@prismnetwork/mcp 0.8.4 → 0.9.1

package/README.md

@@ -13,9 +13,6 @@ claude mcp add prism -- npx -y @prismnetwork/mcp
 Then ask what you can rent. `prism_list_gpus` answers from live capacity with
 real prices. Leasing spends money, so those tools ask for a wallet and say so.
 
-Packaged for Claude Code and Codex as the [Prism plugin](https://plugins.prismnetwork.tech),
-which wires this server up and prompts for the wallet at install time.
-
 ## Tools
 
 | Tool | Wallet |
@@ -27,6 +24,9 @@ which wires this server up and prompts for the wallet at install time.
 | `prism_wallet` | yes |
 | `prism_leases` | yes |
 | `prism_infer` | yes |
+| `prism_infer_batch` | yes |
+| `prism_confidential_infer` | yes |
+| `prism_verify_attestation` | no |
 | `prism_lease_and_run` | yes |
 | `prism_lease` | yes |
 | `prism_run` | yes |
@@ -38,8 +38,8 @@ which wires this server up and prompts for the wallet at install time.
 | `prism_vault_delete` | yes |
 | `prism_vault_release` | yes |
 
-- `prism_budget`: the spending limits in force and what has already been spent
-  today, with the recent charges.
+- `prism_budget`: the spending limits this server enforces, what it has spent
+  in the last 24 hours, and the recent charges.
 - `prism_wallet`: the agent's address and USDG/ETH balances.
 - `prism_list_gpus`: GPUs available to lease, with price per second and per hour.
 - `prism_price_index`: sourced and settled pricing per GPU model, for cost estimates.
@@ -50,8 +50,28 @@ which wires this server up and prompts for the wallet at install time.
   paying the quoted USDG price from this wallet (about 0.01 USDG). Waits
   through a cold start; an unconsumed payment is kept and reused on the next
   call instead of paying twice.
+- `prism_infer_batch`: buy many generations in one paid call, at the
+  single-generation price times the number of prompts. Each prompt runs whole on
+  a rented GPU and they are spread across every GPU the endpoint holds, so a
+  list of prompts finishes far sooner than the same prompts sent one at a time.
+  Returns every answer in order with a Merkle receipt naming the leases that did
+  the work.
+- `prism_confidential_infer`: buy one generation that runs inside a GPU TEE.
+  The message contents are encrypted to a key the enclave's own attestation
+  commits to, so this server's relay carries ciphertext and cannot read the
+  prompt or the answer. Returns the answer, the cost and a receipt id the
+  workload signed over the exact bytes of the exchange.
+- `prism_verify_attestation`: check one of those generations against its
+  receipt and the hardware behind it. The server remembers the digests of the
+  last few confidential calls, so the verdict is bound to the bytes it actually
+  sent and received. Every check is reported with its result, including the two
+  that cannot be established today: private-key custody, and where TLS
+  terminates.
 - `prism_lease_and_run`: lease a GPU, run a command, return the output (one shot).
 - `prism_lease`: lease a GPU and keep it; returns a `lease_id` and SSH access.
+  The SSH block carries `host_key_fingerprint` and `host_key_claim` when the
+  network can say which machine should answer, and says so plainly when it
+  cannot. Check it before connecting by hand; `prism_run` checks it for you.
 - `prism_run`: run a command on an existing lease.
 - `prism_batch_run`: fund a lease that runs one command with no interactive
   access; the node reports the signed output. Matches only suppliers at trust
@@ -73,6 +93,10 @@ Two ceilings bound what this server can spend, and a refusal quotes both.
 | `PRISM_DAILY_BUDGET_USDG` | 5 | Everything in a rolling 24 hours. `0` removes the ceiling. |
 | `PRISM_LEDGER_PATH` | `~/.prism/spend.json` | Where the spend is recorded. |
 
