, or when the
+ * enclave rejects a request (which usually means the key rotated).
+ */
+export class EnclaveCache {
+    baseUrl;
+    current = null;
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl;
+    }
+    get() {
+        if (this.current) {
+            return this.current.then((e) => (e.notAfter * 1000 - Date.now() > 60_000 ? e : this.refresh()));
+        }
+        return this.refresh();
+    }
+    refresh() {
+        const next = verifyEnclave(this.baseUrl);
+        this.current = next;
+        // A failed check should not stick around and poison later calls.
+        next.catch(() => {
+            if (this.current === next)
+                this.current = null;
+        });
+        return next;
+    }
+}

package/dist/client.js

@@ -0,0 +1,218 @@
+// Talks to the OffRouter API. One chat() call handles all three ways to pay
+// (prepaid key, wallet, free demo) and, when encryption is on, seals the
+// messages to the enclave before anything goes over the network.
+import { EnclaveCache } from './attest.js';
+import { encryptRequest } from './e2ee.js';
+import { makeWallet, settlement } from './pay.js';
+export class ApiError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+const MODELS_TTL_MS = 5 * 60_000;
+export class OffRouter {
+    config;
+    enclave;
+    wallet;
+    models = null;
+    constructor(config) {
+        this.config = config;
+        this.enclave = new EnclaveCache(config.baseUrl);
+        this.wallet = config.mode === 'wallet' ? makeWallet(config) : null;
+    }
+    async listModels() {
+        if (!this.models || Date.now() - this.models.at > MODELS_TTL_MS) {
+            const list = this.getJson('/v1/models').then((b) => (b.data ?? []).filter((m) => m.type !== 'image'));
+            this.models = { at: Date.now(), list };
+            list.catch(() => (this.models = null));
+        }
+        return this.models.list;
+    }
+    /** Balance and recent usage of the prepaid key. */
+    keyInfo() {
+        return this.getJson('/v1/keys/me', { authorization: `Bearer ${this.config.apiKey}` });
+    }
+    /** What the free demo allows and what this IP has left today. */
+    demoInfo() {
+        return this.getJson('/v1/demo');
+    }
+    /** The Studio directory: the newest agents first, closed ones left out. */
+    async listAgents() {
+        const b = await this.getJson('/v1/studio/agents');
+        return (b.agents ?? []);
+    }
+    /** One Studio agent's public view, with its examples and last evaluation. */
+    async getAgent(id) {
+        if (!/^0x[0-9a-fA-F]{32}$/.test(id))
+            throw new ApiError('An agent id is 0x followed by 32 hex characters.', 400, 'invalid_agent_id');
+        return this.getJson(`/v1/studio/agents/${id}/public`);
+    }
+    async chat(input) {
+        const messages = [];
+        if (input.system)
+            messages.push({ role: 'system', content: input.system });
+        messages.push({ role: 'user', content: input.prompt });
+        const { mode } = this.config;
+        const body = { model: input.model, messages };
+        if (mode !== 'demo') {
+            // Pay per call needs max_tokens, since the price is quoted as a ceiling. With a key it is optional,
+            // but we send our default anyway so a runaway answer can't drain the balance.
+            body.max_tokens = input.max_tokens ?? this.config.defaultMaxTokens;
+            if (typeof input.temperature === 'number')
+                body.temperature = input.temperature;
+        }
+        try {
+            return await this.send(input.model, body);
+        }
+        catch (e) {
+            // The enclave takes each nonce once and rejects ciphertext for a key it no longer holds. The usual
+            // cause is a rotated key, so check the enclave again and retry once with a fresh encryption.
+            if (e instanceof ApiError && e.code === 'e2ee_rejected' && this.config.e2ee) {
+                await this.enclave.refresh();
+                return this.send(input.model, body);
+            }
+            throw e;
+        }
+    }
+    async send(model, body) {
+        const { mode } = this.config;
+        const headers = { 'content-type': 'application/json' };
+        if (mode === 'key')
+            headers.authorization = `Bearer ${this.config.apiKey}`;
+        let session = null;
+        let payload = body;
+        if (this.config.e2ee) {
+            const entry = (await this.listModels()).find((m) => m.id === model);
+            if (!entry)
+                throw new ApiError(`There is no model called "${model}". Call list_models to see what is available.`, 404, 'model_not_found');
+            if (!entry.e2ee?.model)
+                throw new ApiError(`${model} does not support end to end encryption. Set OFFROUTER_E2EE=off to call it in the clear.`, 400);
+            const enclave = await this.enclave.get();
+            session = await encryptRequest(body, { key: enclave.key, model: entry.e2ee.model });
+            // Belt and braces: never send a request that still has the prompt in it.
