{
  "markdown": "# Prism Network\n\n[![Validate](https://github.com/prismnetwork-tech/prism/actions/workflows/validate.yml/badge.svg)](https://github.com/prismnetwork-tech/prism/actions/workflows/validate.yml)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/prismnetwork-tech/prism/badge)](https://securityscorecards.dev/viewer/?uri=github.com/prismnetwork-tech/prism)\n[![License](https://img.shields.io/badge/license-Apache--2.0-ccff00)](LICENSE)\n[![Headless agent SDK](https://img.shields.io/badge/agents-headless%20SDK-ccff00)](sdk/README.md)\n[![MCP + x402](https://img.shields.io/badge/agents-MCP%20%2B%20x402-ccff00)](mcp/README.md)\n[![Wallet-signature auth](https://img.shields.io/badge/agents-wallet%20auth-ccff00)](examples/agent-quickstart/README.md)\n\nPrism Network is open infrastructure for metered GPU compute. The current\nsystem implements account and wallet onboarding, GPU offer discovery, USDG\nescrow, workload provisioning, time-limited access, metering, settlement and\npublic receipt generation.\n\nPrism has two execution paths:\n\n- **Independent nodes:** Ubuntu 24.04 x86-64 hosts run public OCI images in Kata\n  VM-backed containers with exclusive NVIDIA VFIO passthrough. Access uses\n  short-lived SSH or Jupyter credentials through an outbound-only mTLS tunnel.\n- **Vast broker:** a bonded broker provisions disposable L40S instances and\n  exposes direct SSH. This path relies on provider-reported readiness and\n  evidence; it does not provide Kata/VFIO isolation, the Prism gateway, or\n  Jupyter access.\n\nInteractive raw GPU leases are what the network serves today. A lease can also\ncarry a single command instead of a session, which runs on an independent node\nand reports back what it printed, but no independent node has completed the\nhardware canary yet, so nothing has run that path in production. Managed\ninference is not implemented.\n\n## Current state\n\nVerified on 2026-07-20:\n\n| Area | Status |\n| --- | --- |\n| Public web and API | Live at [prismnetwork.tech](https://prismnetwork.tech), with one Vast-backed L40S offer visible |\n| Robinhood Chain contracts | Deployed on mainnet; the lease escrow is live |\n| Vast execution | Implemented and locally lifecycle-tested; a funded mainnet canary has not been completed |\n| Independent Kata nodes | Daemon, gateway, certificates, commands, tunnel and workspace lifecycle are implemented and integration-tested without physical GPU hardware |\n| Settlement and proof | Workers and local end-to-end flows are implemented; no public mainnet settlement receipt exists yet |\n| Batch commands | Implemented on the independent-node path; never executed on physical hardware |\n| Managed inference | Planned, not implemented |\n\nThis is an unaudited pre-production system, so do not put production traffic or\nserious money on it yet.\n\nWhat a supplier protects is stated per offer rather than as one blanket\nwarning. Every offer, quote, lease and receipt carries a trust class (`open`,\n`isolated`, `attested` or `confidential`), and renters can require a minimum\ninstead of trusting prose:\n\n```bash\ncurl https://api.prismnetwork.tech/v1/offers?min_trust=isolated\n```\n\nThe class is derived by the control plane from evidence it can check, never\nasserted by a supplier, and it is clamped to what the network can currently\nverify. `isolated` requires a GPU attestation report that validates to a pinned\nNVIDIA root and answers a challenge issued to the node presenting it, so a\nmachine cannot claim that class for itself. `attested` requires a launch\nmeasurement of the guest that ran the lease, verified to AMD's root and bound to\nthe SSH host key generated inside that guest, so the proof is about the session\nthe renter is in. It proves what started and not that nobody watched. All\ncapacity live today is `open`, which means the host operator can read anything\nthe workload touches, and nothing above it is served until the reference\nmaterial both classes check against is captured from real hardware and verifies.\nSee [docs/ATTESTATION.md](docs/ATTESTATION.md) for what is checked and\n[docs/SECURITY_MODEL.md](docs/SECURITY_MODEL.md) for what each class does and\ndoes not promise.