@prismnetwork/mcp 0.8.4 → 0.9.0

package/README.md

@@ -13,20 +13,19 @@ claude mcp add prism -- npx -y @prismnetwork/mcp
 Then ask what you can rent. `prism_list_gpus` answers from live capacity with
 real prices. Leasing spends money, so those tools ask for a wallet and say so.
 
-Packaged for Claude Code and Codex as the [Prism plugin](https://plugins.prismnetwork.tech),
-which wires this server up and prompts for the wallet at install time.
-
 ## Tools
 
 | Tool | Wallet |
 | --- | --- |
-| `prism_budget` | no |
 | `prism_list_gpus` | no |
 | `prism_price_index` | no |
 | `prism_receipts` | no |
 | `prism_wallet` | yes |
 | `prism_leases` | yes |
 | `prism_infer` | yes |
+| `prism_infer_batch` | yes |
+| `prism_confidential_infer` | yes |
+| `prism_verify_attestation` | no |
 | `prism_lease_and_run` | yes |
 | `prism_lease` | yes |
 | `prism_run` | yes |
@@ -38,8 +37,6 @@ which wires this server up and prompts for the wallet at install time.
 | `prism_vault_delete` | yes |
 | `prism_vault_release` | yes |
 
-- `prism_budget`: the spending limits in force and what has already been spent
-  today, with the recent charges.
 - `prism_wallet`: the agent's address and USDG/ETH balances.
 - `prism_list_gpus`: GPUs available to lease, with price per second and per hour.
 - `prism_price_index`: sourced and settled pricing per GPU model, for cost estimates.
@@ -50,6 +47,23 @@ which wires this server up and prompts for the wallet at install time.
   paying the quoted USDG price from this wallet (about 0.01 USDG). Waits
   through a cold start; an unconsumed payment is kept and reused on the next
   call instead of paying twice.
+- `prism_infer_batch`: buy many generations in one paid call, at the
+  single-generation price times the number of prompts. Each prompt runs whole on
+  a rented GPU and they are spread across every GPU the endpoint holds, so a
+  list of prompts finishes far sooner than the same prompts sent one at a time.
+  Returns every answer in order with a Merkle receipt naming the leases that did
+  the work.
+- `prism_confidential_infer`: buy one generation that runs inside a GPU TEE.
+  The message contents are encrypted to a key the enclave's own attestation
+  commits to, so this server's relay carries ciphertext and cannot read the
+  prompt or the answer. Returns the answer, the cost and a receipt id the
+  workload signed over the exact bytes of the exchange.
+- `prism_verify_attestation`: check one of those generations against its
+  receipt and the hardware behind it. The server remembers the digests of the
+  last few confidential calls, so the verdict is bound to the bytes it actually
+  sent and received. Every check is reported with its result, including the two
+  that cannot be established today: private-key custody, and where TLS
+  terminates.
 - `prism_lease_and_run`: lease a GPU, run a command, return the output (one shot).
 - `prism_lease`: lease a GPU and keep it; returns a `lease_id` and SSH access.
 - `prism_run`: run a command on an existing lease.
@@ -63,29 +77,6 @@ which wires this server up and prompts for the wallet at install time.
 - `prism_vault_delete`: permanently delete an item.
 - `prism_vault_release`: authorize an item into a lease that clears its trust floor.
 
-## Spending limits
-
-Two ceilings bound what this server can spend, and a refusal quotes both.
-
-| Variable | Default | What it bounds |
-| --- | --- | --- |
-| `PRISM_MAX_USDG` | 1 | Any single lease or generation. `max_usdg` on a call may lower it, never raise it past this. |
-| `PRISM_DAILY_BUDGET_USDG` | 5 | Everything in a rolling 24 hours. `0` removes the ceiling. |
-| `PRISM_LEDGER_PATH` | `~/.prism/spend.json` | Where the spend is recorded. |
-
-Spend is written before the money moves, so a crash between funding an escrow
-and answering is counted rather than forgiven, and a restart does not hand back
-a fresh day's allowance. Only an attempt that provably never reached the chain
-is reverted. Two clients pointed at one wallet share one ceiling, because they
-share the ledger file.
-
-None of this is the real limit. Fund a dedicated wallet with what you are
-willing to lose: that balance is what survives a bug in everything above.
-
-Tools that spend are annotated `destructiveHint` and carry
-`anthropic/requiresUserInteraction`, so Claude Code asks before every one of
-them even in modes that otherwise approve tools automatically.
-
 ## Vault
 
 An agent that handles a card, an identity document or a credential should not
@@ -111,8 +102,7 @@ Point your MCP client (Claude Desktop / Code) at the published server:
       "args": ["-y", "@prismnetwork/mcp"],
       "env": {
         "PRISM_AGENT_KEY": "0x<agent wallet private key>",
-        "PRISM_MAX_USDG": "1",
-        "PRISM_DAILY_BUDGET_USDG": "5"
+        "PRISM_ESCROW": "0x62C042265991bEa17B07229322A01850974626dA"
       }
     }
   }
@@ -125,17 +115,11 @@ Or add it to Claude Code in one line:
 
 ```sh
 claude mcp add prism \
+  --env PRISM_ESCROW=0x62C042265991bEa17B07229322A01850974626dA \
   --env PRISM_AGENT_KEY=0x<agent wallet private key> \
-  --env PRISM_DAILY_BUDGET_USDG=5 \
   -- npx -y @prismnetwork/mcp
 ```
 
-Codex takes the same server:
-
-```sh
-codex mcp add prism --env PRISM_AGENT_KEY=0x<agent wallet private key> -- npx -y @prismnetwork/mcp
-```
-
 ## Timing
 