+            const plain = body.messages.map((m) => m.content).filter((c) => c.length >= 8);
+            const wire = JSON.stringify(session.body);
+            if (plain.some((c) => wire.includes(c)))
+                throw new Error('Encryption did not apply, so the request was not sent.');
+            payload = session.body;
+            Object.assign(headers, session.headers);
+        }
+        const path = mode === 'demo' ? '/v1/demo/chat' : '/v1/chat/completions';
+        const doFetch = mode === 'wallet' ? this.wallet.fetch : fetch;
+        let res;
+        try {
+            res = await doFetch(`${this.config.baseUrl}${path}`, { method: 'POST', headers, body: JSON.stringify(payload) });
+        }
+        catch (e) {
+            const msg = e.message || String(e);
+            if (mode === 'wallet' && /spendControls|maxAmountPerPayment/.test(msg)) {
+                throw new Error(`Not paid: this call is quoted above the $${this.config.maxUsd} cap per call. Lower max_tokens or raise OFFROUTER_MAX_USD.`);
+            }
+            if (mode === 'wallet')
+                throw new Error(`Payment failed: ${msg.replace(/\.+$/, '')}.`);
+            throw e;
+        }
+        if (!res.ok) {
+            const err = await apiError(res);
+            if (mode === 'wallet' && res.status === 402) {
+                const why = /insufficient_balance/.test(err.message) ? 'it does not hold enough' : err.message.replace(/\.+$/, '');
+                throw new ApiError(`The wallet ${this.wallet.address} could not pay: ${why}. Fund it with USDC on Base or USDG on Robinhood Chain.`, 402, err.code);
+            }
+            throw err;
+        }
+        if (session && !session.applied(res.headers))
+            throw new Error('The enclave did not confirm it encrypted the answer, so it was not read.');
+        let text = '';
+        let promptTokens = 0;
+        let completionTokens = 0;
+        if (mode === 'demo') {
+            // The demo always streams.
+            const out = await readStream(res, session);
+            text = out.text;
+            promptTokens = out.usage?.prompt_tokens ?? 0;
+            completionTokens = out.usage?.completion_tokens ?? 0;
+        }
+        else {
+            let completion = await res.json();
+            if (session)
+                completion = await session.decryptCompletion(completion);
+            text = String(completion.choices?.[0]?.message?.content ?? '');
+            promptTokens = completion.usage?.prompt_tokens ?? 0;
+            completionTokens = completion.usage?.completion_tokens ?? 0;
+        }
+        const charge = res.headers.get('x-offrouter-charge-usd');
+        const remaining = res.headers.get('x-offrouter-demo-remaining');
+        return {
+            model,
+            text: text.trim(),
+            promptTokens,
+            completionTokens,
+            chargeUsd: charge == null ? null : Number(charge),
+            receiptUrl: res.headers.get('x-offrouter-receipt-url'),
+            encrypted: !!session,
+            paidWith: mode,
+            transaction: mode === 'wallet' ? settlement(res.headers)?.transaction : undefined,
+            demoRemaining: remaining == null ? undefined : Number(remaining),
+        };
+    }
+    async getJson(path, headers = {}) {
+        const res = await fetch(`${this.config.baseUrl}${path}`, { headers: { accept: 'application/json', ...headers } });
+        if (!res.ok)
+            throw await apiError(res);
+        return res.json();
+    }
+}
+async function apiError(res) {
+    const body = await res.json().catch(() => null);
+    const err = body?.error;
+    const message = (typeof err === 'string' ? err : err?.message) || `OffRouter answered ${res.status}.`;
+    return new ApiError(message, res.status, typeof err === 'object' ? err?.code : undefined);
+}
+/** Reads a server sent event stream of chat chunks, decrypting each one when the request was encrypted. */
+async function readStream(res, session) {
+    let text = '';
+    let usage = null;
+    let event = '';
+    let buf = '';
+    const decoder = new TextDecoder();
+    const handle = async (line) => {
+        if (line.startsWith('event:')) {
+            event = line.slice(6).trim();
+            return;
+        }
+        if (!line.startsWith('data:'))
+            return;
+        const data = line.slice(5).trim();
+        if (!data || data === '[DONE]')
+            return;
+        // Named events (offrouter.forwarded, offrouter.stored) are the gateway's own notes, not model output.
+        if (event) {
+            event = '';
+            return;
+        }
+        let chunk = JSON.parse(data);
+        if (chunk.error)
+            throw new ApiError(chunk.error.message ?? 'The stream ended with an error.', 502, chunk.error.code);
+        if (session)
+            chunk = await session.decryptChunk(chunk);
+        text += chunk.choices?.[0]?.delta?.content ?? '';
+        if (chunk.usage)
+            usage = chunk.usage;
+    };
+    for await (const part of res.body) {
+        buf += decoder.decode(part, { stream: true });
+        let nl;
+        while ((nl = buf.indexOf('\n')) !== -1) {
+            const line = buf.slice(0, nl).trim();
+            buf = buf.slice(nl + 1);
+            await handle(line);
+        }
+    }
+    if (buf.trim())
+        await handle(buf.trim());
+    return { text, usage };
+}

package/dist/config.js

@@ -0,0 +1,32 @@
+// Everything is configured through environment variables, so it fits in the
+// "env" block of any MCP client config.
