For AI coding agents
Claude Code, Codex or any agent with a shell can start a Confidential VM (Intel TDX with an NVIDIA GPU), run a job on it, check that the machine is genuine, and release it. You give the agent a key limited to the machines it starts, with a daily budget and no access to billing.
vgpu up rtx6000b-small --name job1 --ttl 1h --max-price 4 -yA Confidential VM with one RTX PRO 6000 Blackwell, $3.80/hour right now, 2 available. One hour is charged at start and the unused part comes back on release. Once the hour is up our server releases the VM (it checks every 15 minutes, and billing runs until the release); --max-price refuses the launch if the price has moved above $4.
§ 01 / setup
In API Keys, choose Agent key (limited). The defaults are the scopes read, rent and manage, only the machines this key starts, and a budget of $20 per UTC day. An agent key never has the billing scope and cannot create keys.
Add the SSH public key of the computer the agent runs on under SSH Keys: a Confidential VM binds the keys of the account when it is created, and a key limited to its own machines cannot add one.
pip install "voltagegpu-cli[verify]>=2.0.0" export VOLT_API_KEY=volt_... vgpu whoami
Set VOLT_API_KEY yourself, in the environment of the agent; it is never printed and never goes into a file of the project. vgpu whoami shows the scopes, the visibility, the budgets and the spend of the key, never the key itself.
Python 3.10 or later. [verify] adds voltage-verify, which vgpu attest needs for a GPU VM. The agent never logs in to the dashboard: a browser session on your account is not bound by the limits of a key.
The block below, as is. Its core is also printed by vgpu --help and carried by the description of the MCP tool that starts machines.
## VoltageGPU machines (`vgpu`) - Always start machines with `vgpu up TIER --name NAME --ttl DURATION --max-price USD -y`; never without `--ttl`. - Release every machine you started with `vgpu rm NAME -y` when the task ends, including on failure, then check that `vgpu ps` no longer lists it. - If a command exits with code 6 (HTTP 402, balance or `API_KEY_BUDGET_EXCEEDED`), stop and tell the user. Do not retry and do not switch tiers to get around it. - Never print, echo, log or commit the API key (`VOLT_API_KEY`, `VOLTAGEGPU_API_KEY`). Read it from the environment only. - Before spending, state the tier and its hourly price from `vgpu ls --json`, unless the user already approved this run. - After a deploy that got no answer, run `vgpu ps` before anything else; never retry a deploy blindly. - Call a machine confidential only after `vgpu attest NAME` returned VERIFIED. Standard pods, dedicated machines and sandboxes are never confidential.
Then a whole run looks like this:
vgpu up rtx6000b-small --name job1 --ttl 1h --max-price 4 -y # waits until SSH answers vgpu attest job1 # VERIFIED, or it is not called confidential vgpu scp job1 ./train.py /home/ubuntu/train.py --up vgpu exec job1 -d "python3 train.py" # background job: prints the PID and the log path vgpu scp job1 /home/ubuntu/out.tgz ./out.tgz # results back to the agent’s machine vgpu rm job1 -y && vgpu ps # released, and nothing left running
§ 02 / the agent checks the machine
On a Confidential VM or a Confidential CPU tier, vgpu attest checks the machine from the side of the agent, with a challenge drawn where the agent runs. Nothing in that check relies on our word.
A random challenge is drawn on the agent’s computer: 32 bytes for a GPU VM, 64 for a CPU tier. The machine cannot choose it, so it cannot replay an old proof.
The published proof script runs in the machine over SSH. vgpu carries its own copy, pinned by SHA-256, and refuses to send a modified one.
The archive comes back and is verified on the agent’s computer.
voltage-verify checks the Intel TDX quote up to Intel’s root and the NVIDIA attestation of the GPU, both issued for the challenge. --offline runs the same checks from the collateral stored in the bundle, without network.
The report must carry the challenge and its policy must forbid debug. The AMD certificate chain and the VCEK are fetched again from AMD on the agent’s computer, the root must match one pinned in the script, and a local snpguest 0.11.0 checks the chain and the signature. The certificates inside the archive come from the VM and are never used.
vgpu attest job1 --json
Standard pods, dedicated machines and sandboxes have no tenant attestation: vgpu attest refuses them. The dated proofs we published, with their files, are on /proofs.