+A `max_usdg` above `PRISM_MAX_USDG` is clamped back to it. The argument is
+written by the agent being bounded, so it is treated as a request for a lower
+ceiling and never as permission for a higher one.
+
 Spend is written before the money moves, so a crash between funding an escrow
 and answering is counted rather than forgiven, and a restart does not hand back
 a fresh day's allowance. Only an attempt that provably never reached the chain
@@ -111,8 +135,7 @@ Point your MCP client (Claude Desktop / Code) at the published server:
       "args": ["-y", "@prismnetwork/mcp"],
       "env": {
         "PRISM_AGENT_KEY": "0x<agent wallet private key>",
-        "PRISM_MAX_USDG": "1",
-        "PRISM_DAILY_BUDGET_USDG": "5"
+        "PRISM_ESCROW": "0x62C042265991bEa17B07229322A01850974626dA"
       }
     }
   }
@@ -125,17 +148,11 @@ Or add it to Claude Code in one line:
 
 ```sh
 claude mcp add prism \
+  --env PRISM_ESCROW=0x62C042265991bEa17B07229322A01850974626dA \
   --env PRISM_AGENT_KEY=0x<agent wallet private key> \
-  --env PRISM_DAILY_BUDGET_USDG=5 \
   -- npx -y @prismnetwork/mcp
 ```
 
-Codex takes the same server:
-
-```sh
-codex mcp add prism --env PRISM_AGENT_KEY=0x<agent wallet private key> -- npx -y @prismnetwork/mcp
-```
-
 ## Timing
 
 `prism_lease` and `prism_lease_and_run` block while a GPU provisions (usually one to four minutes, occasionally longer on a slow host). Configure your MCP client to allow long tool calls.

package/budget.mjs

@@ -78,6 +78,17 @@ export function readBudget(env = process.env) {
   };
 }
 
+// What a single call is allowed to spend, given what it asked for. The caller's
+// figure is written by the thing being bounded, so it lowers the operator's
+// ceiling and can never lift it.
+export function callCeiling(maxUsdg, ceilingMicros) {
+  if (maxUsdg === undefined || maxUsdg === null) return ceilingMicros;
+  if (typeof maxUsdg !== "number" || !Number.isFinite(maxUsdg) || maxUsdg <= 0) {
+    throw new BudgetError("max_usdg must be a positive number of USDG.");
+  }
+  return Math.min(Math.round(maxUsdg * MICROS), ceilingMicros);
+}
+
 // A lock rather than last-write-wins, because two clients sharing one wallet is
 // the case this file exists for. A lock older than LOCK_STALE_MS belonged to a
 // process that died; breaking it is safe and not breaking it wedges the wallet.
@@ -242,16 +253,64 @@ export class SpendLedger {
   // Replaces the reserved figure with what was actually committed on-chain and
   // pins the receipt to it, so the ledger reads like a statement rather than a
   // list of intentions.
+  //
+  // A payment the endpoint never consumed is redeemed by the next attempt at the
+  // same request, so one transaction can settle more than one reservation.
+  // Booking each would charge the day twice for money that moved once: a
+  // reference already on file keeps its entry and this one is released.
   settle(id, { micros, reference } = {}) {
     if (!id) return false;
     return withLock(this.path, () => {
       const state = readState(this.path);
       const entry = state.entries.find((e) => e.id === id);
       if (!entry) return false;
-      if (Number.isFinite(micros) && micros >= 0) entry.micros = micros;
-      if (reference) entry.reference = reference;
+      const booked = reference ? state.entries.find((e) => e.id !== id && e.reference === reference) : undefined;
+      const target = booked ?? entry;
+      if (Number.isFinite(micros) && micros >= 0) target.micros = micros;
+      if (reference) target.reference = reference;
+      if (booked) state.entries = state.entries.filter((e) => e.id !== id);
       writeState(this.path, state, Date.now());
       return true;
     }, this.lockWaitMs);
   }
 }
+
+/// Records a spend before the money moves, then reconciles it against what
+/// happened. A failure that never reached the chain is given back; anything
+/// that funded an escrow or paid an endpoint keeps its entry and gains the
+/// transaction that proves it, because a ledger that forgets a spend is worse
+/// than no ledger at all.
+export async function recordSpend(book, tool, micros, run) {
+  const id = book.commit({ tool, micros });
+  // Reconciling is bookkeeping and must never be the reason a caller loses a
+  // machine it paid for, or the reason a failure is reported as the wrong
+  // failure. A ledger that cannot be written says so on stderr and the
+  // committed figure stands, which errs towards counting the spend.
+  const reconcile = (action, ...args) => {
+    try {
+      book[action](id, ...args);
+    } catch (err) {
+      console.error(`prism mcp: could not ${action} the ledger entry for ${tool}: ${err?.message ?? err}`);
+    }
+  };
+  try {
+    const { value, settledMicros, reference } = await run();
+    reconcile("settle", { micros: settledMicros, reference });
+    return value;
+  } catch (err) {
+    const paid = err?.body?.funding_hash ?? err?.body?.payment_tx;
+    if (paid) {
+      reconcile("settle", { reference: paid });
+    } else if (err?.code === "chain_error") {
+      // Signed, broadcast, and then something went wrong reading it back, which
+      // is not the same as never having reached the chain. Handing the
+      // reservation back would let one wallet fund escrow after escrow through
+      // an rpc having a bad hour while the day's ceiling reported nothing
+      // spent, so the entry stands at what it reserved.
+      reconcile("settle");
+    } else {
+      reconcile("revert");
+    }
+    throw err;
+  }
+}