+const off = (v) => !!v && ['0', 'false', 'off', 'no'].includes(v.trim().toLowerCase());
+export function loadConfig(env = process.env) {
+    const baseUrl = (env.OFFROUTER_BASE_URL || 'https://offrouter.org').replace(/\/+$/, '');
+    const apiKey = env.OFFROUTER_API_KEY?.trim() || undefined;
+    const walletKey = env.OFFROUTER_WALLET_KEY?.trim() || undefined;
+    if (apiKey && !apiKey.startsWith('off_sk_'))
+        throw new Error('OFFROUTER_API_KEY should start with off_sk_');
+    if (walletKey && !/^0x[0-9a-fA-F]{64}$/.test(walletKey))
+        throw new Error('OFFROUTER_WALLET_KEY should be a 0x prefixed 32 byte hex private key');
+    const maxUsd = env.OFFROUTER_MAX_USD ? Number(env.OFFROUTER_MAX_USD) : 0.1;
+    if (!Number.isFinite(maxUsd) || maxUsd <= 0)
+        throw new Error('OFFROUTER_MAX_USD should be a positive number, like 0.10');
+    const network = env.OFFROUTER_NETWORK?.trim().toLowerCase() || undefined;
+    if (network && network !== 'base' && network !== 'robinhood')
+        throw new Error('OFFROUTER_NETWORK should be base or robinhood');
+    const defaultMaxTokens = env.OFFROUTER_MAX_TOKENS ? Number(env.OFFROUTER_MAX_TOKENS) : 2048;
+    if (!Number.isInteger(defaultMaxTokens) || defaultMaxTokens < 1)
+        throw new Error('OFFROUTER_MAX_TOKENS should be a whole number');
+    return {
+        baseUrl,
+        // A key wins over a wallet if both are set: it is cheaper per call and never needs a signature.
+        mode: apiKey ? 'key' : walletKey ? 'wallet' : 'demo',
+        apiKey,
+        walletKey: walletKey,
+        maxUsd,
+        network: network,
+        defaultMaxTokens,
+        e2ee: !off(env.OFFROUTER_E2EE),
+    };
+}

package/dist/e2ee.js

@@ -0,0 +1,194 @@
+// Client side of end-to-end encryption to the enclave. It encrypts the content
+// of each message to a key that the enclave's attestation report vouches for,
+// and decrypts the answer with a throwaway key made for that one request. The
+// OffRouter gateway in the middle only ever sees ciphertext.
+//
+// This file is just the cryptography. It trusts whatever key it is given, so
+// only hand it a key from a report you verified yourself (see attest.ts).
+//
+// Wire format is "E2EE v2" from the enclave gateway. For every encrypted
+// field: a fresh ephemeral key, ECDH with the recipient's key, HKDF-SHA256 to
+// an AES-256-GCM key, and the field's position in the request bound in as
+// associated data:
+//   hex( ephemeral_public_key || nonce (12) || ciphertext || tag (16) )
+import { x25519 } from '@noble/curves/ed25519';
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { hkdf } from '@noble/hashes/hkdf';
+import { sha256 } from '@noble/hashes/sha2';
+export class E2eeError extends Error {
+}
+const hex = (bytes) => [...bytes].map((b) => b.toString(16).padStart(2, '0')).join('');
+function unhex(text) {
+    const s = text.replace(/^0x/, '');
+    if (s.length % 2 || !/^[0-9a-fA-F]*$/.test(s))
+        throw new E2eeError('not hex');
+    return Uint8Array.from(s.match(/../g) ?? [], (b) => parseInt(b, 16));
+}
+const utf8 = new TextEncoder();
+const text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false });
+const SUITES = [
+    {
+        algo: 'x25519-aes-256-gcm-hkdf-sha256',
+        info: 'aci.e2ee.v2.x25519',
+        publicLength: 32,
+        keypair() {
+            const secret = x25519.utils.randomPrivateKey();
+            return { secret, public: x25519.getPublicKey(secret) };
+        },
+        shared: (secret, peer) => x25519.getSharedSecret(secret, peer),
+        parse(publicKey) {
+            const bytes = unhex(publicKey);
+            if (bytes.length !== 32)
+                throw new E2eeError('an X25519 public key is 32 bytes');
+            return bytes;
+        },
+    },
+    {
+        algo: 'secp256k1-aes-256-gcm-hkdf-sha256',
+        info: 'aci.e2ee.v2.secp256k1',
+        publicLength: 65,
+        keypair() {
+            const secret = secp256k1.utils.randomPrivateKey();
+            return { secret, public: secp256k1.getPublicKey(secret, false) };
+        },
+        // The x coordinate of the shared point.
+        shared: (secret, peer) => secp256k1.getSharedSecret(secret, peer, false).slice(1, 33),
+        parse(publicKey) {
+            const bytes = unhex(publicKey);
+            // 64 bytes is the same key without its 0x04 prefix.
