https://tee.redpill.ai forces confidential routing, but a base URL alone does not verify the
TEE from your machine. A verified client must check the workload attestation, bind TLS to an attested
key, and verify the signed receipt for the exact request and response bytes.
Agent tools, MCP servers, browser automation, and telemetry remain separate trust boundaries.
Node and Bun
/runtime export selects the pinned transport.
aci.fetch only to the client instance that uses this gateway. It retains bounded wire digests
and the matching request authorization for private receipt lookup. Audit a response before treating
its serving path as verified.
Release policy
requireProductionOs rejects development and unknown OS measurements. For reviewed-release
enforcement, also pass acceptedComposeHashes obtained from authenticated RedPill release metadata.
Do not copy a hash from the endpoint and trust it on first use.
Without a compose allowlist, the client verifies that the measured compose ran in a genuine TDX
workload. It does not claim that RedPill reviewed that release. For a production security decision,
pair compose appraisal with a dstack verifier result for the same quote and require is_valid: true.