§ 03 / no machine to rent
An agent that only needs a model does not have to start a machine. The inference API is OpenAI-compatible and serves only confidential models, whose ids end in -TEE. It takes an inference key (vgpu_...), created on the same API Keys page, in VOLTAGEGPU_API_KEY: a different key from VOLT_API_KEY. It is billed per token from the same balance. From the local MCP server, the inference tool makes the same call.
curl -s https://api.voltagegpu.com/v1/models
curl -s https://api.voltagegpu.com/v1/chat/completions \
-H "Authorization: Bearer $VOLTAGEGPU_API_KEY" -H "Content-Type: application/json" \
-d '{"model": "<id from /v1/models>", "messages": [{"role": "user", "content": "Hello"}]}'Prompts are processed inside Intel TDX on the model side; our API relays them over TLS without storing or logging them. There is no end-to-end encryption from the client into the enclave. An inference key has no budget of its own. GET /v1/attestation proves confidential hardware answering your nonce, not which instance served a given answer. Models and prices: /models.
§ 04 / guardrails
| Scope | Allows | On an agent key |
|---|---|---|
| read | List offers and machines, read the spend of the key (vgpu ls, ps, whoami) | by default |
| rent | Start, stop and release machines (vgpu up, rm) | by default |
| manage | SSH keys and registry credentials of the account; refused to a key limited to its own machines | by default |
| billing | Reading the account balance | never |
API_KEY_SCOPE_MISSING, before anything happens. vgpu exits with code 4.API_KEY_ACCOUNT_RESOURCE.API_KEY_BUDGET_EXCEEDED, checked before any charge and before the machine is ordered: nothing is taken, nothing starts. vgpu exits with code 6 and the rules tell the agent to stop and tell you.balance: null with a balance_hidden note. No key can create a key or change its own limits: that takes your dashboard session.$ vgpu up rtx6000b-small --name job1 -y Usage: vgpu up [OPTIONS] TIER Try 'vgpu up --help' for help. Error: Missing option '--ttl'. $ vgpu up rtx6000b-small --name job1 --ttl 31d -y Error: --ttl cannot exceed 30d.
Captured on 27 October 2026 on a Windows 11 workstation, voltagegpu-cli 2.0.0, no API key set. Both commands stop on the agent’s machine with exit code 2, before any request is sent.
§ 05 / what the agent can start
vgpu ls --kind takes one of these names. vgpu up turns --ttl into the automatic stop of each product, rounded up, and refuses a value out of bounds before ordering anything.
| Kind | Machine | Proof the agent can check | --ttl becomes |
|---|---|---|---|
| vm | Confidential VM: Intel TDX, NVIDIA GPU | TDX quote and NVIDIA attestation | hard stop, up to 720 h |
| cpu | Confidential CPU: AMD SEV-SNP, no GPU | SEV-SNP report, chain fetched from AMD | hard stop, up to 720 h |
| standard | Standard GPU pod | no enclave | auto-terminate, 1 to 720 h in whole hours |
| baremetal | Whole dedicated machine | no enclave | hard stop, 1 to 72 h in whole hours |
| sandbox | CPU sandbox | no enclave | deletion, up to 7 days; paused when idle |
§ 06 / MCP and the skill
vgpu mcpRuns on the agent’s computer and speaks MCP over stdio. It has to: exec, scp and attest use your SSH private key, which never leaves that computer. The key and the sudo password of a VM are never part of an answer, and a 402 comes back as API_KEY_BUDGET_EXCEEDED with “do not retry”.
claude mcp add --env 'VOLT_API_KEY=${VOLT_API_KEY}' \
--transport stdio voltagegpu -- vgpu mcp# ~/.codex/config.toml [mcp_servers.voltagegpu] command = "vgpu" args = ["mcp"] env_vars = ["VOLT_API_KEY"] # forwarded from your environment, never written here
The key stays in the environment the agent starts from: these lines name the variable, never the key, and the single quotes keep the shell from writing its value into ~/.claude.json. For the inference tool, forward VOLTAGEGPU_API_KEY (a vgpu_ key) the same way.