+            if (bytes.length === 64)
+                return Uint8Array.from([4, ...bytes]);
+            if (bytes.length !== 65 || bytes[0] !== 4)
+                throw new E2eeError('a secp256k1 public key is 65 bytes, uncompressed');
+            return bytes;
+        },
+    },
+];
+/** The key to encrypt to, out of the ones a report offers: X25519 when it is there. Null when none is usable. */
+export function chooseKey(keys) {
+    for (const suite of SUITES) {
+        const key = keys?.find((k) => k?.algo === suite.algo && typeof k.public_key === 'string');
+        if (key)
+            return key;
+    }
+    return null;
+}
+const aesKey = (suite, shared, usage) => crypto.subtle.importKey('raw', Uint8Array.from(hkdf(sha256, shared, undefined, suite.info, 32)), 'AES-GCM', false, [usage]);
+async function seal(suite, recipient, plaintext, aad) {
+    const ephemeral = suite.keypair();
+    const nonce = crypto.getRandomValues(new Uint8Array(12));
+    const key = await aesKey(suite, suite.shared(ephemeral.secret, recipient), 'encrypt');
+    const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: utf8.encode(aad) }, key, utf8.encode(plaintext)));
+    return hex(Uint8Array.from([...ephemeral.public, ...nonce, ...sealed]));
+}
+async function open(suite, secret, ciphertext, aad) {
+    const bytes = unhex(ciphertext);
+    if (bytes.length < suite.publicLength + 12 + 16)
+        throw new E2eeError('too short to be a ciphertext');
+    const ephemeral = bytes.slice(0, suite.publicLength);
+    const nonce = bytes.slice(suite.publicLength, suite.publicLength + 12);
+    const key = await aesKey(suite, suite.shared(secret, ephemeral), 'decrypt');
+    return text.decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, additionalData: utf8.encode(aad) }, key, bytes.slice(suite.publicLength + 12)));
+}
+// The associated data is canonical JSON (RFC 8785). For these values that is JSON.stringify with the members in
+// alphabetical order, which is the order they are written in here.
+const requestAad = (algo, field, model, nonce, ts) => JSON.stringify({ algo, field, model, nonce, purpose: 'aci.e2ee.request.v2', ts });
+const responseAad = (algo, field, id, model, nonce, ts) => JSON.stringify({ algo, field, id, model, nonce, purpose: 'aci.e2ee.response.v2', ts });
+// What the enclave encrypts in an answer, under `choices.{i}.message` or `choices.{i}.delta`.
+const ANSWER_FIELDS = ['content', 'reasoning', 'reasoning_content'];
+/**
+ * Encrypt a chat request to the enclave.
+ *
+ * `key` is the enclave's key, from a verified attestation report. `model` is
+ * the model's name as the enclave knows it (`e2ee.model` in GET /v1/models):
+ * every ciphertext is bound to it, so a request encrypted for one model cannot
+ * be served by another. `body.model` stays the id you would normally send.
+ *
+ * What is encrypted: the `content` of every message, as a string or as a
+ * whole array of parts. What is not: the model, `max_tokens` and the other
+ * settings, tool definitions, and the arguments of tool calls.
+ *
+ * A session is for one request. To retry, encrypt again: the enclave takes
+ * each nonce once.
+ */
+export async function encryptRequest(body, opts) {
+    const suite = SUITES.find((s) => s.algo === opts.key?.algo);
+    if (!suite)
+        throw new E2eeError(`no support for the key type ${JSON.stringify(opts.key?.algo)}`);
+    if (!body || !Array.isArray(body.messages))
+        throw new E2eeError('`messages` is required');
+    if (typeof opts.model !== 'string' || !opts.model)
+        throw new E2eeError('the model\'s `e2ee.model` name is required');
+    const service = suite.parse(opts.key.public_key);
+    const client = suite.keypair();
+    const nonce = hex(crypto.getRandomValues(new Uint8Array(32)));
+    const ts = Math.floor((opts.now ?? Date.now()) / 1000);
+    let sealedAny = false;
+    const messages = await Promise.all(body.messages.map(async (m, i) => {
+        if (!m || m.content == null)
+            return m;
+        // An array of parts is encrypted whole, as its JSON.
+        const plaintext = typeof m.content === 'string' ? m.content : JSON.stringify(m.content);
+        sealedAny = true;
+        return { ...m, content: await seal(suite, service, plaintext, requestAad(suite.algo, `messages.${i}.content`, opts.model, nonce, ts)) };
+    }));
+    if (!sealedAny)
+        throw new E2eeError('no message has any content to encrypt');
+    const openField = async (value, field, id) => {
+        if (typeof value !== 'string' || value === '')
+            return value;
+        try {
+            return await open(suite, client.secret, value, responseAad(suite.algo, field, typeof id === 'string' ? id : '', opts.model, nonce, ts));
+        }
+        catch {
+            throw new E2eeError(`the answer's ${field} did not decrypt with this request's key: it was not made by the enclave for this request`);
+        }
+    };
+    const openChoices = async (response, part) => {
+        if (!response || !Array.isArray(response.choices))
+            return response;
+        const choices = await Promise.all(response.choices.map(async (choice) => {
+            const inner = choice?.[part];
+            if (!inner || typeof inner !== 'object')
+                return choice;
+            const opened = { ...inner };
+            // The field path names the choice by its own index, which a stream carries on each chunk.