 `prism_lease` and `prism_lease_and_run` block while a GPU provisions (usually one to four minutes, occasionally longer on a slow host). Configure your MCP client to allow long tool calls.

package/package.json

@@ -1,15 +1,14 @@
 {
   "name": "@prismnetwork/mcp",
-  "version": "0.8.4",
+  "version": "0.9.0",
   "description": "MCP server for leasing and running on Prism Network GPUs.",
-  "mcpName": "tech.prismnetwork/mcp",
+  "mcpName": "io.github.prismnetwork-tech/mcp",
   "type": "module",
   "bin": {
     "prism-mcp": "server.mjs"
   },
   "files": [
     "server.mjs",
-    "budget.mjs",
     "README.md"
   ],
   "engines": {
@@ -17,19 +16,18 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@prismnetwork/agent-sdk": "^0.6.1",
+    "@phala/dcap-qvl": "^0.6.1",
+    "@prismnetwork/agent-sdk": "^0.7.0",
+    "jose": "^6",
     "viem": "^2"
   },
   "keywords": [
+    "prism",
+    "mcp",
+    "gpu",
     "agent",
     "claude",
-    "codex",
-    "compute",
-    "gpu",
-    "gpu-rental",
-    "mcp",
-    "prism",
-    "x402"
+    "compute"
   ],
   "homepage": "https://prismnetwork.tech",
   "repository": {

package/server.mjs

@@ -2,13 +2,17 @@
 // Prism Network MCP server: lets an MCP client (Claude, agents) see and lease
 // real GPUs. Looking is free and needs no configuration. Leasing spends money,
 // so it needs a wallet: PRISM_AGENT_KEY, PRISM_ESCROW.
+import { createHash } from "node:crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { DEFAULT_IMAGE, DEFAULT_TRUST_FLOOR, PrismAgent, TRUST_CLASSES } from "@prismnetwork/agent-sdk";
-import { BudgetError, SpendLedger, readBudget, stripUnexpanded } from "./budget.mjs";
-
-stripUnexpanded(process.env);
+import {
+  DEFAULT_IMAGE,
+  DEFAULT_TRUST_FLOOR,
+  PrismAgent,
+  TRUST_CLASSES,
+  verifyConfidential,
+} from "@prismnetwork/agent-sdk";
 
 const IMAGE = process.env.PRISM_DEFAULT_IMAGE ?? DEFAULT_IMAGE;
 
@@ -44,18 +48,6 @@ if (!agent) {
   );
 }
 
-// A budget the operator got wrong must stop spending, not fall back to none.
-// Reading capacity and prices is unaffected, so a typo is discoverable rather
-// than fatal.
-let ledger = null;
-let budgetProblem = null;
-try {
-  ledger = new SpendLedger(readBudget());
-} catch (err) {
-  budgetProblem = err?.message ?? String(err);
-  console.error(`prism mcp: ${budgetProblem}`);
-}
-
 function requireWallet(tool, reason = "spends money") {
   if (!agent) {
     throw new Error(
@@ -65,43 +57,6 @@ function requireWallet(tool, reason = "spends money") {
   return agent;
 }
 
-function requireLedger(tool) {
-  if (!ledger) {
-    throw new Error(`${tool} needs the spend limits, and they are unusable: ${budgetProblem}`);
-  }
-  return ledger;
-}
-
-// Records the spend before the money moves, then reconciles. An attempt that
-// never reached the chain is reverted; anything that funded an escrow keeps its
-// entry and gains the transaction that proves it, because a ledger that forgets
-// a funded lease is worse than no ledger at all.
-async function spending(tool, micros, run) {
-  const book = requireLedger(tool);
-  const id = book.commit({ tool, micros });
-  // Reconciling is bookkeeping and must never be the reason a caller loses a
-  // machine it paid for, or the reason a failure is reported as the wrong
-  // failure. A ledger that cannot be written says so on stderr and the
-  // committed figure stands, which errs towards counting the spend.
-  const reconcile = (action, ...args) => {
-    try {
-      book[action](id, ...args);
-    } catch (err) {
-      console.error(`prism mcp: could not ${action} the ledger entry for ${tool}: ${err?.message ?? err}`);
-    }
-  };
-  try {
-    const { value, settledMicros, reference } = await run();
-    reconcile("settle", { micros: settledMicros, reference });
-    return value;
-  } catch (err) {
-    const funded = err?.body?.funding_hash;
-    if (funded) reconcile("settle", { reference: funded });
-    else reconcile("revert");
-    throw err;
-  }
-}
-
 function requireCommand(value) {
   if (typeof value !== "string" || value.trim() === "") {
     throw new Error("command is required: the shell command to run on the GPU, e.g. 'nvidia-smi'.");
@@ -112,20 +67,8 @@ function requireCommand(value) {
   return value;
 }
 