\n\nPrivate data does not have to live in a workspace to be useful. Cards, identity\ndocuments and credentials go in the vault, sealed on your machine under a key\nderived from a wallet signature and never sent, so Prism stores ciphertext and\nholds no way to read it:\n\n```js\nawait agent.vault.unlock();\nconst card = await agent.vault.put({ pan: \"4111111111111111\" }, { label: \"billing\" });\n```\n\nEvery item carries the weakest class of workspace it may be shown to, and new\nitems default to `confidential` — above what the network can serve — so handing\none to today's capacity is refused rather than quietly allowed. The account,\nversion and trust floor are authenticated into the ciphertext, which makes\nmoving an item, replaying an old version, or lowering its floor a failed\ndecrypt instead of a successful lie. [docs/VAULT.md](docs/VAULT.md) has the\nconstruction and its limits.\n\n## Mainnet contracts\n\nThe V1 contracts are non-upgradeable and `LeaseEscrowV1` is live. They have not\nreceived an independent audit. Blockscout reports `NodeRegistryV1` as fully\nsource-verified and `LeaseEscrowV1` as partially source-verified. The escrow's\nexecutable bytecode matches this tree, while its trailing Solidity metadata\nhash differs.\n\nYou do not have to take that on trust. `./scripts/verify-deployed-bytecode.sh`\nrebuilds both contracts and compares them against the code live on chain using\nonly the public RPC, masking immutables and reporting the metadata blob\nseparately:\n\n```\nNodeRegistryV1 0xe3b7…8f01: executable code matches, metadata differs\nLeaseEscrowV1  0x71Df…cDeD: executable code matches, metadata differs\n```\n\n| Contract | Address |\n| --- | --- |\n| Canonical USDG | [`0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168`](https://robinhoodchain.blockscout.com/address/0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168) |\n| `NodeRegistryV1` | [`0xa7Ca8e43c599b978095c391bd018A35BA6e7B71D`](https://robinhoodchain.blockscout.com/address/0xa7Ca8e43c599b978095c391bd018A35BA6e7B71D) |\n| `LeaseEscrowV1` | [`0xfD4228eEEfC49e4b76A0CD40af9fdd546220B2FD`](https://robinhoodchain.blockscout.com/address/0xfD4228eEEfC49e4b76A0CD40af9fdd546220B2FD) |\n| Governance Safe | [`0xAF1113cE9E65D79daA87005A729Ab9Bc1A9fc60a`](https://robinhoodchain.blockscout.com/address/0xAF1113cE9E65D79daA87005A729Ab9Bc1A9fc60a) |\n\nAdministration, emergency pause and dispute resolution are held by a 2-of-2\ngovernance Safe. Network settings and the USDG address should always\nbe checked against the\n[official Robinhood Chain documentation](https://docs.robinhood.com/chain/connecting/)\nand [contract registry](https://docs.robinhood.com/chain/contracts/).\n\n## Architecture\n\n```text\nBrowser + wallet\n       |\n       v\nNext.js web -----> Rust control plane -----> PostgreSQL\n                         |\n              +----------+-----------+\n              |                      |\n              v                      v\n      lifecycle worker       settlement/proof workers\n              |                      |\n       +------+-------+              v\n       |              |       Robinhood Chain\n       v              v\nVast instance    access gateway\ndirect SSH       mTLS tunnel/relay\n                       |\n                       v\n               prismd + Kata/VFIO\n```\n\nThe repository contains:\n\n- `apps/web`: Next.js account, marketplace, supplier, operator and proof UI.\n- `crates`: shared Rust protocol and persistence libraries.\n- `services`: Rust control plane, access gateway and operations monitor.\n- `workers`: lifecycle, settlement and proof workers.\n- `node/prismd`: independent-node runtime and workspace supervisor.\n- `contracts`: PRISM bond, USDG escrow and administration contracts.\n- `sdk`: headless agent SDK for wallet-signature USDG leasing.\n- `mcp`: Model Context Protocol server exposing leasing to MCP clients.\n- `x402`: pay-per-job GPU execution over HTTP 402.\n- `inference`: managed inference, a warm ollama lease behind an x402-paid endpoint.\n- `integrations`: LangChain, CrewAI, AG2/AutoGen, elizaOS and Virtuals GAME adapters.\n- `examples/trading`: agents that rent a GPU for research, then trade on what it finds.\n- `examples/confidential`: an agent pays for TEE-served inference and verifies the attestation itself.\n- `deploy/ec2`: lean Vast launch topology with the web application on Render.