Overview: Protected, the current session, the Local API, and connected agents
Install
Start building detects your platform and offers the current stable build. Direct links always resolve to the current stable release:
Every build, with checksums, is on the
releases page. The app updates itself
from the stable release channel.
Profiles and sign-in
A profile is one RedPill workspace plus its credential. Add one with either:- Account login: the app opens your browser, you approve it once and pick a workspace, and the
app receives an inference key for that workspace. The flow is a public OAuth client with PKCE and
a loopback callback on
127.0.0.1:4181; no client secret or refresh token, and the sign-in token stays in memory. If saving fails, Retry reuses the approval. - API key: Get API key opens the dashboard; paste the key.
Privacy: what Protected does
Switching on Protected runs the ACI relying-party checks against the gateway with a fresh nonce:- the hardware quote verifies to the TEE vendor root and binds the report data;
- the attested keyset digest matches the statement for that nonce;
- the keyset has not expired;
- source provenance names the public code the workload booted from; and
- the TLS key actually used for the connection is in the attested keyset.
Agents
The Agents screen lists the agents the app can configure. Connect writes RedPill into the agent’s own provider settings, in the protocol the agent speaks, with an agent-scoped token for the Local API. Disconnect restores the file you had before; edits you made in the meantime are preserved, and an incomplete restore stays retryable.
Only agents that are both connected and currently protected receive the Local API configuration.
Connecting from the CLI previews the change first and applies it with a revision, so a file that
changed in between is rejected rather than overwritten.
Local API
While Protected is on, the app serves an OpenAI-compatible API on your machine:
Any tool that accepts an OpenAI-compatible endpoint can use it, for example
Cline. The Local API is plain HTTP on loopback; send
ordinary request bodies. It rejects end-to-end encryption headers because the app already owns the
verified channel, and it stops listening when Protected is off. Rotate the client key from the Local
API screen or
token rotate.
Usage
Responses stream to the agent immediately. The app fetches the signed receipt for each response afterwards and audits it against the attestation. Usage records every request with the agent, model, tokens, estimated cost, and the audit result; an audit failure is recorded but cannot recall bytes the agent already received. The Overview screen shows the current session’s totals. Usage can be filtered, exported to CSV, and cleared.Settings
- Connect on launch starts protection when the background service starts.
- Open at login is an operating system preference set from the desktop app.
- Advanced > Reset stops protection, disconnects agents, and restores defaults while keeping profiles, credentials, the local client key, and usage history.
- Closing the window does not stop the service; the tray’s Stop All and Quit action does.
CLI
pap drives the same background service without a window; private-ai-proxy and aci are the
same executable under longer names. The desktop app registers the command for your shell
(pap cli install).
Credentials are entered through a hidden prompt or
--key-stdin, never as an argument. For
scripts, --json --non-interactive returns data and --yes approves a change; agent changes are
previewed with --dry-run and applied with the returned --revision. Exit status is 0 on
success, 2 for invalid arguments, 1 for operation failures. verify, sessions, and serve
work against any ACI service without a profile; serve refuses to start unless verification passes.