-// What the escrow actually holds, which is what the day's budget should count.
-// Booking the caller's ceiling instead charged a 0.2 USDG lease against a 0.5
-// USDG cap, so a 5 USDG day bought ten leases where it could afford twenty-five.
-function escrowed(quote) {
-  const held = Number(quote?.maximum_escrow);
-  return Number.isFinite(held) && held > 0 ? held : undefined;
-}
-
-// The per-call ceiling is the operator's, not the model's: an omitted max_usdg
-// takes the configured cap rather than a hardcoded one, and a stated max_usdg
-// above it is refused when the ledger checks the commit.
-function maxDeposit(tool, args) {
-  if (args.max_usdg === undefined) return requireLedger(tool).maxPerCallMicros;
-  const cap = args.max_usdg;
+function maxDeposit(args) {
+  const cap = args.max_usdg ?? 1;
   if (typeof cap !== "number" || !Number.isFinite(cap) || cap <= 0) {
     throw new Error("max_usdg must be a positive number of USDG.");
   }
@@ -146,13 +89,56 @@ async function publicJson(url, what) {
 }
 
 const leases = new Map();
-// Unconsumed inference payments, keyed by endpoint and price, so a failed
-// generation is retried with the same paid header instead of paying again.
-const pendingInference = new Map();
 // null in, null out: a missing price must never render as 0.000000 USDG.
 const usdg = (micros) =>
   micros == null || !Number.isFinite(Number(micros)) ? null : `${(Number(micros) / 1e6).toFixed(6)} USDG`;
 
+/// The SDK pays once and keeps the payment until the endpoint actually serves,
+/// so a generation that never happened is retried with the payment already made.
+async function payAndPost({ base, path, price, payTo, body, tool }) {
+  const served = await agent.payAndPost({ base, path, price, payTo, body, caller: tool });
+  return { ...JSON.parse(served.bytes.toString("utf8")), paid: usdg(price), payment_tx: served.tx };
+}
+
+// What the last few confidential calls sent and received, as digests only, so
+// prism_verify_attestation binds its verdict to the real bytes of a call
+// without keeping anyone's prompt in memory.
+const confidentialCalls = new Map();
+const CONFIDENTIAL_HISTORY = 16;
+
+const sha256Prefixed = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+
+function rememberConfidentialCall(receiptId, record) {
+  if (!receiptId) return;
+  confidentialCalls.set(receiptId, record);
+  while (confidentialCalls.size > CONFIDENTIAL_HISTORY) {
+    confidentialCalls.delete(confidentialCalls.keys().next().value);
+  }
+}
+
+const inferenceBase = () =>
+  (process.env.PRISM_INFERENCE_URL ?? "https://api.prismnetwork.tech/inference").replace(/\/$/, "");
+
+/// What the endpoint currently offers, and the model this call should use.
+async function inferenceOffer(base, requested) {
+  const offer = await publicJson(`${base}/v1/models`, "inference endpoint");
+  const model = requested ?? offer.models?.[0];
+  if (!model || (Array.isArray(offer.models) && !offer.models.includes(model))) {
+    throw new Error(`model must be one of ${offer.models?.join(", ") ?? "(endpoint offered none)"}`);
+  }
+  return { offer, model, unit: BigInt(offer.price_micros ?? 0) };
+}
+
+function withinCap(price, maxUsdg, fallback, what) {
+  const cap = maxUsdg ?? fallback;
+  if (typeof cap !== "number" || !Number.isFinite(cap) || cap <= 0) {
+    throw new Error("max_usdg must be a positive number of USDG.");
+  }
+  if (price <= 0n || price > BigInt(Math.round(cap * 1e6))) {
+    throw new Error(`the endpoint quotes ${usdg(price)} ${what}, past the ${cap} USDG cap.`);
+  }
+}
+
 function sweepExpiredLeases() {
   const now = Date.now();
   for (const [id, lease] of leases) {
@@ -170,28 +156,11 @@ function leaseId(value) {
   return id;
 }
 