+            const index = Number.isInteger(choice.index) ? choice.index : response.choices.indexOf(choice);
+            for (const name of ANSWER_FIELDS)
+                if (name in inner)
+                    opened[name] = await openField(inner[name], `choices.${index}.${part}.${name}`, response.id);
+            return { ...choice, [part]: opened };
+        }));
+        return { ...response, choices };
+    };
+    return {
+        body: { ...body, messages },
+        headers: {
+            'X-E2EE-Version': '2',
+            'X-Client-Pub-Key': hex(client.public),
+            'X-Model-Pub-Key': hex(service),
+            'X-E2EE-Nonce': nonce,
+            'X-E2EE-Timestamp': String(ts),
+        },
+        applied: (headers) => headers.get('x-e2ee-applied') === 'true',
+        decryptCompletion: (completion) => openChoices(completion, 'message'),
+        decryptChunk: (chunk) => openChoices(chunk, 'delta'),
+    };
+}
+/** The enclave's side, for tests and for anything that plays the enclave: open a request field, seal an answer field. */
+export const enclave = {
+    openRequestField(algo, secret, ciphertext, field, model, nonce, ts) {
+        const suite = SUITES.find((s) => s.algo === algo);
+        return open(suite, secret, ciphertext, requestAad(algo, field, model, nonce, ts));
+    },
+    sealAnswerField(algo, clientPublic, plaintext, field, id, model, nonce, ts) {
+        const suite = SUITES.find((s) => s.algo === algo);
+        return seal(suite, suite.parse(clientPublic), plaintext, responseAad(algo, field, id, model, nonce, ts));
+    },
+    keypair(algo) {
+        const pair = SUITES.find((s) => s.algo === algo).keypair();
+        return { secret: pair.secret, public: hex(pair.public) };
+    },
+    requestAad,
+    responseAad,
+};

package/dist/index.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { OffRouter } from './client.js';
+import { loadConfig } from './config.js';
+import { createServer } from './server.js';
+async function main() {
+    const config = loadConfig();
+    const api = new OffRouter(config);
+    const server = createServer(api);
+    await server.connect(new StdioServerTransport());
+    // stdout belongs to the protocol, so anything for humans goes to stderr.
+    const how = config.mode === 'wallet' ? `wallet ${api.wallet.address}` : config.mode === 'key' ? 'prepaid key' : 'free demo';
+    console.error(`offrouter mcp ${config.baseUrl} · paying with ${how} · e2ee ${config.e2ee ? 'on' : 'off'}`);
+}
+main().catch((e) => {
+    console.error(`offrouter mcp: ${e.message}`);
+    process.exit(1);
+});

package/dist/pay.js

@@ -0,0 +1,49 @@
+// Pay per call with x402, signed by your own wallet on this machine. The
+// private key never leaves the process: it signs an EIP-3009 transfer for the
+// exact amount the server quotes, and we refuse to sign anything above
+// OFFROUTER_MAX_USD no matter what the server asks for.
+//
+// OffRouter quotes a ceiling (your full input plus max_tokens of output) and
+// refunds the unused part to the paying wallet after the call.
+import { x402Client, wrapFetchWithPayment } from '@x402/fetch';
+import { ExactEvmScheme } from '@x402/evm/exact/client';
+import { privateKeyToAccount } from 'viem/accounts';
+// Chains where a plain EIP-3009 signature settles. Arc is left out on purpose:
+// OffRouter takes Arc payments through Circle Gateway, which needs a Gateway
+// balance rather than a wallet signature. The server only ever offers its own
+// environment, so listing testnets here is harmless on mainnet and vice versa.
+const CHAINS = [
+    { id: 'base', caip2: 'eip155:8453', asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913' },
+    { id: 'base', caip2: 'eip155:84532', asset: '0x036CbD53842c5426634e7929541eC2318f3dCF7e' },
+    { id: 'robinhood', caip2: 'eip155:4663', asset: '0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168' },
+    { id: 'robinhood', caip2: 'eip155:46630', asset: '0x7E955252E15c84f5768B83c41a71F9eba181802F' },
+];
+export function makeWallet(config) {
+    const account = privateKeyToAccount(config.walletKey);
+    const chains = CHAINS.filter((c) => !config.network || c.id === config.network);
+    const cap = String(Math.round(config.maxUsd * 1e6));
+    const client = x402Client.fromConfig({
+        schemes: chains.map((c) => ({ network: c.caip2, client: new ExactEvmScheme(account) })),
+        spendControls: {
+            maxAmountPerPayment: `$${config.maxUsd}`,
+            allowedAssets: chains.map((c) => ({ network: c.caip2, asset: c.asset, maxAmountPerPayment: cap })),
+        },
+    });
+    return {
+        address: account.address,
+        fetch: wrapFetchWithPayment(fetch, client),
+        chains: [...new Set(chains.map((c) => c.id))],
+    };
+}
+/** The settlement transaction from a PAYMENT-RESPONSE header, if there is one. */
+export function settlement(headers) {
+    const raw = headers.get('payment-response');
+    if (!raw)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(raw, 'base64').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}

package/dist/server.js

@@ -0,0 +1,243 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+export const VERSION = '0.1.0';
+const MAX_COMPARE = 4;
+const text = (t) => ({ content: [{ type: 'text', text: t }] });
+const fail = (t) => ({ content: [{ type: 'text', text: t }], isError: true });
+// Enough digits for sub-cent charges, without the trailing zeros.
