@prismnetwork/mcp 0.2.0 → 0.4.0

package/README.md

@@ -1,15 +1,58 @@
 # @prismnetwork/mcp
 
-An MCP server that lets Claude (or any MCP client) lease and run on real GPUs through [Prism Network](https://prismnetwork.tech). Give it a wallet; it handles auth, on-chain payment, provisioning, and SSH.
+An MCP server that lets Claude (or any MCP client) see and lease real GPUs through [Prism Network](https://prismnetwork.tech). Give it a wallet and it handles auth, onchain payment, provisioning, and SSH.
+
+## Try it without a wallet
+
+Looking costs nothing and needs no configuration:
+
+```sh
+claude mcp add prism -- npx -y @prismnetwork/mcp
+```
+
+Then ask what you can rent. `prism_list_gpus` answers from live capacity with
+real prices. Leasing spends money, so those tools ask for a wallet and say so.
 
 ## Tools
 
+| Tool | Wallet |
+| --- | --- |
+| `prism_list_gpus` | no |
+| `prism_wallet` | yes |
+| `prism_lease_and_run` | yes |
+| `prism_lease` | yes |
+| `prism_run` | yes |
+| `prism_end_lease` | yes |
+| `prism_vault_store` | yes |
+| `prism_vault_list` | yes |
+| `prism_vault_read` | yes |
+| `prism_vault_delete` | yes |
+| `prism_vault_release` | yes |
+
 - `prism_wallet`: the agent's address and USDG/ETH balances.
 - `prism_list_gpus`: GPUs available to lease, with price per second and per hour.
 - `prism_lease_and_run`: lease a GPU, run a command, return the output (one shot).
 - `prism_lease`: lease a GPU and keep it; returns a `lease_id` and SSH access.
 - `prism_run`: run a command on an existing lease.
 - `prism_end_lease`: release a lease.
+- `prism_vault_store`: seal private data under the wallet-derived key.
+- `prism_vault_list`: list sealed items; values are never returned.
+- `prism_vault_read`: decrypt one item in this process.
+- `prism_vault_delete`: permanently delete an item.
+- `prism_vault_release`: authorize an item into a lease that clears its trust floor.
+
+## Vault
+
+An agent that handles a card, an identity document or a credential should not
+write it into a leased workspace. `prism_vault_store` seals it under a key
+derived from the agent's wallet inside this server process; Prism receives
+ciphertext and holds no way to read it.
+
+Each item names the weakest workspace trust class it may ever be released into,
+and new items default to `confidential` — above anything the network serves
+today. `prism_vault_release` is therefore refused on current capacity instead of
+handing a secret to a host that can read it. Lowering an item's floor is a
+deliberate act, and allowed releases are recorded against the account.
 
 ## Configure
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prismnetwork/mcp",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "MCP server for leasing and running on Prism Network GPUs.",
   "mcpName": "io.github.prismnetwork-tech/mcp",
   "type": "module",
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@prismnetwork/agent-sdk": "^0.2.0",
+    "@prismnetwork/agent-sdk": "^0.3.0",
     "viem": "^2"
   },
   "keywords": [

package/server.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-// Prism Network MCP server: lets an MCP client (Claude, agents) lease and run on
-// real GPUs. Configure with a wallet: PRISM_AGENT_KEY, PRISM_ESCROW.
+// Prism Network MCP server: lets an MCP client (Claude, agents) see and lease
+// real GPUs. Looking is free and needs no configuration. Leasing spends money,
+// so it needs a wallet: PRISM_AGENT_KEY, PRISM_ESCROW.
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { DEFAULT_IMAGE, PrismAgent, TRUST_CLASSES } from "@prismnetwork/agent-sdk";
+import { DEFAULT_IMAGE, DEFAULT_TRUST_FLOOR, PrismAgent, TRUST_CLASSES } from "@prismnetwork/agent-sdk";
 
 const IMAGE = process.env.PRISM_DEFAULT_IMAGE ?? DEFAULT_IMAGE;
 