-// Hints a client uses to decide what it may run unattended. `reads` is anything
-// that cannot change state or move money; `spends` is anything that can, and it
-// carries the Claude Code marker that forces a confirmation prompt on every call
-// even in modes that otherwise auto-approve.
-const reads = { readOnlyHint: true, openWorldHint: true };
-const spends = {
-  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
-  _meta: { "anthropic/requiresUserInteraction": true },
-};
-
 const TOOLS = [
-  {
-    name: "prism_budget",
-    description: "Show the spending limits this server enforces and what it has already spent in the last 24 hours, with the recent charges. Needs no wallet. Check this before a long job; a lease refused for budget says the same numbers.",
-    inputSchema: { type: "object", properties: {} },
-    annotations: { title: "Spending limits", readOnlyHint: true, openWorldHint: false },
-  },
   {
     name: "prism_wallet",
     description: "Show the agent's wallet address and on-chain balances (USDG and ETH for gas) on Robinhood Chain. Check this before leasing to confirm the wallet can pay.",
     inputSchema: { type: "object", properties: {} },
-    annotations: { title: "Wallet balances", ...reads },
   },
   {
     name: "prism_list_gpus",
@@ -206,13 +175,11 @@ const TOOLS = [
         },
       },
     },
-    annotations: { title: "Available GPUs", ...reads },
   },
   {
     name: "prism_price_index",
     description: "Current GPU pricing on Prism Network by model: sourced low/median/high and settled mean, in USDG per hour. Needs no wallet. Use it to estimate what an analysis job will cost before leasing.",
     inputSchema: { type: "object", properties: {} },
-    annotations: { title: "GPU price index", ...reads },
   },
   {
     name: "prism_receipts",
@@ -223,13 +190,11 @@ const TOOLS = [
         limit: { type: "integer", description: "Max receipts to return (default 10, max 50)." },
       },
     },
-    annotations: { title: "Settled receipts", ...reads },
   },
   {
     name: "prism_leases",
     description: "List this wallet's leases on Prism Network with their current state.",
     inputSchema: { type: "object", properties: {} },
-    annotations: { title: "Your leases", ...reads },
   },
   {
     name: "prism_batch_run",
@@ -244,8 +209,6 @@ const TOOLS = [
       },
       required: ["command"],
     },
-    ...spends,
-    annotations: { title: "Rent a GPU for one command", ...spends.annotations },
   },
   {
     name: "prism_batch_result",
@@ -257,7 +220,6 @@ const TOOLS = [
       },
       required: ["lease_id"],
     },
-    annotations: { title: "Batch result", ...reads },
   },
   {
     name: "prism_infer",
@@ -271,8 +233,52 @@ const TOOLS = [
       },
       required: ["prompt"],
     },
-    ...spends,
-    annotations: { title: "Buy one LLM generation", ...spends.annotations },
+  },
+  {
+    name: "prism_infer_batch",
+    description: "Buy many LLM generations from Prism's managed inference endpoint in one paid call. Every prompt runs whole on a rented GPU, spread across every GPU the endpoint holds, so a list of prompts finishes far sooner than the same prompts sent one at a time. Costs the single-generation price times the number of prompts. Returns every answer in order plus a Merkle receipt naming the leases that did the work. Use it for evals, dataset passes, rollouts, or anything with more than a handful of independent prompts.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        prompts: {
+          type: "array",
+          items: { type: "string" },
+          minItems: 1,
+          maxItems: 64,
+          description: "Independent prompts, answered in the order given (each max 32 KiB).",
+        },
+        model: { type: "string", description: "Model to use; defaults to the endpoint's first offered model." },
+        max_usdg: { type: "number", description: "Refuse if the quoted total exceeds this (default 0.5)." },
+      },
+      required: ["prompts"],
+    },
+  },
+  {
+    name: "prism_confidential_infer",
+    description: "Buy one LLM generation that runs inside a GPU TEE, with the message contents encrypted end to end to a key the enclave's own attestation commits to, so Prism's relay in between carries ciphertext and cannot read the prompt or the answer. Costs a little more than prism_infer. Returns the answer, the cost, and a receipt id the workload signed over the exact bytes of the exchange; pass that id to prism_verify_attestation to check the whole chain. Use it for anything the operator of an ordinary endpoint should not be able to read.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        prompt: { type: "string", description: "The prompt to generate from." },
+        model: { type: "string", description: "Confidential model to use; defaults to the endpoint's first." },
+        max_tokens: { type: "integer", description: "Cap on generated tokens (default 512). The price is quoted against this cap." },
+        max_usdg: { type: "number", description: "Refuse if the quoted price exceeds this (default 0.25)." },
+        e2ee: { type: "boolean", description: "Encrypt message contents to the attested enclave key (default true). Turn it off only when the relay is allowed to read the prompt." },
+      },
+      required: ["prompt"],
+    },
+  },
+  {
+    name: "prism_verify_attestation",
+    description: "Check a confidential generation against its signed receipt and the hardware behind it: the TDX quote verifies to Intel's root and commits to the key set that signed the receipt, the boot log replays to the measurement in that quote, the receipt covers the exact bytes of this call, the upstream that ran the model was itself verified, and the GPU is attested by NVIDIA. Returns every check with its result, including the ones that cannot be established today. Needs no wallet.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        receipt_id: { type: "string", description: "The receipt_id from prism_confidential_infer." },
+        model: { type: "string", description: "Model to fetch GPU evidence for; defaults to the one recorded for this receipt." },
+      },
+      required: ["receipt_id"],
+    },
   },
   {
     name: "prism_lease_and_run",
@@ -292,8 +298,6 @@ const TOOLS = [
       },
       required: ["command"],
     },
-    ...spends,
-    annotations: { title: "Rent a GPU and run a command", ...spends.annotations },
   },
   {
     name: "prism_lease",
@@ -311,8 +315,6 @@ const TOOLS = [
         max_usdg: { type: "number", description: "Hard cap on the USDG this lease may cost (default 1). Raise it deliberately for longer leases." },
       },
     },
-    ...spends,
-    annotations: { title: "Rent a GPU", ...spends.annotations },
   },
   {
     name: "prism_run",
@@ -326,7 +328,6 @@ const TOOLS = [
       },
       required: ["lease_id", "command"],
     },
-    annotations: { title: "Run a command on a lease", readOnlyHint: false, destructiveHint: true, openWorldHint: true },
   },
   {
     name: "prism_end_lease",
@@ -336,7 +337,6 @@ const TOOLS = [
       properties: { lease_id: { type: "integer" } },
       required: ["lease_id"],
     },
-    annotations: { title: "Release a lease", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
   },
   {
     name: "prism_vault_store",
@@ -354,13 +354,11 @@ const TOOLS = [
       },
       required: ["value"],
     },
-    annotations: { title: "Seal a secret", readOnlyHint: false, destructiveHint: false, openWorldHint: true },
   },
   {
     name: "prism_vault_list",
     description: "List the agent's sealed vault items: item_id, label, version and trust floor. Values are not returned and are not readable by Prism.",
     inputSchema: { type: "object", properties: {} },
-    annotations: { title: "List sealed items", ...reads },
   },
   {
     name: "prism_vault_read",
@@ -370,8 +368,6 @@ const TOOLS = [
       properties: { item_id: { type: "string", description: "The item_id from prism_vault_store or prism_vault_list." } },
       required: ["item_id"],
     },
-    _meta: { "anthropic/requiresUserInteraction": true },
-    annotations: { title: "Decrypt one sealed item", readOnlyHint: true, openWorldHint: true },
   },
   {
     name: "prism_vault_delete",
@@ -381,8 +377,6 @@ const TOOLS = [
       properties: { item_id: { type: "string" } },
       required: ["item_id"],
     },
-    ...spends,
-    annotations: { title: "Delete a sealed item", ...spends.annotations },
   },
   {
     name: "prism_vault_release",
@@ -395,13 +389,10 @@ const TOOLS = [
       },
       required: ["item_id", "lease_id"],
     },
-    ...spends,
-    annotations: { title: "Release a secret into a lease", ...spends.annotations },
   },
 ];
 