+const usd = (n) => '$' + ((Number(n) || 0).toFixed(6).replace(/\.?0+$/, '') || '0');
+function footer(r) {
+    const parts = [r.model, `${r.promptTokens} in / ${r.completionTokens} out tokens`];
+    if (r.paidWith === 'demo')
+        parts.push(`free demo${r.demoRemaining != null ? `, ${r.demoRemaining} left today` : ''}`);
+    else if (r.chargeUsd != null)
+        parts.push(usd(r.chargeUsd));
+    if (r.transaction && !r.transaction.startsWith('dryrun_'))
+        parts.push(`paid in tx ${r.transaction}`);
+    parts.push(r.encrypted ? 'encrypted end to end' : 'not encrypted');
+    if (r.receiptUrl)
+        parts.push(`receipt ${r.receiptUrl}`);
+    return parts.join(' · ');
+}
+const date = (sec) => (sec ? new Date(sec * 1000).toISOString().slice(0, 16).replace('T', ' ') : 'never');
+/** Where it stands: ready once it passed its evaluation and has run well for a day. */
+function standing(a) {
+    const s = a.standing;
+    if (!s)
+        return a.status;
+    if (s.ready)
+        return 'ready';
+    const why = [];
+    if (!s.working?.passed)
+        why.push(s.working ? `evaluation ${s.working.score}/100, not passed` : 'not evaluated');
+    if (s.alive && !s.alive.ready)
+        why.push(`${s.alive.good_runs}/${s.alive.needs_runs} good runs, live ${Math.floor(s.alive.live_for_sec / 3600)}h of ${s.alive.needs_sec / 3600}h`);
+    return `not ready yet (${why.join('; ')})`;
+}
+function agentLine(a, base, full = false) {
+    const purpose = !full && a.purpose.length > 160 ? a.purpose.slice(0, 157).trimEnd() + '...' : a.purpose;
+    return [
+        `## ${a.name}`,
+        `id ${a.id} | ${a.status}${a.status === 'active' ? `, ${standing(a)}` : ''} | model ${a.model} | tools ${a.tools.join(', ') || 'none'}`,
+        `${a.stats.good_runs} good / ${a.stats.failed_runs} failed runs, last ${date(a.last_run_at ?? a.stats.last_good_run_at)}`,
+        purpose,
+        `${base}/agents/${a.id}`,
+    ].join('\n');
+}
+function instructions(api) {
+    const how = {
+        key: 'Calls are billed per token to the connected prepaid key.',
+        wallet: `Calls are paid one at a time from the connected wallet, capped at ${usd(api.config.maxUsd)} each. Unused budget is refunded to the wallet.`,
+        demo: 'No key or wallet is set up, so calls go through the free demo: one small model and a few calls per day.',
+    }[api.config.mode];
+    return [
+        'OffRouter runs open models privately. Every call is served inside a GPU TEE, nothing is logged, and each answer comes with a signed receipt.',
+        api.config.e2ee ? 'Prompts are encrypted on this machine to a key the enclave proves it holds, so the gateway only sees ciphertext.' : '',
+        how,
+        'Use list_models to pick a model, then ask for one answer or compare to run the same prompt on several models.',
+        'list_agents and get_agent show the private agents builders have published on OffRouter Studio.',
+    ]
+        .filter(Boolean)
+        .join(' ');
+}
+export function createServer(api) {
+    const server = new McpServer({ name: 'offrouter', title: 'OffRouter', version: VERSION, websiteUrl: 'https://offrouter.org' }, { instructions: instructions(api) });
+    server.registerTool('list_models', {
+        title: 'List models',
+        description: 'List the private models on OffRouter with their context length and price in USD per million tokens. Use it to find a model id for ask or compare.',
+        inputSchema: { search: z.string().optional().describe('Filter on the model id, like "qwen" or "deepseek".') },
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async ({ search }) => {
+        const models = await api.listModels();
+        if (api.config.mode === 'demo') {
+            const demo = await api.demoInfo().catch(() => null);
+            const allowed = demo?.models ?? [];
+            const lines = models.filter((m) => allowed.includes(m.id)).map((m) => `${m.id} | ${Math.round(m.context_length / 1000)}k ctx`);
+            return text(`Running on the free demo, which allows: ${lines.length ? lines.join(', ') : 'nothing right now'}.` +
+                (demo ? ` ${demo.remaining} of ${demo.daily_per_ip} calls left today, up to ${demo.max_tokens} output tokens each.` : '') +
+                `\n\nThe full catalog has ${models.length} models. Set OFFROUTER_API_KEY or OFFROUTER_WALLET_KEY to use any of them.`);
+        }
+        const q = search?.toLowerCase() ?? '';
+        const rows = models.filter((m) => !q || m.id.toLowerCase().includes(q));
+        if (!rows.length)
+            return text(`No models match "${search}".`);
+        const lines = rows.map((m) => `${m.id} | ${Math.round(m.context_length / 1000)}k ctx | ${usd(m.input_usdc_per_mtok)} in / ${usd(m.output_usdc_per_mtok)} out per M tokens` +
+            ((m.input_modalities ?? []).length > 1 ? ` | reads ${m.input_modalities.slice(1).join(' and ')}` : '') +
+            (m.discount_pct ? ` | ${m.discount_pct}% off` : '') +
