Build against metered GPU infrastructure.

The public web application is the identity boundary. It verifies Privy access tokens, establishes an HTTP-only same-origin session, rate-limits requests, and signs service-to-service identity assertions. Browsers never receive orchestration signing keys, settlement keys, device keys, or provider credentials.

1. 01

   Prepare the workload

   Publish a Linux/amd64 OCI image to a public registry and address it by its complete immutable sha256 digest.

2. 02

   Prepare access

   Create a disposable Ed25519 key. Submit only the single-line public key; the private key must never leave the renter machine.

3. 03

   Authenticate

   Use the console to create a Privy-backed Prism session and connect the wallet that will fund escrow.

4. 04

   Quote and fund

   Request a five-minute quote, approve the exact maximum USDG amount, and call createLease with the quote-derived reference.

5. 05

   Confirm and connect

   Confirm the finalized funding transaction, poll the lease until active, retrieve access, and connect over SSH. The SDK pins the host key for the life of the lease and reports what that pin is worth: a key the node published under its own device key, or, for capacity brokered through a third-party cloud, no publishable key at all. Pass requireHostKey to refuse a lease that cannot be pinned.

Interactive access uses Privy. The browser obtains an access token, posts it to/api/auth/session, and receives a secure, HTTP-only, same-site cookie with a one-hour maximum age. Mutation endpoints require both that session and a same-origin request.

Browser integrations use https://prismnetwork.tech/api/app. Responses are JSON, never cached, and include X-Request-Id. Mutation bodies must be application/json and no larger than 256 KiB.

{
  "request": {
    "image": "docker.io/nvidia/cuda@sha256:<64 lowercase hex chars>",
    "duration_seconds": 3600,
    "min_vram_mib": 45000,
    "preferred_node_id": null
  }
}

{
  "quote_id": "9d417fc0-6f42-4d8b-a44f-9ab3cf1bc41f",
  "node_id": "0x<32-byte node id>",
  "image": "docker.io/nvidia/cuda@sha256:<digest>",
  "duration_seconds": 3600,
  "min_vram_mib": 45000,
  "rate_per_second": 222,
  "maximum_escrow": 799200,
  "expires_at": "2026-07-20T18:00:00Z"
}

Matching constraints#

• image must be public, whitespace-free, at most 512 characters, and end in a complete @sha256: digest.
• duration_seconds must be between 1 and 21,600 seconds.
• min_vram_mib must be a positive integer compatible with an online offer.
• preferred_node_id is optional; omit it for deterministic best-match selection.
• The resulting maximum escrow cannot exceed 50 USDG.

A quote does not reserve capacity or move funds. The renter wallet sends two sequential transactions: an exact USDG approval followed byLeaseEscrowV1.createLease. The client reference is the Keccak-256 hash of the UTF-8 quote UUID.

const maximum = BigInt(quote.rate_per_second)
  * BigInt(quote.duration_seconds);
const clientReference = keccak256(toBytes(quote.quote_id));

await wallet.writeContract({
  address: USDG,
  abi: erc20Abi,
  functionName: "approve",
  args: [LEASE_ESCROW, maximum],
});

await wallet.writeContract({
  address: LEASE_ESCROW,
  abi: escrowAbi,
  functionName: "createLease",
  args: [quote.node_id, quote.duration_seconds, clientReference],
});

Wait for both receipts and reject any reverted status. Then confirm the funding transaction through the application API. Confirmation independently verifies the finalized LeaseFunded event, node, duration, renter wallet, deposit, and quote-derived client reference.

{
  "quote_id": "9d417fc0-6f42-4d8b-a44f-9ab3cf1bc41f",
  "transaction_hash": "0x<funding transaction hash>",
  "ssh_authorized_key": "ssh-ed25519 AAAA... workstation"
}

Transitions are idempotent and persisted before external side effects. Provider instance IDs, chain transaction bytes, nonces, hashes, confirmation blocks, and final-state evidence survive worker restarts. A ten-minute provision timeout is the refund boundary for leases that never reach billable access.

Operators can also serve open-class leases from machines they already own, with the card left on the host driver and an optional workload filling the time between leases. Serving leases from a machine you already own covers the host requirements, the preflight, and the idle workload.

Container requirements#

• Publicly pullable Linux/amd64 OCI image.
• Immutable registry digest; tags alone are rejected.
• Compatible with the host NVIDIA driver and requested CUDA major version.
• No embedded credentials. Runtime access is injected separately.
• Workspace storage is ephemeral and must be treated as disposable.