 async function handle(name, args) {
-  if (name === "prism_budget") return requireLedger(name).status();
   if (name === "prism_wallet") {
     const b = await requireWallet("prism_wallet").balances();
     return { address: b.address, usdg: usdg(b.usdg), eth_wei: b.eth };
@@ -492,28 +483,22 @@ async function handle(name, args) {
   if (name === "prism_batch_run") {
     requireCommand(args.command);
     requireWallet(name);
-    const cap = maxDeposit(name, args);
-    return spending(name, cap, async () => {
-      const batch = await agent.lease({
-        image: IMAGE,
-        durationSeconds: args.duration_seconds ?? 900,
-        minVramMib: args.min_vram_mib ?? 16000,
-        maxDeposit: cap,
-        command: args.command,
-      });
-      return {
-        reference: batch.fundingHash,
-        settledMicros: escrowed(batch.quote),
-        value: {
-          lease_id: batch.leaseId,
-          funding_tx: batch.fundingHash,
-          exit_code: batch.result?.exit_code,
-          stdout: batch.result?.stdout,
-          stderr: batch.result?.stderr,
-          truncated: batch.result?.truncated ?? false,
-        },
-      };
+    const cap = maxDeposit(args);
+    const batch = await agent.lease({
+      image: IMAGE,
+      durationSeconds: args.duration_seconds ?? 900,
+      minVramMib: args.min_vram_mib ?? 16000,
+      maxDeposit: cap,
+      command: args.command,
     });
+    return {
+      lease_id: batch.leaseId,
+      funding_tx: batch.fundingHash,
+      exit_code: batch.result?.exit_code,
+      stdout: batch.result?.stdout,
+      stderr: batch.result?.stderr,
+      truncated: batch.result?.truncated ?? false,
+    };
   }
   if (name === "prism_batch_result") {
     requireWallet(name, "reads this wallet's leases");
@@ -525,83 +510,126 @@ async function handle(name, args) {
       throw new Error("prompt is required.");
     }
     requireWallet(name);
-    const base = (process.env.PRISM_INFERENCE_URL ?? "https://api.prismnetwork.tech/inference").replace(/\/$/, "");
-    const offer = await publicJson(`${base}/v1/models`, "inference endpoint");
-    const model = args.model ?? offer.models?.[0];
-    if (!model || (Array.isArray(offer.models) && !offer.models.includes(model))) {
-      throw new Error(`model must be one of ${offer.models?.join(", ") ?? "(endpoint offered none)"}`);
+    const base = inferenceBase();
+    const { offer, model, unit } = await inferenceOffer(base, args.model);
+    withinCap(unit, args.max_usdg, 0.05, "per generation");
+    return payAndPost({
+      base,
+      path: "/v1/inference",
+      price: unit,
+      payTo: offer.pay_to,
+      body: { model, prompt: args.prompt },
+      tool: "prism_infer",
+    });
+  }
+  if (name === "prism_infer_batch") {
+    const prompts = args.prompts;
+    if (!Array.isArray(prompts) || !prompts.length) {
+      throw new Error("prompts must be a non-empty array of strings.");
     }
-    const price = BigInt(offer.price_micros ?? 0);
-    const cap = args.max_usdg ?? 0.05;
-    if (typeof cap !== "number" || !Number.isFinite(cap) || cap <= 0) {
-      throw new Error("max_usdg must be a positive number of USDG.");
+    if (prompts.some((p) => typeof p !== "string" || p.trim() === "")) {
+      throw new Error("every prompt must be a non-empty string.");
     }
-    if (price <= 0n || price > BigInt(Math.round(cap * 1e6))) {
-      throw new Error(`the endpoint quotes ${usdg(price)} per generation, past the ${cap} USDG cap.`);
+    if (prompts.length > 64) {
+      throw new Error(`a batch takes at most 64 prompts; ${prompts.length} were given.`);
     }
-    const pendingKey = `${base}:${price}`;
-    let pending = pendingInference.get(pendingKey);
-    // A kept payment was already charged and already counted. Only a new
-    // transfer touches the ledger, or a retry would bill the day twice for one
-    // generation.
-    if (!pending) {
-      pending = await spending(name, Number(price), async () => {
-        const paymentTx = await agent.transferUsdg(offer.pay_to, price);
-        const signature = await agent.account.signMessage({ message: paymentTx });
-        return {
-          reference: paymentTx,
-          value: {
-            tx: paymentTx,
-            header: Buffer.from(JSON.stringify({ txHash: paymentTx, signature })).toString("base64"),
-          },
-        };
-      });
-      pendingInference.set(pendingKey, pending);
+    requireWallet(name);
+    const base = inferenceBase();
+    const { offer, model, unit } = await inferenceOffer(base, args.model);
+    const price = unit * BigInt(prompts.length);
+    withinCap(price, args.max_usdg, 0.5, `for ${prompts.length} generations`);
+    return payAndPost({
+      base,
+      path: "/v1/batch",
+      price,
+      payTo: offer.pay_to,
+      body: { model, prompts },
+      tool: "prism_infer_batch",
+    });
+  }
+  if (name === "prism_confidential_infer") {
+    if (typeof args.prompt !== "string" || args.prompt.trim() === "") {
+      throw new Error("prompt is required.");
     }
-    // A cold endpoint holds the request through provisioning; when it answers
-    // 503 instead, the payment is not consumed and the same header retries.
-    const deadline = Date.now() + 600_000;
-    for (;;) {
-      const res = await fetch(`${base}/v1/inference`, {
