Rent, attest and verify
a confidential GPU, as MCP tools.

One remote MCP server, 12 tools: list and start Confidential VMs (Intel TDX with an NVIDIA GPU), Confidential CPU tiers (AMD SEV-SNP), standard GPU pods, dedicated machines and sandboxes, each with a lifetime it must be given; poll them until they answer, get the exact commands to generate and verify the attestation of a Confidential VM, and release them. Once you have created the key, no dashboard is needed.

To be precise about what does and does not run inside Intel TDX: this MCP endpoint is an ordinary API route, like any other on this site. What it lets an agent provision, the Confidential VM itself, is what runs inside Intel TDX. See what is confidential and what is not below, we are not going to blur that line to sound more impressive.

What is MCP?

Model Context Protocol is an open standard for connecting LLM clients and coding agents to external tools. An MCP server exposes tools (callable functions with typed inputs and outputs) that a client can list and call over a standard transport. The full spec lives at modelcontextprotocol.io.

Agents are starting to buy and provision infrastructure on their own, not just reason about it. This server is our answer to that: everything a customer can do through the dashboard to run and verify a Confidential VM is also a tool call.

Setup

Point any MCP client that speaks Streamable HTTP at https://voltagegpu.com/api/mcp with a VoltageGPU API key (volt_...) as a bearer token. For an agent, make it an agent key: chosen scopes, only the machines it starts, a daily budget. For a stdio-only client, wrap the same URL with mcp-remote, or use the local server vgpu mcp, which also runs commands and the attestation over SSH with your own key: see the agent quickstart.

claude mcp add --transport http voltagegpu \
  https://voltagegpu.com/api/mcp \
  --header 'Authorization: Bearer ${VOLT_API_KEY}'

// ~/.cursor/mcp.json
{
  "mcpServers": {
    "voltagegpu": {
      "url": "https://voltagegpu.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:VOLT_API_KEY}"
      }
    }
  }
}

# Any MCP client that speaks Streamable HTTP works the same way.
# This is the raw JSON-RPC call list_vm_tiers makes, for anything that
# is not yet a full MCP client:
curl -s https://voltagegpu.com/api/mcp \
  -H "Authorization: Bearer $VOLT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0", "id": 1, "method": "tools/call",
    "params": { "name": "list_vm_tiers", "arguments": {} }
  }'

The key stays in the VOLT_API_KEY environment variable: both configurations name it and never hold the key itself. Get a key at voltagegpu.com/api-keys. get_verification_instructions needs no key at all; every other tool returns a plain-text error naming the missing key rather than a silent empty result. A launch refused by the budget of the key (402 API_KEY_BUDGET_EXCEEDED) comes back with the instruction to stop and tell the user; nothing is charged.

The 12 tools

Standard pods, dedicated machines and sandboxes have no enclave and no attestation. There is no exec tool here: running a command on a machine needs your SSH private key, which stays on your computer (the local server vgpu mcp does it there).

What is confidential, and what is not

Pricing

No separate MCP fee. The listing tools and get_verification_instructions cost nothing to call. Each deploy tool charges one hour of the machine at its hourly rate when it starts, and the unused part comes back per second when the machine is released with stop_pod or delete_sandbox (a dedicated machine always bills at least 15 minutes). Live rates are on the pricing page and returned by list_vm_tiers and list_offers.

EXPLORE FURTHER