Skip to main content
Using https://tee.redpill.ai forces confidential routing, but a base URL alone does not verify the TEE from your machine. A verified client must check the workload attestation, bind TLS to an attested key, and verify the signed receipt for the exact request and response bytes. Agent tools, MCP servers, browser automation, and telemetry remain separate trust boundaries.

Node and Bun

The same API runs on Node 20.18+ and Bun 1.4+. The /runtime export selects the pinned transport.
Pass aci.fetch only to the client instance that uses this gateway. It retains bounded wire digests and the matching request authorization for private receipt lookup. Audit a response before treating its serving path as verified.

Release policy

requireProductionOs rejects development and unknown OS measurements. For reviewed-release enforcement, also pass acceptedComposeHashes obtained from authenticated RedPill release metadata. Do not copy a hash from the endpoint and trust it on first use. Without a compose allowlist, the client verifies that the measured compose ran in a genuine TDX workload. It does not claim that RedPill reviewed that release. For a production security decision, pair compose appraisal with a dstack verifier result for the same quote and require is_valid: true.

Base-URL-only clients

Claude Code, Codex CLI, Cline, and other base-URL-only tools can call the RedPill API, but cannot inject the attested TLS transport. Do not describe those configurations as locally verified ACI clients. Add a native adapter only when the host exposes supported provider, transport, credential, model, and lifecycle hooks.