-        method: "POST",
-        headers: { "content-type": "application/json", "x-payment": pending.header },
-        body: JSON.stringify({ model, prompt: args.prompt }),
-        signal: AbortSignal.timeout(620_000),
-      });
-      const body = await res.json().catch(() => null);
-      if (res.status === 200 && body) {
-        pendingInference.delete(pendingKey);
-        return { ...body, paid: usdg(price), payment_tx: pending.tx };
-      }
-      const last = body?.detail ?? body?.error ?? `status ${res.status}`;
-      // 503 means the box is warming; a 402 for a payment that is merely too
-      // young (confirmations still landing, receipt not yet visible) heals by
-      // itself. Everything else is final.
-      const retryable =
-        res.status === 503 ||
-        (res.status === 402 && ["insufficient_confirmations", "tx_not_found"].includes(body?.error));
-      if (!retryable || Date.now() > deadline) {
-        throw new Error(
-          `inference failed: ${last}. The payment (tx ${pending.tx}) was not consumed and is kept; the next prism_infer call retries with it instead of paying again.`,
-        );
-      }
-      await new Promise((r) => setTimeout(r, 15_000));
+    requireWallet(name);
+    const base = inferenceBase();
+    const run = await agent.confidentialInfer({
+      prompt: args.prompt,
+      model: args.model,
+      maxTokens: args.max_tokens ?? 512,
+      maxUsdg: args.max_usdg ?? 0.25,
+      e2ee: args.e2ee ?? true,
+      endpoint: base,
+    });
+    rememberConfidentialCall(run.receiptId, {
+      base,
+      model: run.model,
+      e2ee: run.e2ee,
+      keysetDigest: run.keysetDigest,
+      responseHash: sha256Prefixed(run.bytes.response),
+      requestHash: sha256Prefixed(run.bytes.request),
+      restoredRequestHash: run.bytes.restoredRequest ? sha256Prefixed(run.bytes.restoredRequest) : null,
+    });
+    return {
+      model: run.model,
+      content: run.content,
+      usage: run.usage,
+      receipt_id: run.receiptId,
+      paid: usdg(run.priceMicros),
+      payment_tx: run.tx,
+      e2ee: run.e2ee
+        ? "on: the prompt and the answer were encrypted to the enclave's attested key, and the relay carried ciphertext"
+        : "off: the relay could read this prompt",
+      next: `prism_verify_attestation with receipt_id ${run.receiptId} checks the hardware, the receipt and the GPU behind this answer`,
+    };
+  }
+  if (name === "prism_verify_attestation") {
+    if (typeof args.receipt_id !== "string" || args.receipt_id.trim() === "") {
+      throw new Error("receipt_id is required: the id prism_confidential_infer returned.");
     }
+    // Without the bytes of the call, a receipt still proves what the workload
+    // signed, but not that it signed this exchange. That is `incomplete`, and it
+    // is a different thing to tell an agent than a failure.
+    const remembered = confidentialCalls.get(args.receipt_id) ?? {};
+    const bound = remembered.responseHash != null;
+    const result = await verifyConfidential({
+      base: remembered.base ?? inferenceBase(),
+      receiptId: args.receipt_id,
+      model: args.model ?? remembered.model,
+      e2ee: Boolean(remembered.e2ee),
+      requestHash: remembered.requestHash ?? null,
+      responseHash: remembered.responseHash ?? null,
+      restoredRequestHash: remembered.restoredRequestHash ?? null,
+      expectedKeysetDigest: remembered.keysetDigest ?? null,
+    });
+    const mark = { pass: "ok", fail: "FAIL", skip: "skip" };
+    return {
+      receipt_id: args.receipt_id,
+      verdict: result.verdict,
+      verdict_means: {
+        verified: "every check that ran passed, and the only skips are the documented ones",
+        incomplete: "nothing failed, and evidence some check needed was not available here",
+        failed: "a check failed",
+      }[result.verdict],
+      bound_to_this_session: bound,
+      ...(bound
+        ? {}
+        : { unbound_because: "this server has no record of that call, so the request and response checks could not run" }),
+      measured_source: result.provenance,
+      checks: result.checks.map((c) => `${mark[c.status]} ${c.title}${c.detail ? `: ${c.detail}` : ""}`),
+    };
   }
   if (name === "prism_lease_and_run" || name === "prism_lease") {
     if (name === "prism_lease_and_run") requireCommand(args.command);
     requireWallet(name);
-    const cap = maxDeposit(name, args);
+    const cap = maxDeposit(args);
     sweepExpiredLeases();
-    const lease = await spending(name, cap, async () => {
-      const funded = await agent.lease({
-        image: IMAGE,
-        durationSeconds: args.duration_seconds ?? 900,
-        minVramMib: args.min_vram_mib ?? 16000,
-        maxDeposit: cap,
-        minTrustClass: args.min_trust_class ?? "open",
-      });
-      return { value: funded, reference: funded.fundingHash, settledMicros: escrowed(funded.quote) };
+    const lease = await agent.lease({
+      image: IMAGE,
+      durationSeconds: args.duration_seconds ?? 900,
+      minVramMib: args.min_vram_mib ?? 16000,
+      maxDeposit: cap,
+      minTrustClass: args.min_trust_class ?? "open",
     });
     leases.set(lease.leaseId, lease);
     const summary = {
@@ -699,16 +727,13 @@ async function handleVault(name, args) {
   throw new Error(`unknown tool ${name}`);
 }
 
