Prism Network

Prism Network is open infrastructure for metered GPU compute. The current system implements account and wallet onboarding, GPU offer discovery, USDG escrow, workload provisioning, time-limited access, metering, settlement and public receipt generation.

Prism has two execution paths:

• Independent nodes: Ubuntu 24.04 x86-64 hosts run public OCI images in Kata VM-backed containers with exclusive NVIDIA VFIO passthrough. Access uses short-lived SSH or Jupyter credentials through an outbound-only mTLS tunnel.
• Vast broker: a bonded broker provisions disposable L40S instances and exposes direct SSH. This path relies on provider-reported readiness and evidence; it does not provide Kata/VFIO isolation, the Prism gateway, or Jupyter access.

Interactive raw GPU leases are what the network serves today. A lease can also carry a single command instead of a session, which runs on an independent node and reports back what it printed, but no independent node has completed the hardware canary yet, so nothing has run that path in production. Managed inference is not implemented.

Current state

Verified on 2026-07-20:

This is an unaudited pre-production system, so do not put production traffic or serious money on it yet.

What a supplier protects is stated per offer rather than as one blanket warning. Every offer, quote, lease and receipt carries a trust class (open, isolated, attested or confidential), and renters can require a minimum instead of trusting prose:

curl https://api.prismnetwork.tech/v1/offers?min_trust=isolated

The class is derived by the control plane from evidence it can check, never asserted by a supplier, and it is clamped to what the network can currently verify. isolated requires a GPU attestation report that validates to a pinned NVIDIA root and answers a challenge issued to the node presenting it, so a machine cannot claim that class for itself. attested requires a launch measurement of the guest that ran the lease, verified to AMD's root and bound to the SSH host key generated inside that guest, so the proof is about the session the renter is in. It proves what started and not that nobody watched. All capacity live today is open, which means the host operator can read anything the workload touches, and nothing above it is served until the reference material both classes check against is captured from real hardware and verifies. See docs/ATTESTATION.md for what is checked and docs/SECURITY_MODEL.md for what each class does and does not promise.

Private data does not have to live in a workspace to be useful. Cards, identity documents and credentials go in the vault, sealed on your machine under a key derived from a wallet signature and never sent, so Prism stores ciphertext and holds no way to read it:

await agent.vault.unlock();
const card = await agent.vault.put({ pan: "4111111111111111" }, { label: "billing" });

Every item carries the weakest class of workspace it may be shown to, and new items default to confidential — above what the network can serve — so handing one to today's capacity is refused rather than quietly allowed. The account, version and trust floor are authenticated into the ciphertext, which makes moving an item, replaying an old version, or lowering its floor a failed decrypt instead of a successful lie. docs/VAULT.md has the construction and its limits.

Mainnet contracts

The V1 contracts are non-upgradeable and LeaseEscrowV1 is live. They have not received an independent audit. Blockscout reports NodeRegistryV1 as fully source-verified and LeaseEscrowV1 as partially source-verified. The escrow's executable bytecode matches this tree, while its trailing Solidity metadata hash differs.

You do not have to take that on trust. ./scripts/verify-deployed-bytecode.sh rebuilds both contracts and compares them against the code live on chain using only the public RPC, masking immutables and reporting the metadata blob separately:

NodeRegistryV1 0xe3b7…8f01: executable code matches, metadata differs
LeaseEscrowV1  0x71Df…cDeD: executable code matches, metadata differs

Administration, emergency pause and dispute resolution are held by a 2-of-2 governance Safe. Network settings and the USDG address should always be checked against the official Robinhood Chain documentation and contract registry.

Architecture

Browser + wallet
       |
       v
Next.js web -----> Rust control plane -----> PostgreSQL
                         |
              +----------+-----------+
              |                      |
              v                      v
      lifecycle worker       settlement/proof workers
              |                      |
       +------+-------+              v
       |              |       Robinhood Chain
       v              v
Vast instance    access gateway
direct SSH       mTLS tunnel/relay
                       |
                       v
               prismd + Kata/VFIO

The repository contains:

• apps/web: Next.js account, marketplace, supplier, operator and proof UI.
• crates: shared Rust protocol and persistence libraries.
• services: Rust control plane, access gateway and operations monitor.
• workers: lifecycle, settlement and proof workers.
• node/prismd: independent-node runtime and workspace supervisor.
• contracts: PRISM bond, USDG escrow and administration contracts.
• sdk: headless agent SDK for wallet-signature USDG leasing.
• mcp: Model Context Protocol server exposing leasing to MCP clients.
• x402: pay-per-job GPU execution over HTTP 402.
• inference: managed inference, a warm ollama lease behind an x402-paid endpoint.
• integrations: LangChain, CrewAI, AG2/AutoGen, elizaOS and Virtuals GAME adapters.
• examples/trading: agents that rent a GPU for research, then trade on what it finds.
• examples/confidential: an agent pays for TEE-served inference and verifies the attestation itself.
• deploy/ec2: lean Vast launch topology with the web application on Render.
• deploy/lightsail: full single-host reference topology.
• deploy/node: Ubuntu node service units and configuration.
• infra: an AWS reference architecture, not the active lean deployment.
• docs: design, security boundary, proof format and release documentation.

See architecture, security model and release gates before operating the system.

Agent access

Autonomous agents integrate without a browser. An agent proves control of its funding wallet by signing a short-lived challenge, exchanges it for a bearer session, and drives the same renter surface — offer discovery and the lease lifecycle — over the /api/agent endpoints. Escrow, readiness, metering and settlement are identical to the browser path, and the agent boundary reaches only renter routes.

• sdk — @prismnetwork/agent-sdk, headless USDG-funded leasing for Node.
• mcp — @prismnetwork/mcp, the same leasing exposed as Model Context Protocol tools.
• x402 — @prismnetwork/x402, pay-per-job GPU execution over HTTP 402.
• integrations — the same tools in the dialect of LangChain, CrewAI, AG2/AutoGen, elizaOS, Virtuals GAME and Coinbase AgentKit, plus how to pair Prism with Robinhood's agentic trading MCP.