Chain ID

4663

RPC

rpc.mainnet.chain.robinhood.com

Maximum lease

6 hours

Maximum escrow

50 USDG

Provision timeout

10 minutes

Dispute window

5 minutes

Platform fee

10%

Network concurrency

25 active leases

Billing begins only after Prism confirms runtime and access readiness onchain. Closing revokes access first, destroys the execution environment, and then assembles bounded usage evidence.

1. 01

   Observe

   Clamp confirmed runtime to the funded duration and preserve provider or physical-node execution evidence.

2. 02

   Propose

   Submit an EIP-712 settlement carrying usage seconds, receipt hash, nonce, and deadline.

3. 03

   Dispute

   Hold finalization for the escrow dispute window, currently 5 minutes. A renter can dispute; the governance Safe resolves disputed outcomes.

4. 04

   Finalize

   Pay 90% of the charge to the provider, route the 10% platform fee, and refund unused escrow.

5. 05

   Publish

   Verify the final chain event and expose a sanitized, canonical receipt in the public proof feed.

Public receipts omit renter/provider wallet addresses, precise geography, image digests, terminal output, files, and private telemetry. Proof establishes a platform-attested usage record paired with a final onchain event; it does not prove faithful workload execution or confidential computing.

Report a vulnerability#

Do not publish an exploitable vulnerability in a public issue. Use this repository's GitHub private vulnerability reporting or email security@prismnetwork.tech. Include the affected commit, component, reproduction, impact, and suggested containment. Never include live credentials or renter data.

Production availability#

Prism expands public capacity after end-to-end production validation covers quoting, funding, provisioning, readiness, teardown, settlement, refunds, provider payment, and proof publication. Failed validations preserve diagnostic evidence and pause new lease funding until the affected service is restored.

• Retry 429 only after Retry-After.
• Retry transient 503 responses with exponential backoff and a maximum delay, without changing the request.
• Before resubmitting a funding transaction, verify the wallet receipt and account lease history.
• funding_not_final is expected before the required confirmation threshold and can be polled safely.
• Treat other 4xx responses as non-retryable until the request or account state changes.

Autonomous agents integrate without a browser or Privy. An agent proves control of its funding wallet by signing a short-lived challenge, exchanges the signature for a bearer session, and drives the same renter surface — offer discovery and the lease lifecycle — over the /api/agent endpoints. Escrow, readiness, metering, and settlement are identical to the browser path.

import { PrismAgent, DEFAULT_IMAGE } from "@prismnetwork/agent-sdk";

const agent = new PrismAgent({
  privateKey: process.env.AGENT_KEY,
  escrow: "0xfD4228eEEfC49e4b76A0CD40af9fdd546220B2FD",
});

await agent.authenticate();
const lease = await agent.lease({ image: DEFAULT_IMAGE, durationSeconds: 900, minVramMib: 16000 });
const out = await agent.run(lease, "nvidia-smi");
console.log(out.stdout);
await agent.endLease(lease);

Clients#

Four packages reach the same renter surface, so the choice is only which runtime you are already in. Every one of them reads offers without a wallet; a key is needed to lease, never to look.

Node

npm i @prismnetwork/agent-sdk · lease, run over SSH, release

Python

pip install prismnetwork · the same lifecycle from a script

Coinbase AgentKit

pip install prism-agentkit · an action provider, so a LangGraph agent rents its own GPU

MCP

claude mcp add prism -- npx -y @prismnetwork/mcp · eleven tools in any MCP client

A workspace is administered by someone else, so anything that must stay private belongs in the vault instead. Items are sealed under a key derived from a wallet signature on the renter's own machine and never transmitted, which leaves the control plane holding ciphertext and no means of reading it. The browser and the agent SDK run the same client, so one wallet opens one vault from either.

await agent.vault.unlock();

const card = await agent.vault.put(
  { pan: "4111111111111111", exp: "09/29" },
  { label: "billing card" },
);

// Sealed at the default floor, so this is refused on open capacity
// rather than exposing the card to a host that can read it.
await agent.vault.releaseInto(lease, card.item_id, { json: true });

Properties and limits#

• The account, item, version, and trust floor are authenticated into the ciphertext, so relocating an item, replaying an old version, or lowering its floor produces a failed decrypt rather than a wrong answer.
• Writes are compare-and-set. Omitting previous_version creates and fails on an occupied item, so concurrent writers cannot silently drop one another.
• Every item names the weakest workspace class it may be released into. New items default to confidential, above what the network can serve, so a release into current capacity is refused.
• Signatures are deterministic, so the same wallet reproduces the same key on any machine. No recovery copy is held anywhere; losing the wallet loses the vault.
• Ciphertext is capped at 160 KiB per item, with 512 items per account.