\n- `deploy/lightsail`: full single-host reference topology.\n- `deploy/node`: Ubuntu node service units and configuration.\n- `infra`: an AWS reference architecture, not the active lean deployment.\n- `docs`: design, security boundary, proof format and release documentation.\n\nSee [architecture](docs/ARCHITECTURE.md), [security model](docs/SECURITY_MODEL.md)\nand [release gates](docs/RELEASE_GATES.md) before operating the system.\n\n## Agent access\n\nAutonomous agents integrate without a browser. An agent proves control of its\nfunding wallet by signing a short-lived challenge, exchanges it for a bearer\nsession, and drives the same renter surface — offer discovery and the lease\nlifecycle — over the `/api/agent` endpoints. Escrow, readiness, metering and\nsettlement are identical to the browser path, and the agent boundary reaches\nonly renter routes.\n\n- [`sdk`](sdk/README.md) — `@prismnetwork/agent-sdk`, headless USDG-funded leasing for Node.\n- [`mcp`](mcp/README.md) — `@prismnetwork/mcp`, the same leasing exposed as Model Context Protocol tools.\n- [`x402`](x402/README.md) — `@prismnetwork/x402`, pay-per-job GPU execution over HTTP 402.\n- [`integrations`](integrations/README.md) — the same tools in the dialect of\n  LangChain, CrewAI, AG2/AutoGen, elizaOS, Virtuals GAME and Coinbase AgentKit,\n  plus how to pair Prism with Robinhood's agentic trading MCP.\n\nThe Node and Python packages are published under the `@prismnetwork` npm scope\nand as `prismnetwork`/`prism-*` on PyPI. An agent\nworkspace is still a disposable environment, not confidential computing;\nanything an agent needs to keep private belongs in its vault, which the same\nSDK reaches through `agent.vault`.\n\n## Verification\n\nThe fast pull-request gate checks the web application, production build,\nsecrets and repository isolation:\n\n```sh\npnpm install --frozen-lockfile\npnpm check\n```\n\nThe full local gate additionally runs the Rust and Solidity suites, audits and\nsecurity scanners, PostgreSQL and Valkey integrations, Anvil lifecycle tests,\nmTLS relay tests, load and recovery checks, deployment validation and\nobservability checks:\n\n```sh\npnpm check:full\n```\n\nThe full gate passed locally on 2026-07-20 with 23 web tests, 57 Rust tests and\n18 Foundry tests, including fuzz and invariant coverage. That run used\nsimulated/containerized infrastructure; it is not evidence of physical\nNVIDIA/Kata/VFIO execution or a funded mainnet lease.\n\nThe hosted full gate is manual and has not yet produced a public run:\n\n```sh\ngh workflow run full-validate.yml --ref <branch>\n```\n\nRequired toolchains are Node.js 24.14, pnpm 10.34.5, Rust 1.94.1, Foundry 1.5,\nDocker with Compose and ripgrep.\n\n## Remaining release gates\n\n- Keep the escrow paused until a capped, funded mainnet canary completes from\n  deposit through refund or settlement.\n- Validate CUDA readiness, Kata isolation, VFIO assignment, egress controls and\n  teardown on physical NVIDIA hardware.\n- Complete live KMS signing and failure-recovery evidence for lifecycle and\n  settlement workers.\n- Exercise real Privy signup, external and embedded wallets, SSH access and\n  Jupyter access against the release deployment.\n- Publish the first confirmed proof receipt and test the independent daily X\n  digest outbox.\n- Run applied-host backup/restore, load, failover and incident-response drills.\n- Obtain independent smart-contract and infrastructure security review before\n  raising contract caps.\n\nCopy only the example environment files needed for your target. Never commit\nenvironment files, credentials, deployment outputs or generated artifacts.\n\n## Contributing\n\nRead [CONTRIBUTING.md](CONTRIBUTING.md), the\n[Code of Conduct](CODE_OF_CONDUCT.md) and [governance](GOVERNANCE.md) before\nopening a change. Security reports must follow [SECURITY.md](SECURITY.md) and\nmust not be filed as public issues.\n\n## License\n\nCode is licensed under the [Apache License 2.0](LICENSE). The Prism Network\nname and visual identity are governed separately by [TRADEMARKS.md](TRADEMARKS.md).\n",
  "bytes": 12448,
  "sha": "43187f068e55e4a4280eac181d05eeb0c0fb347d506e3bd126021d221d16f30f",
  "repo_slug": "prismnetwork-tech/prism",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_prismnetwork_tech_mcp_af3aacfd/readme"
}