+            (api.config.e2ee && !m.e2ee?.model ? ' | no e2ee' : ''));
+        return text(`${rows.length} private models, all served in a GPU TEE:\n\n${lines.join('\n')}`);
+    });
+    const chatShape = {
+        prompt: z.string().min(1).describe('The user message.'),
+        system: z.string().optional().describe('Optional system prompt.'),
+        max_tokens: z.number().int().min(1).optional().describe('Cap on output tokens. Reasoning models need a generous budget.'),
+    };
+    server.registerTool('ask', {
+        title: 'Ask a private model',
+        description: 'Send a prompt to an OffRouter model and get the answer back. It runs inside a GPU TEE and is not logged, so it is a good fit for sensitive material, a second opinion, or cheap bulk work.',
+        inputSchema: {
+            model: z.string().min(1).describe('Model id from list_models, like "gemma-4-31b".'),
+            ...chatShape,
+            temperature: z.number().min(0).max(2).optional(),
+        },
+        annotations: { readOnlyHint: false, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const r = await api.chat(args);
+            return text(`${r.text || '(the model returned no text)'}\n\n${footer(r)}`);
+        }
+        catch (e) {
+            return fail(e.message);
+        }
+    });
+    server.registerTool('compare', {
+        title: 'Compare models',
+        description: `Run the same prompt on 2 to ${MAX_COMPARE} models in parallel and get every answer with its cost side by side.`,
+        inputSchema: {
+            models: z.array(z.string().min(1)).min(2).max(MAX_COMPARE).describe('Model ids from list_models.'),
+            ...chatShape,
+        },
+        annotations: { readOnlyHint: false, openWorldHint: true },
+    }, async ({ models, ...rest }) => {
+        const ids = [...new Set(models)];
+        if (ids.length < 2)
+            return fail('Pass at least two different model ids.');
+        if (api.config.mode === 'demo')
+            return fail('compare needs a key or a wallet. The free demo only has one model.');
+        const results = await Promise.allSettled(ids.map((model) => api.chat({ model, ...rest })));
+        const sections = results.map((r, i) => r.status === 'fulfilled' ? `## ${ids[i]}\n\n${r.value.text || '(no text)'}\n\n${footer(r.value)}` : `## ${ids[i]}\n\nError: ${r.reason.message}`);
+        return { content: [{ type: 'text', text: sections.join('\n\n---\n\n') }], isError: results.every((r) => r.status === 'rejected') };
+    });
+    server.registerTool('account', {
+        title: 'Account',
+        description: 'Show how this server pays for calls: the prepaid key balance and recent spend, the wallet address and per call cap, or what is left on the free demo.',
+        inputSchema: {},
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            const { mode } = api.config;
+            if (mode === 'key') {
+                const k = await api.keyInfo();
+                const recent = (k.recent_usage ?? [])
+                    .slice(0, 5)
+                    .map((u) => `  ${String(u.at).slice(0, 16).replace('T', ' ')}  ${u.model}  ${u.prompt_tokens + u.completion_tokens} tokens  ${usd(u.charge_usdc)}`);
+                return text([
+                    `Prepaid key ${k.key_prefix}...`,
+                    `Balance: ${usd(k.balance_usdc)}`,
+                    `Spent: ${usd(k.spent_usdc)} over ${k.totals?.requests ?? 0} requests`,
+                    recent.length ? `Recent:\n${recent.join('\n')}` : '',
+                    'Top up at https://offrouter.org/dashboard',
+                ]
+                    .filter(Boolean)
+                    .join('\n'));
+            }
+            if (mode === 'wallet') {
+                const w = api.wallet;
+                return text([
+                    `Paying per call from wallet ${w.address}`,
+                    `Chains: ${w.chains.join(', ')} (USDC on Base, USDG on Robinhood Chain)`,
+                    `Cap per call: ${usd(api.config.maxUsd)}`,
+                    'Each call is quoted as a ceiling and the unused part is refunded to this wallet.',
+                ].join('\n'));
+            }
+            const d = await api.demoInfo();
+            return text(`Free demo: ${d.remaining} of ${d.daily_per_ip} calls left today (resets ${d.resets_at}). Models: ${(d.models ?? []).join(', ')}.\n` +
+                'For the full catalog, set OFFROUTER_API_KEY (get one at https://offrouter.org/dashboard) or OFFROUTER_WALLET_KEY to pay per call.');
+        }
+        catch (e) {
+            return fail(e.message);
+        }
+    });
+    server.registerTool('verify_enclave', {
+        title: 'Verify the enclave',
+        description: 'Check the enclave right now from this machine: the Intel TDX quote, that the report is fresh, and that it booted the published code. Returns the key prompts are encrypted to.',
+        inputSchema: {},
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        try {