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@prismnetwork/mcp",
-  "version": "0.8.4",
+  "version": "0.9.1",
   "description": "MCP server for leasing and running on Prism Network GPUs.",
-  "mcpName": "tech.prismnetwork/mcp",
+  "mcpName": "io.github.winter0x/mcp",
   "type": "module",
   "bin": {
     "prism-mcp": "server.mjs"
   },
   "files": [
-    "server.mjs",
     "budget.mjs",
+    "server.mjs",
     "README.md"
   ],
   "engines": {
@@ -17,31 +17,33 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@prismnetwork/agent-sdk": "^0.6.1",
+    "@phala/dcap-qvl": "^0.6.1",
+    "@prismnetwork/agent-sdk": "^0.7.3",
+    "jose": "^6",
     "viem": "^2"
   },
   "keywords": [
+    "prism",
+    "mcp",
+    "gpu",
     "agent",
     "claude",
-    "codex",
-    "compute",
-    "gpu",
-    "gpu-rental",
-    "mcp",
-    "prism",
-    "x402"
+    "compute"
   ],
   "homepage": "https://prismnetwork.tech",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/prismnetwork-tech/prism.git",
+    "url": "git+https://github.com/winter0x/prism.git",
     "directory": "mcp"
   },
   "bugs": {
-    "url": "https://github.com/prismnetwork-tech/prism/issues"
+    "url": "https://github.com/winter0x/prism/issues"
   },
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "test": "node --test"
   }
 }

package/server.mjs

@@ -2,11 +2,19 @@
 // Prism Network MCP server: lets an MCP client (Claude, agents) see and lease
 // real GPUs. Looking is free and needs no configuration. Leasing spends money,
 // so it needs a wallet: PRISM_AGENT_KEY, PRISM_ESCROW.
+import { createHash } from "node:crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { DEFAULT_IMAGE, DEFAULT_TRUST_FLOOR, PrismAgent, TRUST_CLASSES } from "@prismnetwork/agent-sdk";
-import { BudgetError, SpendLedger, readBudget, stripUnexpanded } from "./budget.mjs";
+import {
+  DEFAULT_IMAGE,
+  DEFAULT_TRUST_FLOOR,
+  hostKeyPolicy,
+  PrismAgent,
+  TRUST_CLASSES,
+  verifyConfidential,
+} from "@prismnetwork/agent-sdk";
+import { BudgetError, SpendLedger, callCeiling, readBudget, recordSpend, stripUnexpanded } from "./budget.mjs";
 
 stripUnexpanded(process.env);
 
