Verify in 5 Minutes

You shouldn’t trust our privacy claims. Here’s how to verify them yourself in under 5 minutes.

What You’re Verifying

When you verify, you’re proving:

The code running is what we claim - Docker compose hash matches published source
It’s running in real TEE hardware - Intel TDX / AMD SEV-SNP + NVIDIA GPU attestation
Your specific request was processed there - Signed response with hardware-bound key

Quick Verification (2 minutes)

1. Install the Verifier

git clone https://github.com/redpill-ai/redpill-verifier.git
cd redpill-verifier/js
npm install && npm run build

2. Verify Attestation (No API Key Needed)

npx redpill-verifier attestation --model phala/gpt-oss-120b

Output:

RedPill Verifier — TEE Attestation
  Model: phala/gpt-oss-120b

[Step 1] Intel TDX Quote
  OK    TDX quote verified

[Step 2] Report Data Binding
  OK    Signing key bound to TEE hardware
  OK    Nonce embedded in report data

[Step 3] GPU Attestation
  OK    GPU nonce matches
  OK    NVIDIA verdict: true

[Step 4] Compose Manifest
  OK    Compose hash matches mr_config

[Step 5] Sigstore Provenance
  OK    5556fb80b9528327... (HTTP 200)

  VERIFIED
  Provider: near-ai | Hardware: INTEL_TDX, NVIDIA_CC

If you see VERIFIED, the model is running in genuine TEE hardware.

Verify Your Chat Response (3 minutes)

Use RedPill as an OpenAI drop-in, then verify the response:

import OpenAI from 'openai'
import { verify } from '@redpill-ai/verifier'

const openai = new OpenAI({ baseURL: 'https://api.redpill.ai/v1', apiKey: 'sk-xxx' })
const response = await openai.chat.completions.create({
  model: 'phala/gpt-oss-120b',
  messages: [{ role: 'user', content: 'Hello!' }],
})

// Verify the response came from a real TEE
const proof = await verify(response.id, {
  model: 'phala/gpt-oss-120b',
  apiKey: 'sk-xxx',
})

console.log(proof.verified)           // true
console.log(proof.signature.valid)    // true — ECDSA ecrecover
console.log(proof.provider)           // "near-ai"
console.log(proof.hardware)           // ["INTEL_TDX", "NVIDIA_CC"]

What Each Check Means

Check	What It Proves
Intel TDX quote verified	Code runs in genuine Intel TDX CPU enclave
Report data binds signing address	Signing key is generated inside TEE
Report data embeds request nonce	Attestation is fresh (not replayed)
GPU nonce matches	GPU attestation is for this specific request
NVIDIA verdict	GPU is genuine H100/H200 with confidential computing
Compose hash matches mr_config	Running code matches the Docker compose shown
Sigstore provenance	Container images have verified build provenance

Two Verification Modes

Light Mode (Default) — No Docker

Uses cloud APIs: Phala TDX verifier, NVIDIA NRAS, and optionally Automata on-chain DCAP.

npx redpill-verifier attestation --model phala/gpt-oss-120b

Deep Mode — Trust Only Intel Silicon

Uses dstack-verifier (Rust + QEMU) to independently replay boot measurements. Requires Docker.

# Start dstack-verifier
docker compose up -d

# Run with deep verification
npx redpill-verifier attestation --model phala/qwen-2.5-7b-instruct --deep

Deep mode verifies all three TEE components independently: model, KMS, and gateway.

Multi-Provider Support

RedPill routes to different TEE providers. The verifier auto-detects and applies provider-specific checks.

Provider	Example Models	Hardware
Chutes	`z-ai/glm-5.1`, `moonshotai/kimi-k2.6`, `deepseek/deepseek-v3.2`	Intel TDX + NVIDIA CC
Near AI	`z-ai/glm-5`, `deepseek/deepseek-chat-v3.1`, `openai/gpt-oss-120b`	Intel TDX + NVIDIA CC
Phala	`phala/qwen3.5-27b`, `phala/qwen3-vl-30b-a3b-instruct`, `phala/gpt-oss-20b`	Intel TDX + NVIDIA CC
Tinfoil	`meta-llama/llama-3.3-70b-instruct`	Intel TDX or AMD SEV-SNP

Use GET /v1/models for the live model catalog. Tinfoil models are listed as GPU TEE models, but RedPill’s attestation endpoint currently returns provider errors for the Tinfoil catalog entries, so do not rely on /v1/attestation/report for Tinfoil until the endpoint returns a supported Tinfoil format.