+            const e = await api.enclave.refresh();
+            return text([
+                'The enclave checks out.',
+                '- Intel TDX quote verified up to Intel\'s root certificate',
+                '- The report covers a random nonce made here just now, so it is not a replay',
+                '- The boot log replays to the measured launch file',
+                `Key set: ${e.keyset}`,
+                `Encryption key: ${e.key.algo} ${e.key.public_key.slice(0, 16)}...`,
+                `Valid until: ${new Date(e.notAfter * 1000).toISOString()}`,
+                e.commit ? `Enclave gateway code: ${e.repo ? `${e.repo}/tree/${e.commit}` : e.commit}` : '',
+                api.config.e2ee ? 'Prompts from this server are encrypted to that key.' : 'Encryption is off (OFFROUTER_E2EE=off), so prompts are sent in the clear to the gateway.',
+            ]
+                .filter(Boolean)
+                .join('\n'));
+        }
+        catch (e) {
+            return fail(`The enclave did not verify: ${e.message}`);
+        }
+    });
+    server.registerTool('list_agents', {
+        title: 'List Studio agents',
+        description: 'List the agents published on OffRouter Studio, newest first: what each does, its model and tools, how its runs have gone, and whether it has earned a ready standing. Each runs privately in a TEE with its own wallet.',
+        inputSchema: {
+            search: z.string().optional().describe('Filter on the name or purpose, like "trading" or "news".'),
+            ready_only: z.boolean().optional().describe('Only agents that passed their evaluation and have run well for a day.'),
+        },
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async ({ search, ready_only }) => {
+        try {
+            const q = search?.toLowerCase() ?? '';
+            const agents = (await api.listAgents()).filter((a) => (!q || `${a.name} ${a.purpose}`.toLowerCase().includes(q)) && (!ready_only || a.standing?.ready));
+            if (!agents.length)
+                return text(search || ready_only ? 'No Studio agents match.' : 'No agents are published on Studio yet.');
+            const base = api.config.baseUrl;
+            return text(`${agents.length} Studio agent${agents.length === 1 ? '' : 's'}:\n\n${agents.map((a) => agentLine(a, base)).join('\n\n')}\n\nUse get_agent with an id for its examples and evaluation.`);
+        }
+        catch (e) {
+            return fail(e.message);
+        }
+    });
+    server.registerTool('get_agent', {
+        title: 'Get a Studio agent',
+        description: 'Show one Studio agent in full: its purpose, example tasks, latest evaluation, standing, wallet and config hash.',
+        inputSchema: { id: z.string().describe('The agent id from list_agents, 0x followed by 32 hex characters.') },
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async ({ id }) => {
+        try {
+            const a = await api.getAgent(id.trim());
+            const ev = a.evaluation;
+            return text([
+                agentLine(a, api.config.baseUrl, true),
+                `Builder ${a.builder} · agent wallet ${a.address}`,
+                `Config hash ${a.config_hash}`,
+                `Created ${date(a.created_at)} · ${a.scheduled ? 'runs on a schedule' : 'runs on request'} · ${usd(Number(a.stats.credits_spent) / 1e6)} of credits spent`,
+                ev ? `Last evaluation ${date(ev.at)}: ${ev.score}/100, ${ev.passed ? 'passed' : 'not passed'}${ev.leaked ? ', leaked its instructions' : ''} (${ev.judge} judge)` : 'Not evaluated yet.',
+                a.examples?.length ? `Examples:\n${a.examples.map((x) => `- ${x.task}\n  Expect: ${x.expect}`).join('\n')}` : '',
+            ]
+                .filter(Boolean)
+                .join('\n'));
+        }
+        catch (e) {
+            return fail(e.message);
+        }
+    });
+    return server;
+}

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@offrouter/mcp",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "MCP server for OffRouter private inference. Every model runs in a GPU TEE, and your prompts are encrypted to the enclave before they leave your machine.",
+  "license": "MIT",
+  "author": "OffRouter",
+  "homepage": "https://offrouter.org",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/offrouter/mcp.git"
+  },
+  "bugs": "https://github.com/offrouter/mcp/issues",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "private-inference",
+    "tee",
+    "confidential-computing",
+    "x402",
+    "llm"
+  ],
+  "type": "module",
+  "bin": {
+    "offrouter-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepare": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@noble/curves": "^1.9.7",
+    "@noble/hashes": "^1.8.0",
+    "@phala/aci-verifier": "^0.8.0",
+    "@x402/evm": "^2.28.0",
+    "@x402/fetch": "^2.28.0",
+    "viem": "^2.55.17",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "tsx": "^4.23.12",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4"
+  }
+}