@@ -72,35 +80,9 @@ function requireLedger(tool) {
   return ledger;
 }
 
-// Records the spend before the money moves, then reconciles. An attempt that
-// never reached the chain is reverted; anything that funded an escrow keeps its
-// entry and gains the transaction that proves it, because a ledger that forgets
-// a funded lease is worse than no ledger at all.
-async function spending(tool, micros, run) {
-  const book = requireLedger(tool);
-  const id = book.commit({ tool, micros });
-  // Reconciling is bookkeeping and must never be the reason a caller loses a
-  // machine it paid for, or the reason a failure is reported as the wrong
-  // failure. A ledger that cannot be written says so on stderr and the
-  // committed figure stands, which errs towards counting the spend.
-  const reconcile = (action, ...args) => {
-    try {
-      book[action](id, ...args);
-    } catch (err) {
-      console.error(`prism mcp: could not ${action} the ledger entry for ${tool}: ${err?.message ?? err}`);
-    }
-  };
-  try {
-    const { value, settledMicros, reference } = await run();
-    reconcile("settle", { micros: settledMicros, reference });
-    return value;
-  } catch (err) {
-    const funded = err?.body?.funding_hash;
-    if (funded) reconcile("settle", { reference: funded });
-    else reconcile("revert");
-    throw err;
-  }
-}
+// The ledger has to be usable before anything is spent, and the refusal names
+// the tool that asked.
+const spending = (tool, micros, run) => recordSpend(requireLedger(tool), tool, micros, run);
 
 function requireCommand(value) {
   if (typeof value !== "string" || value.trim() === "") {
@@ -112,6 +94,16 @@ function requireCommand(value) {
   return value;
 }
 
+// What the caller can check the machine against if they open their own session.
+// A lease that publishes nothing says so, rather than leaving the field out and
+// letting its absence read as "fine".
+function hostKey(access) {
+  const policy = hostKeyPolicy(access);
+  return policy.fingerprint === null
+    ? { host_key: "unpublished: this lease cannot tell you which machine answers" }
+    : { host_key_fingerprint: policy.fingerprint, host_key_claim: policy.mode };
+}
+
 // What the escrow actually holds, which is what the day's budget should count.
 // Booking the caller's ceiling instead charged a 0.2 USDG lease against a 0.5
 // USDG cap, so a 5 USDG day bought ten leases where it could afford twenty-five.
@@ -121,15 +113,10 @@ function escrowed(quote) {
 }
 
 // The per-call ceiling is the operator's, not the model's: an omitted max_usdg
-// takes the configured cap rather than a hardcoded one, and a stated max_usdg
-// above it is refused when the ledger checks the commit.
+// takes PRISM_MAX_USDG rather than a hardcoded number, and a stated one above it
+// is clamped back down to it.
 function maxDeposit(tool, args) {
-  if (args.max_usdg === undefined) return requireLedger(tool).maxPerCallMicros;
-  const cap = args.max_usdg;
-  if (typeof cap !== "number" || !Number.isFinite(cap) || cap <= 0) {
-    throw new Error("max_usdg must be a positive number of USDG.");
-  }
-  return Math.round(cap * 1e6);
+  return callCeiling(args.max_usdg, requireLedger(tool).maxPerCallMicros);
 }
 
 const PROOF_FEED = process.env.PRISM_PROOF_URL ?? "https://prismnetwork.tech/api/proof";
@@ -146,13 +133,57 @@ async function publicJson(url, what) {
 }
 
 const leases = new Map();
-// Unconsumed inference payments, keyed by endpoint and price, so a failed
-// generation is retried with the same paid header instead of paying again.
-const pendingInference = new Map();
 // null in, null out: a missing price must never render as 0.000000 USDG.
 const usdg = (micros) =>
   micros == null || !Number.isFinite(Number(micros)) ? null : `${(Number(micros) / 1e6).toFixed(6)} USDG`;
 