| Tool | What it does |
|---|---|
| ls | Offers with the price charged per hour, cheapest first. |
| up | Starts a machine; the first hour is charged at start.ttl and max_hourly_price required |
| ps | Machines of this key, with status, price and SSH readiness. |
| exec | Runs a command over SSH with your local key; output cut at 64 KB, detach for long jobs. |
| scp | Copies a file between the machine and the computer the agent runs on. |
| rm | Releases a machine; its disk is deleted.confirm: true required |
| attest | Checks a Confidential VM or a Confidential CPU tier with a challenge drawn locally. |
| inference | Chats with a confidential model (ids ending in -TEE), no machine to rent.needs a vgpu_ key in VOLTAGEGPU_API_KEY |
| whoami | Scopes, visibility, budgets and spend of the key, never the key itself. |
voltagegpu.com/api/mcpFor clients that cannot run a local command (Streamable HTTP, the API key as a bearer token). It lists, starts and releases machines through the same REST routes and the same key checks, and every deployment needs a lifetime. It has no exec and no attest: running a command needs your SSH key, which stays with you. The endpoint itself is an ordinary API route, not inside an enclave.
claude mcp add --transport http voltagegpu \
https://voltagegpu.com/api/mcp \
--header 'Authorization: Bearer ${VOLT_API_KEY}'| Tool | What it does |
|---|---|
| get_verification_instructions | No key needed. The commands that generate and verify both proofs inside a Confidential VM, and which SKUs have a published proof. |
| list_vm_tiers | Confidential VM tiers (Intel TDX, NVIDIA GPU) and Confidential CPU tiers (AMD SEV-SNP): price, stock, published attestation. |
| register_ssh_key | Adds a public SSH key to the account. Refused to a key limited to its own machines. |
| deploy_vm | Starts a Confidential VM or a Confidential CPU tier.hardstop_hours required, up to 720 |
| list_pods | The machines this key can see, with status, ssh_ready and ssh_command. |
| stop_pod | Releases a pod or a VM; the unused prepaid time comes back per second. |
| list_offers | Standard GPUs, dedicated machines, sandbox templates or Confidential CPU tiers. |
| deploy_standard | Starts a standard GPU pod (no enclave).auto_terminate_hours required, 1 to 720 |
| deploy_baremetal | Starts a dedicated machine (no enclave).hardstop_hours required, 1 to 72, and ssh_key_ids |
| deploy_sandbox | Creates a CPU sandbox (no enclave).ttl_seconds required, 61 to 604800 |
| list_sandboxes | The sandboxes of this key, with status, price and SSH command. |
| delete_sandbox | Deletes a sandbox and its disk. |
Other clients and the raw JSON-RPC call: MCP server setup.
For agents that load skills, such as Claude Code: SKILL.md with the rules above, the workflow, the exit codes and the five kinds, two example scripts (a job that always releases its machine, and a Confidential VM started, attested and released) and the MCP configuration for Claude Code and Codex. It is not published yet; until it is, the rules block above carries the same rules.
§ 07 / limits
No recorded agent session is shown on this page yet. Except the two refusals in the guardrails section, captured on 27 October 2026, the commands here are documented from the source of voltagegpu-cli 2.0.0, not copied from a run. Published proofs, dated, with their files: /proofs.
§ 08 / FAQ
It cannot start a new machine once the budget of its key is reached, for the UTC day, the month or in total: the API answers 402 API_KEY_BUDGET_EXCEEDED and charges nothing. Machines it already started keep running and keep being billed until their deadline or until it releases them. That is why vgpu up refuses to start a machine without --ttl.
Not with the defaults. An agent key never has the billing scope, so the balance comes back as null with a balance_hidden note. With the visibility "own", the key lists and controls only the machines it started; any other machine of the account answers 404.
No. Keys are created and revoked only from your logged-in dashboard, and an agent key has no billing scope. Create the key in your own browser: a session logged in to your account is not bound by the limits of a key, so never log in on the computer the agent controls.
Any agent that can run a shell command, such as Claude Code, Codex or Cursor. MCP clients can use the local server (vgpu mcp, over stdio) or the remote one at https://voltagegpu.com/api/mcp (Streamable HTTP).
No. https://voltagegpu.com/api/mcp is an ordinary API route. What runs inside Intel TDX is the Confidential VM it deploys. The local server, vgpu mcp, runs on your own computer.
Keys, the vgpu command and the MCP servers add no fee. Machines are billed per second at the price vgpu ls shows: one hour is charged at start and the unused part is refunded on release (a dedicated machine always bills at least 15 minutes). Inference is billed per token from the same balance.
Looking for ready-made confidential agents for legal, finance or compliance work rather than your own coding agent? They are on /agents.
Create an agent key in your dashboard, install vgpu where the agent runs, and give it its first job with a one-hour deadline.