@@ -14,7 +15,12 @@ function requireEnv(name) {
   return value;
 }
 
-let agent;
+const PUBLIC_API = process.env.PRISM_PUBLIC_API ?? "https://api.prismnetwork.tech";
+
+// Refusing to start without a wallet meant nobody could ask what a GPU costs
+// without first producing a private key, which is a strange thing to demand of
+// someone deciding whether to use you at all.
+let agent = null;
 try {
   agent = new PrismAgent({
     privateKey: requireEnv("PRISM_AGENT_KEY"),
@@ -22,9 +28,28 @@ try {
     apiBase: process.env.PRISM_API_BASE ?? "https://prismnetwork.tech",
     rpcUrl: process.env.PRISM_RPC_URL,
   });
-} catch (err) {
-  console.error(`prism mcp config error: ${err.message}. Set PRISM_AGENT_KEY and PRISM_ESCROW in the server env.`);
-  process.exit(1);
+} catch {
+  console.error(
+    "prism mcp: no wallet configured, so capacity and pricing are readable and leasing is not. " +
+      "Set PRISM_AGENT_KEY and PRISM_ESCROW to lease.",
+  );
+}
+
+function requireWallet(tool) {
+  if (!agent) {
+    throw new Error(
+      `${tool} spends money, so it needs a wallet. Set PRISM_AGENT_KEY and PRISM_ESCROW in this server's environment and restart it.`,
+    );
+  }
+  return agent;
+}
+
+async function publicOffers(minTrust) {
+  const url = new URL("/v1/offers", PUBLIC_API);
+  if (minTrust) url.searchParams.set("min_trust", minTrust);
+  const response = await fetch(url, { headers: { accept: "application/json" } });
+  if (!response.ok) throw new Error(`prism offers unavailable (${response.status})`);
+  return response.json();
 }
 
 const leases = new Map();
@@ -55,7 +80,7 @@ const TOOLS = [
   },
   {
     name: "prism_list_gpus",
-    description: "List GPUs currently available to lease on Prism Network, with model, VRAM, price per second in USDG, and trust class. Trust class runs open < isolated < attested < confidential; on an 'open' supplier the host operator can read anything the workload touches, so never send secrets, credentials or private model weights to one.",
+    description: "List GPUs currently available to lease on Prism Network, with model, VRAM, price per second in USDG, and trust class. Trust class runs open < isolated < attested < confidential; on an 'open' supplier the host operator can read anything the workload touches. Keep secrets and credentials in prism_vault_store rather than on the box, and raise min_trust when the workload itself must not be readable.",
     inputSchema: {
       type: "object",
       properties: {
@@ -123,16 +148,74 @@ const TOOLS = [
       required: ["lease_id"],
     },
   },
+  {
+    name: "prism_vault_store",
+    description: "Store private data — a card, an identity document, an API credential — encrypted under a key derived from this agent's wallet on this machine. Prism receives ciphertext only and cannot read it. Use this instead of writing a secret into a workspace or a file. Returns an item_id; the value is not recoverable without the wallet.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        value: { type: "string", description: "The data to seal. Encrypted before it leaves this process." },
+        label: { type: "string", description: "Optional plain-text name so the item is findable. Stored unencrypted, so keep it non-revealing (e.g. 'billing card', not the number)." },
+        trust_floor: {
+          type: "string",
+          enum: TRUST_CLASSES,
+          description: "The weakest workspace this item may ever be released into. Defaults to 'confidential', which is above anything the network serves today, so the item cannot reach a rented GPU at all. Only lower it deliberately.",
+        },
+      },
+      required: ["value"],
+    },
+  },
+  {
+    name: "prism_vault_list",
+    description: "List the agent's sealed vault items: item_id, label, version and trust floor. Values are not returned and are not readable by Prism.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "prism_vault_read",
+    description: "Decrypt and return one vault item, in this process, using the wallet-derived key. The plaintext exists only here — do not echo it into a leased workspace, a log, or a message.",
+    inputSchema: {
+      type: "object",
+      properties: { item_id: { type: "string", description: "The item_id from prism_vault_store or prism_vault_list." } },
+      required: ["item_id"],
+    },
+  },
+  {
+    name: "prism_vault_delete",
+    description: "Permanently delete a vault item. The ciphertext is removed and the value cannot be recovered.",
+    inputSchema: {
+      type: "object",
+      properties: { item_id: { type: "string" } },
+      required: ["item_id"],
+    },
+  },
+  {
+    name: "prism_vault_release",
+    description: "Authorize a vault item into a lease you hold and return its plaintext for use there. Refused when the lease's trust class is below the item's trust floor, which is what stops a secret reaching a host that can read it. Every allowed release is recorded against the account.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        item_id: { type: "string" },
+        lease_id: { type: "integer", description: "A lease from prism_lease." },
+      },
+      required: ["item_id", "lease_id"],
+    },
+  },
 ];
 