-const server = new Server({ name: "prism", version: "0.8.4" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "prism", version: "0.9.0" }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   try {
     const result = await handle(request.params.name, request.params.arguments ?? {});
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   } catch (err) {
-    if (err instanceof BudgetError) {
-      return { isError: true, content: [{ type: "text", text: `${err.message} See prism_budget.` }] };
-    }
     const body = err?.body ?? {};
     const detail = [
       body.cause,

package/budget.mjs

@@ -1,257 +0,0 @@
-// What stands between a model deciding to rent a GPU and a wallet paying for it.
-// The real ceiling is the balance; fund the agent wallet with what you are
-// willing to lose. This is the second line, and it exists because `max_usdg`
-// never was one: it bounds a single lease and says nothing about the fortieth in
-// a row, which is what an unattended agent actually does.
-//
-// Spend is written before the money moves and reverted only when the attempt
-// provably cost nothing, so a crash between funding and reply is counted rather
-// than forgiven. The file is shared across clients on purpose: one wallet gets
-// one daily ceiling whoever is holding it.
-import { mkdirSync, readFileSync, renameSync, writeFileSync, openSync, closeSync, unlinkSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-
-const MICROS = 1_000_000;
-const DAY_MS = 86_400_000;
-// Entries older than this are dropped on write. Two days covers the rolling
-// window with room for a clock that stepped backwards.
-const MEMORY_MS = 2 * DAY_MS;
-const LOCK_STALE_MS = 15_000;
-const LOCK_WAIT_MS = 5_000;
-
-export class BudgetError extends Error {
-  constructor(message, detail = {}) {
-    super(message);
-    this.name = "BudgetError";
-    this.detail = detail;
-  }
-}
-
-export const usdg = (micros) => `${(Number(micros) / MICROS).toFixed(6)} USDG`;
-
-function positiveNumber(raw, fallback, name) {
-  if (raw === undefined || raw === null || String(raw).trim() === "") return fallback;
-  const value = Number(raw);
-  if (!Number.isFinite(value) || value < 0) {
-    throw new BudgetError(`${name} must be a non-negative number of USDG, got ${JSON.stringify(raw)}`);
-  }
-  return value;
-}
-
-// One .mcp.json serves every client, and they disagree about templates: Claude
-// Code expands ${user_config.x} before launch, Codex passes it through. Reading
-// the literal template as a value would turn "no wallet configured" into
-// "wallet configured and broken", so an unexpanded placeholder is nothing.
-export function stripUnexpanded(env = process.env) {
-  for (const [key, value] of Object.entries(env)) {
-    if (key.startsWith("PRISM_") && /^\$\{[^}]*\}$/.test(String(value ?? "").trim())) delete env[key];
-  }
-  return env;
-}
-
-export function defaultLedgerPath(env = process.env) {
-  if (env.PRISM_LEDGER_PATH) return env.PRISM_LEDGER_PATH;
-  return join(env.HOME || homedir(), ".prism", "spend.json");
-}
-
-// A missing budget is not an unlimited one. The default is deliberately small:
-// enough for a handful of real leases, cheap enough that discovering the plugin
-// spends money costs about the price of a coffee rather than a rent cheque.
-export function readBudget(env = process.env) {
-  const maxPerCall = positiveNumber(env.PRISM_MAX_USDG, 1, "PRISM_MAX_USDG");
-  const daily = positiveNumber(env.PRISM_DAILY_BUDGET_USDG, 5, "PRISM_DAILY_BUDGET_USDG");
-  if (maxPerCall <= 0) throw new BudgetError("PRISM_MAX_USDG must be above zero");
-  // A per-call cap above the day's allowance is a cap in name only, and the
-  // mismatch is always a configuration mistake rather than an intention.
-  if (daily > 0 && maxPerCall > daily) {
-    throw new BudgetError(
-      `PRISM_MAX_USDG (${maxPerCall}) cannot exceed PRISM_DAILY_BUDGET_USDG (${daily}); lower the per-call cap or raise the daily one`,
-    );
-  }
-  return {
-    maxPerCallMicros: Math.round(maxPerCall * MICROS),
-    // Zero means the operator explicitly removed the daily ceiling. It is not
-    // the default and it is not what a missing variable produces.
-    dailyMicros: Math.round(daily * MICROS),
-    ledgerPath: defaultLedgerPath(env),
-  };
-}
-
-// A lock rather than last-write-wins, because two clients sharing one wallet is
-// the case this file exists for. A lock older than LOCK_STALE_MS belonged to a
-// process that died; breaking it is safe and not breaking it wedges the wallet.
-function withLock(path, fn, waitMs = LOCK_WAIT_MS) {
-  const lock = `${path}.lock`;
-  mkdirSync(dirname(path), { recursive: true });
-  const deadline = Date.now() + waitMs;
-  for (;;) {
-    let fd;
-    try {
-      fd = openSync(lock, "wx");
-    } catch (err) {
-      if (err?.code !== "EEXIST") throw err;
-      let age = 0;
-      try {
-        age = Date.now() - statSync(lock).mtimeMs;
-      } catch {
-        continue; // it vanished between the open and the stat; retry immediately
-      }
-      if (age > LOCK_STALE_MS) {
-        try {
-          unlinkSync(lock);
-        } catch {
-          /* another process broke it first, which is the outcome we wanted */
-        }
-        continue;
-      }
-      if (Date.now() > deadline) {
-        throw new BudgetError(
-          `the spend ledger at ${path} is locked by another Prism process; nothing was charged. Retry in a moment.`,
-        );
-      }