+/// The SDK pays once and keeps the payment until the endpoint actually serves,
+/// so a generation that never happened is retried with the payment already made.
+async function payAndPost({ base, path, price, payTo, body, tool }) {
+  const served = await agent.payAndPost({ base, path, price, payTo, body, caller: tool });
+  return { ...JSON.parse(served.bytes.toString("utf8")), paid: usdg(price), payment_tx: served.tx };
+}
+
+// What the last few confidential calls sent and received, as digests only, so
+// prism_verify_attestation binds its verdict to the real bytes of a call
+// without keeping anyone's prompt in memory.
+const confidentialCalls = new Map();
+const CONFIDENTIAL_HISTORY = 16;
+
+const sha256Prefixed = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+
+function rememberConfidentialCall(receiptId, record) {
+  if (!receiptId) return;
+  confidentialCalls.set(receiptId, record);
+  while (confidentialCalls.size > CONFIDENTIAL_HISTORY) {
+    confidentialCalls.delete(confidentialCalls.keys().next().value);
+  }
+}
+
+const inferenceBase = () =>
+  (process.env.PRISM_INFERENCE_URL ?? "https://api.prismnetwork.tech/inference").replace(/\/$/, "");
+
+/// What the endpoint currently offers, and the model this call should use.
+async function inferenceOffer(base, requested) {
+  const offer = await publicJson(`${base}/v1/models`, "inference endpoint");
+  const model = requested ?? offer.models?.[0];
+  if (!model || (Array.isArray(offer.models) && !offer.models.includes(model))) {
+    throw new Error(`model must be one of ${offer.models?.join(", ") ?? "(endpoint offered none)"}`);
+  }
+  return { offer, model, unit: BigInt(offer.price_micros ?? 0) };
+}
+
+// The quoted price against the lower of what this call asked for and what the
+// operator allows, so the refusal names whichever ceiling stopped it.
+function withinCap(tool, price, maxUsdg, fallback, what) {
+  const operator = requireLedger(tool).maxPerCallMicros;
+  const cap = callCeiling(maxUsdg ?? fallback, operator);
+  if (price <= 0n || price > BigInt(cap)) {
+    const named = cap === operator ? "PRISM_MAX_USDG" : "max_usdg";
+    throw new Error(`the endpoint quotes ${usdg(price)} ${what}, past the ${named} cap of ${usdg(cap)}.`);
+  }
+}
+
 function sweepExpiredLeases() {
   const now = Date.now();
   for (const [id, lease] of leases) {
@@ -240,7 +271,7 @@ const TOOLS = [
         command: { type: "string", description: "Shell command to run (max 8 KiB)." },
         duration_seconds: { type: "integer", description: "Paid window in seconds (default 900, max 21600). A command still running at the end is killed and reported exit 124." },
         min_vram_mib: { type: "integer", description: "Minimum GPU memory in MiB (default 16000)." },
-        max_usdg: { type: "number", description: "Hard cap on the USDG this lease may cost (default 1). Raise it deliberately for longer leases." },
+        max_usdg: { type: "number", description: "Cost ceiling for this lease in USDG. It lowers the operator's PRISM_MAX_USDG and cannot raise it; omitted, that ceiling applies. See prism_budget." },
       },
       required: ["command"],
     },
@@ -267,13 +298,64 @@ const TOOLS = [
       properties: {
         prompt: { type: "string", description: "The prompt to generate from (max 32 KiB)." },
         model: { type: "string", description: "Model to use; defaults to the endpoint's first offered model." },
-        max_usdg: { type: "number", description: "Refuse if the quoted price exceeds this (default 0.05)." },
+        max_usdg: { type: "number", description: "Refuse if the quoted price exceeds this (default 0.05). The operator's PRISM_MAX_USDG binds it either way." },
       },
       required: ["prompt"],
     },
     ...spends,
     annotations: { title: "Buy one LLM generation", ...spends.annotations },
   },
+  {
+    name: "prism_infer_batch",
+    description: "Buy many LLM generations from Prism's managed inference endpoint in one paid call. Every prompt runs whole on a rented GPU, spread across every GPU the endpoint holds, so a list of prompts finishes far sooner than the same prompts sent one at a time. Costs the single-generation price times the number of prompts. Returns every answer in order plus a Merkle receipt naming the leases that did the work. Use it for evals, dataset passes, rollouts, or anything with more than a handful of independent prompts.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        prompts: {
+          type: "array",
+          items: { type: "string" },
+          minItems: 1,
+          maxItems: 64,
+          description: "Independent prompts, answered in the order given (each max 32 KiB).",
+        },