API Verification Flow

If you are implementing verification in your own service, use the same order:

Send POST /v1/chat/completions and store the exact request body plus response body.
Fetch GET /v1/signature/{request_id}?model=....
Verify the signed request_hash:response_hash against your stored bodies.
Verify the signature and signer address.
Generate a fresh 32-byte nonce.
Fetch GET /v1/attestation/report?model=...&nonce=...&signing_address=....
Verify the TDX quote, NVIDIA attestation, nonce, and signer binding.

Attestation answers “is this model server a genuine TEE?” Signature verification answers “did that TEE sign my exact response?” Production verification should do both.

On-Chain Verification

Verify the TDX quote trustlessly via Ethereum smart contracts — no API trust needed:

npx redpill-verifier attestation --model phala/gpt-oss-120b --network sepolia

Store proof permanently on-chain:

npx redpill-verifier store \
  --private-key 0x... \
  --proof-store 0x83541AD3f380De2b28E0108d4Da934236342B02b \
  --network sepolia

How It Works

Generate fresh nonce

Verifier creates a random 32-byte hex nonce to prevent replay attacks

Auto-detect provider

Queries /v1/models to identify if model runs on Phala, NearAI, Chutes, or Tinfoil

Fetch attestation

Request attestation from /v1/attestation/report?model=...&nonce=...

Verify TDX/SEV-SNP quote

Light: submit to Phala’s verification service. Deep: replay via dstack-verifier (QEMU)

Verify GPU attestation

Submit GPU payload to NVIDIA NRAS service

Provider-specific checks

Tinfoil: hardware policy + Sigstore golden values. Chutes: anti-tamper binding. Phala: compose manifest

Optional: on-chain DCAP

Verify via Automata smart contract for trustless proof

CI/CD Integration

# .github/workflows/verify-tee.yml
name: Verify TEE Attestation

on:
  schedule:
    - cron: '0 * * * *'  # Every hour
  workflow_dispatch:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Setup verifier
        run: |
          git clone https://github.com/redpill-ai/redpill-verifier.git
          cd redpill-verifier/js && npm install && npm run build

      - name: Verify models
        run: |
          cd redpill-verifier/js
          npx redpill-verifier attestation --model phala/gpt-oss-120b --light --skip-onchain

What If Verification Fails?

Intel TDX quote verified: False

Cause: Quote couldn’t be validated against Intel’s root certificates.Action: Could be network issue. Retry. If persistent, the hardware may not be genuine TEE.

Report data embeds request nonce: False

Cause: Attestation may be replayed from old request.Action: Generate new nonce and try again. If persistent, contact security@redpill.ai.

Compose hash mismatch

Cause: Running code doesn’t match the Docker compose manifest.Action: Check for recent updates. If mismatch persists, stop using and report to security@redpill.ai.

NVIDIA verdict: False

Cause: GPU attestation failed NVIDIA verification.Action: GPU may not be genuine H100/H200 TEE. Report to security@redpill.ai.

Attestation API error / timeout

Cause: The model’s backend may be temporarily unavailable.Action: Try a different model from the same provider, or retry in a few minutes.

Next Steps

Full Attestation Guide

Deep dive into attestation format

Signature Verification

Verify individual request signatures

GitHub Repo

View verifier source code

Threat Model

Understand what we protect against

Documentation Index

​Verify in 5 Minutes

​What You’re Verifying

​Quick Verification (2 minutes)

​1. Install the Verifier

​2. Verify Attestation (No API Key Needed)

​Verify Your Chat Response (3 minutes)

​What Each Check Means

​Two Verification Modes

​Light Mode (Default) — No Docker

​Deep Mode — Trust Only Intel Silicon

​Multi-Provider Support

​API Verification Flow

​On-Chain Verification

​How It Works

​CI/CD Integration

​What If Verification Fails?

​Next Steps

Full Attestation Guide

Signature Verification

GitHub Repo

Threat Model

Verify in 5 Minutes

What You’re Verifying

Quick Verification (2 minutes)

1. Install the Verifier

2. Verify Attestation (No API Key Needed)

Verify Your Chat Response (3 minutes)

What Each Check Means

Two Verification Modes

Light Mode (Default) — No Docker

Deep Mode — Trust Only Intel Silicon

Multi-Provider Support

API Verification Flow

On-Chain Verification

How It Works

CI/CD Integration

What If Verification Fails?

Next Steps