DEVELOPER RESOURCES / CONFIDENTIAL INFERENCE

Send prompts to
verified compute.

Adverserial clients verify a fresh TEE and GPU attestation before they send content. Your coding tool talks only to a local gateway; the gateway exchanges your billing key for a bounded entitlement and connects directly to the attested confidential runtime.

Quickstart

Clone the confidential SDK, create an isolated Python environment, and install both the verifier and loopback gateway. Python 3.10 or newer is required.

git clone https://github.com/AdverserialAI/confidential-sdk.git
cd confidential-sdk
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install ./python ./gateway

Get your normal Adverserial billing key from billing.adverserial.ai. The key stays on your computer: the gateway uses it only to obtain a short-lived, single-request entitlement. The confidential runtime receives that entitlement, never your long-lived key.

Verification gate

Before the gateway starts, configure independently obtained verification material. The verifier checks the Intel TDX and NVIDIA evidence against the published policy; it does not treat a proxy-signed receipt as hardware proof.

# JSON object: {"<receipt-key-id>": {"kty":"EC", "crv":"P-256", "x":"…", "y":"…"}}
# published at https://verify.adverserial.ai/policies/production.json
export ADVERSERIAL_RECEIPT_KEYS_FILE="$HOME/.config/adverserial/receipt-keys.json"

# The SDK ships the reference verifier for the current Phala TDX + NVIDIA CC
# deployment (Intel collateral via dcap-qvl, NVIDIA EAT bundles via NRAS JWKS):
export ADVERSERIAL_HARDWARE_VERIFIER_COMMAND="$PWD/typescript/bin/adverserial-hardware-verify.mjs"

The hardware verifier recomputes the nonce and public-key bindings, verifies the Intel TDX quote against Intel collateral, and validates every NVIDIA EAT against NRAS public keys. It rejects synthetic development evidence, missing evidence, and mismatched bindings. Custom TEEs can substitute their own verifier command with the same stdin/stdout contract.

Start the local confidential gateway

The gateway binds to 127.0.0.1 only. It supports OpenAI Chat Completions, Anthropic Messages, and OpenAI Responses on the same local endpoint, so existing tools can keep their native protocol while the content path becomes confidential.

export ADVERSERIAL_GATEWAY_HOST="127.0.0.1"
export ADVERSERIAL_GATEWAY_PORT="8787"
export ADVERSERIAL_CC_API_URL="https://api.adverserial.ai/v1"
export ADVERSERIAL_BILLING_URL="https://billing.adverserial.ai"
export ADVERSERIAL_ISSUER="https://verify.adverserial.ai"
export ADVERSERIAL_AUDIENCE="https://chat.adverserial.ai"

adverserial-confidential-gateway
# listening on http://127.0.0.1:8787

The gateway validates a fresh policy and hardware proof, gets an entitlement from billing, sends the encrypted request to the attested endpoint over direct TLS, then verifies the signed inference receipt. It logs neither prompt bodies nor API keys.

Canonical model IDs

Use these exact model IDs in every tool configuration. The local gateway rejects non-canonical model IDs rather than routing them somewhere else.

Configure your coding client

Each configuration points to the loopback gateway. Set your billing key in the client’s local secure storage or environment; it is converted into a bounded entitlement before the request crosses the network.

export ADVERSERIAL_API_KEY="sk-YOUR-KEY"
source /absolute/path/to/confidential-sdk/profiles/claude-code.confidential.sh
claude

# Routes Claude to /v1/messages at the local gateway.
# The gateway preserves tool_use/tool_result and streamed tool JSON.

cp /absolute/path/to/confidential-sdk/profiles/codex.confidential.toml \
  ~/.codex/confidential.config.toml
export ADVERSERIAL_API_KEY="sk-YOUR-KEY"

# Install the attestation skill once:
codex plugin marketplace add AdverserialAI/confidential-sdk --ref main
codex plugin add adverserial-verify@adverserial
codex --profile confidential