+        model: { type: "string", description: "Model to use; defaults to the endpoint's first offered model." },
+        max_usdg: { type: "number", description: "Refuse if the quoted total exceeds this (default 0.5). The operator's PRISM_MAX_USDG binds it either way." },
+      },
+      required: ["prompts"],
+    },
+    ...spends,
+    annotations: { title: "Buy many LLM generations", ...spends.annotations },
+  },
+  {
+    name: "prism_confidential_infer",
+    description: "Buy one LLM generation that runs inside a GPU TEE, with the message contents encrypted end to end to a key the enclave's own attestation commits to, so Prism's relay in between carries ciphertext and cannot read the prompt or the answer. Costs a little more than prism_infer. Returns the answer, the cost, and a receipt id the workload signed over the exact bytes of the exchange; pass that id to prism_verify_attestation to check the whole chain. Use it for anything the operator of an ordinary endpoint should not be able to read.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        prompt: { type: "string", description: "The prompt to generate from." },
+        model: { type: "string", description: "Confidential model to use; defaults to the endpoint's first." },
+        max_tokens: { type: "integer", description: "Cap on generated tokens (default 512). The price is quoted against this cap." },
+        max_usdg: { type: "number", description: "Refuse if the quoted price exceeds this (default 0.25). The operator's PRISM_MAX_USDG binds it either way." },
+        e2ee: { type: "boolean", description: "Encrypt message contents to the attested enclave key (default true). Turn it off only when the relay is allowed to read the prompt." },
+      },
+      required: ["prompt"],
+    },
+    ...spends,
+    annotations: { title: "Buy one confidential LLM generation", ...spends.annotations },
+  },
+  {
+    name: "prism_verify_attestation",
+    description: "Check a confidential generation against its signed receipt and the hardware behind it: the TDX quote verifies to Intel's root and commits to the key set that signed the receipt, the boot log replays to the measurement in that quote, the receipt covers the exact bytes of this call, the upstream that ran the model was itself verified, and the GPU is attested by NVIDIA. Returns every check with its result, including the ones that cannot be established today. Needs no wallet.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        receipt_id: { type: "string", description: "The receipt_id from prism_confidential_infer." },
+        model: { type: "string", description: "Model to fetch GPU evidence for; defaults to the one recorded for this receipt." },
+      },
+      required: ["receipt_id"],
+    },
+    annotations: { title: "Check a confidential generation", ...reads },
+  },
   {
     name: "prism_lease_and_run",
     description: "Lease a GPU, run one shell command on it, and return the output. The lease stays alive (use prism_run for more commands, prism_end_lease to release). Prefer this for a single command; use prism_lease when you'll run several.",
@@ -288,7 +370,7 @@ const TOOLS = [
           enum: TRUST_CLASSES,
           description: "Refuse suppliers below this trust class (default 'open'). Raise it for anything the host operator must not read.",
         },
-        max_usdg: { type: "number", description: "Hard cap on the USDG this lease may cost (default 1). Raise it deliberately for longer leases." },
+        max_usdg: { type: "number", description: "Cost ceiling for this lease in USDG. It lowers the operator's PRISM_MAX_USDG and cannot raise it; omitted, that ceiling applies. See prism_budget." },
       },
       required: ["command"],
     },
@@ -308,7 +390,7 @@ const TOOLS = [
           enum: TRUST_CLASSES,
           description: "Refuse suppliers below this trust class (default 'open'). Raise it for anything the host operator must not read.",
         },
-        max_usdg: { type: "number", description: "Hard cap on the USDG this lease may cost (default 1). Raise it deliberately for longer leases." },
+        max_usdg: { type: "number", description: "Cost ceiling for this lease in USDG. It lowers the operator's PRISM_MAX_USDG and cannot raise it; omitted, that ceiling applies. See prism_budget." },
       },
     },
     ...spends,
@@ -525,68 +607,126 @@ async function handle(name, args) {
       throw new Error("prompt is required.");
     }
     requireWallet(name);
-    const base = (process.env.PRISM_INFERENCE_URL ?? "https://api.prismnetwork.tech/inference").replace(/\/$/, "");
-    const offer = await publicJson(`${base}/v1/models`, "inference endpoint");