-      // Busy-wait deliberately: this holds for milliseconds and the alternative
-      // is making every caller of a synchronous ledger asynchronous.
-      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
-      continue;
-    }
-    try {
-      closeSync(fd);
-      return fn();
-    } finally {
-      try {
-        unlinkSync(lock);
-      } catch {
-        /* already gone */
-      }
-    }
-  }
-}
-
-function readState(path) {
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (!parsed || !Array.isArray(parsed.entries)) return { entries: [] };
-    return { entries: parsed.entries.filter((e) => e && Number.isFinite(e.at) && Number.isFinite(e.micros)) };
-  } catch (err) {
-    if (err?.code === "ENOENT") return { entries: [] };
-    // A corrupt ledger must not read as an empty one: that would hand the
-    // caller a fresh day's budget every time the file got truncated.
-    throw new BudgetError(
-      `the spend ledger at ${path} is unreadable (${err?.message ?? err}), so spending is refused. Move or repair the file.`,
-    );
-  }
-}
-
-function writeState(path, state, now) {
-  const entries = state.entries.filter((e) => now - e.at < MEMORY_MS);
-  const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify({ version: 1, entries }, null, 2)}\n`, { mode: 0o600 });
-  renameSync(tmp, path);
-}
-
-export function spentInWindow(entries, now) {
-  return entries.reduce((total, e) => (now - e.at < DAY_MS ? total + e.micros : total), 0);
-}
-
-export class SpendLedger {
-  constructor({ ledgerPath, dailyMicros, maxPerCallMicros, lockWaitMs = LOCK_WAIT_MS }) {
-    this.path = ledgerPath;
-    this.dailyMicros = dailyMicros;
-    this.maxPerCallMicros = maxPerCallMicros;
-    this.lockWaitMs = lockWaitMs;
-  }
-
-  // What is left of today, for the caller to show before it asks to spend.
-  remaining(now = Date.now()) {
-    if (this.dailyMicros <= 0) return null;
-    const { entries } = readState(this.path);
-    return Math.max(0, this.dailyMicros - spentInWindow(entries, now));
-  }
-
-  status(now = Date.now()) {
-    const { entries } = readState(this.path);
-    const spent = spentInWindow(entries, now);
-    return {
-      daily_budget: this.dailyMicros > 0 ? usdg(this.dailyMicros) : "unlimited (PRISM_DAILY_BUDGET_USDG=0)",
-      spent_last_24h: usdg(spent),
-      remaining_today: this.dailyMicros > 0 ? usdg(Math.max(0, this.dailyMicros - spent)) : "unlimited",
-      max_per_call: usdg(this.maxPerCallMicros),
-      ledger: this.path,
-      charges_last_24h: entries
-        .filter((e) => now - e.at < DAY_MS)
-        .sort((a, b) => b.at - a.at)
-        .slice(0, 20)
-        .map((e) => ({
-          at: new Date(e.at).toISOString(),
-          tool: e.tool,
-          amount: usdg(e.micros),
-          ...(e.reference ? { reference: e.reference } : {}),
-        })),
-    };
-  }
-
-  // Records the spend before the money moves. Returns a handle the caller
-  // reverts only when it can prove nothing was charged.
-  commit({ tool, micros, now = Date.now() }) {
-    if (!Number.isFinite(micros) || micros <= 0) {
-      throw new BudgetError("a spend must be a positive number of micros");
-    }
-    if (micros > this.maxPerCallMicros) {
-      throw new BudgetError(
-        `${tool} would commit up to ${usdg(micros)}, past the ${usdg(this.maxPerCallMicros)} per-call cap. ` +
-          `Lower max_usdg for this call, or raise PRISM_MAX_USDG.`,
-        { required: micros, cap: this.maxPerCallMicros },
-      );
-    }
-    return withLock(
-      this.path,
-      () => {
-        const state = readState(this.path);
-        const spent = spentInWindow(state.entries, now);
-        if (this.dailyMicros > 0 && spent + micros > this.dailyMicros) {
-          throw new BudgetError(
-            `${tool} would take today's Prism spend to ${usdg(spent + micros)}, past the ${usdg(this.dailyMicros)} ` +
-              `daily cap (${usdg(spent)} already spent). Nothing was charged. Raise PRISM_DAILY_BUDGET_USDG to continue.`,
-            { spent, requested: micros, cap: this.dailyMicros },
-          );
-        }
-        const id = `${now.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-        state.entries.push({ id, at: now, tool, micros });
-        writeState(this.path, state, now);
-        return id;
-      },
-      this.lockWaitMs,
-    );
-  }
-
-  // Only for an attempt that provably cost nothing. A funded lease whose command
-  // failed is not one of those.
-  revert(id) {
-    if (!id) return false;
-    return withLock(this.path, () => {
-      const state = readState(this.path);
-      const before = state.entries.length;
-      state.entries = state.entries.filter((e) => e.id !== id);
-      if (state.entries.length === before) return false;
-      writeState(this.path, state, Date.now());
-      return true;
-    }, this.lockWaitMs);
-  }
-
-  // Replaces the reserved figure with what was actually committed on-chain and
-  // pins the receipt to it, so the ledger reads like a statement rather than a
-  // list of intentions.
-  settle(id, { micros, reference } = {}) {
-    if (!id) return false;
-    return withLock(this.path, () => {
-      const state = readState(this.path);
-      const entry = state.entries.find((e) => e.id === id);
-      if (!entry) return false;
-      if (Number.isFinite(micros) && micros >= 0) entry.micros = micros;
-      if (reference) entry.reference = reference;
-      writeState(this.path, state, Date.now());
-      return true;
-    }, this.lockWaitMs);
-  }
-}