# Uses /v1/responses with structured function calls,
# tool outputs, and streamed function arguments.
# In Codex: $adverserial-verify

cd /absolute/path/to/confidential-sdk/plugins
npm install && npm run build
# In Kimi Code: /plugins install ./kimi-code
# Then: /reload

[providers.adverserial]
type = "anthropic"
base_url = "http://127.0.0.1:8787"
api_key = "sk-YOUR-KEY"

[models.cyberglm]
provider = "adverserial"
model = "lordx64/cyberglm"

# Merge profiles/opencode.jsonc into:
# ~/.config/opencode/opencode.json
export ADVERSERIAL_API_KEY="sk-YOUR-KEY"
opencode --model adverserial/lordx64/cyberglm

# Install the verifier plugin exactly as documented:
# https://github.com/AdverserialAI/confidential-sdk/tree/main/plugins/opencode

export ADVERSERIAL_API_KEY="sk-YOUR-KEY"
pi --extension /absolute/path/to/confidential-sdk/plugins/pi/adverserial-confidential.ts \
  --model adverserial-confidential/lordx64/cyberglm

# Pi does not register the model until a fresh
# adverserial-verify attestation check succeeds.

# The Codex desktop app reads the same
# ~/.codex/config.toml as the CLI.
# Apply the Codex block, then restart the app.
# In a new chat: $adverserial-verify
# The plugin runs its bundled verifier.

# ~/.hermes/config.yaml
model_aliases:
  cyberglm:
    model: lordx64/cyberglm
    provider: custom
    base_url: "http://127.0.0.1:8787/v1"
    key_env: ADVERSERIAL_API_KEY

# inside Hermes (CLI, TUI, desktop):
#   /model cyberglm

The gateway preserves text, function definitions, function calls, function outputs, and streamed function-argument data. It rejects unsupported hosted-provider tools, files, images, and provider-side conversation state rather than degrading to a non-confidential route.

Copy-ready profiles for every harness live in the SDK profiles directory. They contain no key material and direct every prompt to the loopback gateway.

Claude Code’s desktop app shares ~/.claude with the CLI, so the same environment block applies to both. Its profile pins interactive, background-agent, and small/fast roles to lordx64/cyberglm. The loopback gateway recognizes only Claude-family child aliases and canonicalizes them before verification; billing and the runtime receive only the canonical ID. Kimi Code accepts the same Anthropic Messages route; its own configuration reference is providers and models.

Install and verify each client

Install the integration from its public source, restart the coding client when the harness requires it, and run a fresh check before sending sensitive content. The local gateway independently verifies again before confidential dispatch, so a plugin badge is never the only enforcement point.

Use the Python SDK directly

Use the Python SDK when your application needs end-to-end verification plus TLS SPKI pinning on the data path. Configure the independent hardware-verifier callback before calling verify_endpoint.

from adverserial import verify_endpoint, VerifiedSession

proof = verify_endpoint(
    "https://api.adverserial.ai/v1",
    expected_model_id="lordx64/cyberglm",
    trusted_receipt_keys=trusted_receipt_keys,
    issuer="https://verify.adverserial.ai",
    audience="https://chat.adverserial.ai",
    hardware_verifier=verify_hardware_evidence,
)

session = VerifiedSession(
    "https://api.adverserial.ai/v1",
    proof=proof,
    entitlement=short_lived_entitlement,
)
response = session.chat_completions(
    model="lordx64/cyberglm",
    messages=[{"role": "user", "content": "Assess this authorized test finding."}],
)
assert response.receipt_verified

Verification plugins

Build and install instructions, source, test suites, and supported plugin versions are maintained in the confidential-sdk repository.

Read the result

Every completed confidential request returns a signed receipt. The SDK checks its signature, model and policy identity, expiration, evidence binding, request hash, response hash, and the attested TLS key. Streaming requests receive the receipt at the end of the stream; treat a missing or invalid receipt as a failed exchange.

Security boundary