-    const model = args.model ?? offer.models?.[0];
-    if (!model || (Array.isArray(offer.models) && !offer.models.includes(model))) {
-      throw new Error(`model must be one of ${offer.models?.join(", ") ?? "(endpoint offered none)"}`);
+    const base = inferenceBase();
+    const { offer, model, unit } = await inferenceOffer(base, args.model);
+    withinCap(name, unit, args.max_usdg, 0.05, "per generation");
+    return spending(name, Number(unit), async () => {
+      const value = await payAndPost({
+        base,
+        path: "/v1/inference",
+        price: unit,
+        payTo: offer.pay_to,
+        body: { model, prompt: args.prompt },
+        tool: "prism_infer",
+      });
+      return { value, settledMicros: Number(unit), reference: value.payment_tx };
+    });
+  }
+  if (name === "prism_infer_batch") {
+    const prompts = args.prompts;
+    if (!Array.isArray(prompts) || !prompts.length) {
+      throw new Error("prompts must be a non-empty array of strings.");
     }
-    const price = BigInt(offer.price_micros ?? 0);
-    const cap = args.max_usdg ?? 0.05;
-    if (typeof cap !== "number" || !Number.isFinite(cap) || cap <= 0) {
-      throw new Error("max_usdg must be a positive number of USDG.");
+    if (prompts.some((p) => typeof p !== "string" || p.trim() === "")) {
+      throw new Error("every prompt must be a non-empty string.");
     }
-    if (price <= 0n || price > BigInt(Math.round(cap * 1e6))) {
-      throw new Error(`the endpoint quotes ${usdg(price)} per generation, past the ${cap} USDG cap.`);
+    if (prompts.length > 64) {
+      throw new Error(`a batch takes at most 64 prompts; ${prompts.length} were given.`);
     }
-    const pendingKey = `${base}:${price}`;
-    let pending = pendingInference.get(pendingKey);
-    // A kept payment was already charged and already counted. Only a new
-    // transfer touches the ledger, or a retry would bill the day twice for one
-    // generation.
-    if (!pending) {
-      pending = await spending(name, Number(price), async () => {
-        const paymentTx = await agent.transferUsdg(offer.pay_to, price);
-        const signature = await agent.account.signMessage({ message: paymentTx });
-        return {
-          reference: paymentTx,
-          value: {
-            tx: paymentTx,
-            header: Buffer.from(JSON.stringify({ txHash: paymentTx, signature })).toString("base64"),
-          },
-        };
+    requireWallet(name);
+    const base = inferenceBase();
+    const { offer, model, unit } = await inferenceOffer(base, args.model);
+    const price = unit * BigInt(prompts.length);
+    withinCap(name, price, args.max_usdg, 0.5, `for ${prompts.length} generations`);
+    return spending(name, Number(price), async () => {
+      const value = await payAndPost({
+        base,
+        path: "/v1/batch",
+        price,
+        payTo: offer.pay_to,
+        body: { model, prompts },
+        tool: "prism_infer_batch",
       });
-      pendingInference.set(pendingKey, pending);
+      return { value, settledMicros: Number(price), reference: value.payment_tx };
+    });
+  }
+  if (name === "prism_confidential_infer") {
+    if (typeof args.prompt !== "string" || args.prompt.trim() === "") {
+      throw new Error("prompt is required.");
     }
-    // A cold endpoint holds the request through provisioning; when it answers
-    // 503 instead, the payment is not consumed and the same header retries.
-    const deadline = Date.now() + 600_000;
-    for (;;) {
-      const res = await fetch(`${base}/v1/inference`, {
-        method: "POST",
-        headers: { "content-type": "application/json", "x-payment": pending.header },
-        body: JSON.stringify({ model, prompt: args.prompt }),
-        signal: AbortSignal.timeout(620_000),
+    requireWallet(name);
+    const base = inferenceBase();
+    // The endpoint quotes inside the SDK, so the day is charged the ceiling up
+    // front and corrected to the quoted price once the call has been served.
+    const cap = callCeiling(args.max_usdg ?? 0.25, requireLedger(name).maxPerCallMicros);
+    const run = await spending(name, cap, async () => {
+      const served = await agent.confidentialInfer({
+        prompt: args.prompt,
+        model: args.model,
+        maxTokens: args.max_tokens ?? 512,
+        maxUsdg: cap / 1e6,
+        e2ee: args.e2ee ?? true,
+        endpoint: base,
       });
-      const body = await res.json().catch(() => null);
-      if (res.status === 200 && body) {
-        pendingInference.delete(pendingKey);
-        return { ...body, paid: usdg(price), payment_tx: pending.tx };
-      }
-      const last = body?.detail ?? body?.error ?? `status ${res.status}`;