 async function handle(name, args) {
   if (name === "prism_wallet") {
-    const b = await agent.balances();
+    const b = await requireWallet("prism_wallet").balances();
     return { address: b.address, usdg: usdg(b.usdg), eth_wei: b.eth };
   }
   if (name === "prism_list_gpus") {
-    await ensureAuth();
-    const offers = await agent.offers({ minTrust: args.min_trust ?? "open" });
+    const minTrust = args.min_trust ?? "open";
+    let offers;
+    if (agent) {
+      await ensureAuth();
+      offers = await agent.offers({ minTrust });
+    } else {
+      offers = await publicOffers(minTrust);
+    }
     return {
       available: offers.length,
       gpus: offers.map((o) => ({
@@ -146,6 +229,7 @@ async function handle(name, args) {
   }
   if (name === "prism_lease_and_run" || name === "prism_lease") {
     if (name === "prism_lease_and_run" && !args.command) throw new Error("command is required");
+    requireWallet(name);
     await ensureAuth();
     sweepExpiredLeases();
     const lease = await agent.lease({
@@ -184,6 +268,57 @@ async function handle(name, args) {
     }
     return { lease_id: id, released: Boolean(lease) };
   }
+  if (name.startsWith("prism_vault_")) return handleVault(name, args);
+  throw new Error(`unknown tool ${name}`);
+}
+
+// The vault key is derived here from the wallet signature and stays in this
+// process. Nothing in this function sends a key or a plaintext to Prism.
+async function handleVault(name, args) {
+  const vault = requireWallet(name).vault;
+  await ensureAuth();
+  if (!vault.unlocked) await vault.unlock();
+
+  if (name === "prism_vault_store") {
+    if (typeof args.value !== "string" || args.value.length === 0) {
+      throw new Error("value is required");
+    }
+    const item = await vault.put(args.value, {
+      label: args.label ?? "",
+      trustFloor: args.trust_floor ?? DEFAULT_TRUST_FLOOR,
+    });
+    return {
+      item_id: item.item_id,
+      version: item.version,
+      label: item.label,
+      trust_floor: item.min_trust_class,
+      stored: "sealed on this machine; Prism holds ciphertext only",
+    };
+  }
+  if (name === "prism_vault_list") {
+    const items = await vault.list();
+    return {
+      count: items.length,
+      items: items.map((item) => ({
+        item_id: item.item_id,
+        label: item.label,
+        version: item.version,
+        trust_floor: item.min_trust_class,
+        updated_at: item.updated_at,
+      })),
+    };
+  }
+  if (name === "prism_vault_read") {
+    return { item_id: args.item_id, value: await vault.get(args.item_id) };
+  }
+  if (name === "prism_vault_delete") {
+    await vault.remove(args.item_id);
+    return { item_id: args.item_id, deleted: true };
+  }
+  if (name === "prism_vault_release") {
+    const id = leaseId(args.lease_id);
+    return { item_id: args.item_id, lease_id: id, value: await vault.releaseInto(id, args.item_id) };
+  }
   throw new Error(`unknown tool ${name}`);
 }