-      // 503 means the box is warming; a 402 for a payment that is merely too
-      // young (confirmations still landing, receipt not yet visible) heals by
-      // itself. Everything else is final.
-      const retryable =
-        res.status === 503 ||
-        (res.status === 402 && ["insufficient_confirmations", "tx_not_found"].includes(body?.error));
-      if (!retryable || Date.now() > deadline) {
-        throw new Error(
-          `inference failed: ${last}. The payment (tx ${pending.tx}) was not consumed and is kept; the next prism_infer call retries with it instead of paying again.`,
-        );
-      }
-      await new Promise((r) => setTimeout(r, 15_000));
+      return { value: served, settledMicros: Number(served.priceMicros), reference: served.tx };
+    });
+    rememberConfidentialCall(run.receiptId, {
+      base,
+      model: run.model,
+      e2ee: run.e2ee,
+      keysetDigest: run.keysetDigest,
+      responseHash: sha256Prefixed(run.bytes.response),
+      requestHash: sha256Prefixed(run.bytes.request),
+      restoredRequestHash: run.bytes.restoredRequest ? sha256Prefixed(run.bytes.restoredRequest) : null,
+    });
+    return {
+      model: run.model,
+      content: run.content,
+      usage: run.usage,
+      receipt_id: run.receiptId,
+      paid: usdg(run.priceMicros),
+      payment_tx: run.tx,
+      e2ee: run.e2ee
+        ? "on: the prompt and the answer were encrypted to the enclave's attested key, and the relay carried ciphertext"
+        : "off: the relay could read this prompt",
+      next: `prism_verify_attestation with receipt_id ${run.receiptId} checks the hardware, the receipt and the GPU behind this answer`,
+    };
+  }
+  if (name === "prism_verify_attestation") {
+    if (typeof args.receipt_id !== "string" || args.receipt_id.trim() === "") {
+      throw new Error("receipt_id is required: the id prism_confidential_infer returned.");
     }
+    // Without the bytes of the call, a receipt still proves what the workload
+    // signed, but not that it signed this exchange. That is `incomplete`, and it
+    // is a different thing to tell an agent than a failure.
+    const remembered = confidentialCalls.get(args.receipt_id) ?? {};
+    const bound = remembered.responseHash != null;
+    const result = await verifyConfidential({
+      base: remembered.base ?? inferenceBase(),
+      receiptId: args.receipt_id,
+      model: args.model ?? remembered.model,
+      e2ee: Boolean(remembered.e2ee),
+      requestHash: remembered.requestHash ?? null,
+      responseHash: remembered.responseHash ?? null,
+      restoredRequestHash: remembered.restoredRequestHash ?? null,
+      expectedKeysetDigest: remembered.keysetDigest ?? null,
+    });
+    const mark = { pass: "ok", fail: "FAIL", skip: "skip" };
+    return {
+      receipt_id: args.receipt_id,
+      verdict: result.verdict,
+      verdict_means: {
+        verified: "every check that ran passed, and the only skips are the documented ones",
+        incomplete: "nothing failed, and evidence some check needed was not available here",
+        failed: "a check failed",
+      }[result.verdict],
+      bound_to_this_session: bound,
+      ...(bound
+        ? {}
+        : { unbound_because: "this server has no record of that call, so the request and response checks could not run" }),
+      measured_source: result.provenance,
+      checks: result.checks.map((c) => `${mark[c.status]} ${c.title}${c.detail ? `: ${c.detail}` : ""}`),
+    };
   }
   if (name === "prism_lease_and_run" || name === "prism_lease") {
     if (name === "prism_lease_and_run") requireCommand(args.command);
@@ -607,7 +747,16 @@ async function handle(name, args) {
     const summary = {
       lease_id: lease.leaseId,
       funding_tx: lease.fundingHash,
-      ssh: { host: lease.access.ssh_host, port: lease.access.ssh_port, user: lease.access.ssh_user },
+      // `prism_run` checks this itself. It is in the summary because the
+      // caller is being handed an address they may connect to by hand, and an
+      // address with no key to check is an invitation to accept whatever
+      // answers.
+      ssh: {
+        host: lease.access.ssh_host,
+        port: lease.access.ssh_port,
+        user: lease.access.ssh_user,
+        ...hostKey(lease.access),
+      },
       trust: lease.quote?.trust_class ?? "open",
       expires_at: lease.access.expires_at,
     };
@@ -699,7 +848,7 @@ async function handleVault(name, args) {
   throw new Error(`unknown tool ${name}`);
 }
 
-const server = new Server({ name: "prism", version: "0.8.4" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "prism", version: "0.9.0" }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   try {