Compute for AI agent swarms: one confidential machine per agent

What a swarm needs from its machines

A swarm is many agents working on one job: a trading swarm, a research, data or backtesting swarm, or a set of agents that each serve their own API. Each agent needs a machine of its own, started when its work starts and gone when it ends, and no agent should need a person to open an account for it.

Here each agent gets one dedicated confidential VM (Intel TDX) running its Docker workload. Memory and disk are encrypted by the hardware and we hold no key to them, so a trading agent's keys and strategy stay sealed from the host. Every machine carries a remote-attestation quote. There is no signup and no API key to get: the wallet that pays owns the machine.

Two ways to pay for a swarm

Each agent pays for itself. An agent wallet holding USDC on Base, Polygon or Solana sends POST /api/compute/deployments with {"plan", "hours", "image"} (or "compose"). The first answer is HTTP 402, a free quote with one entry per network. The agent signs that exact amount and sends the same request again with X-PAYMENT. The machine belongs to the wallet that paid, and only that wallet reads, controls or destroys it.

One balance pays for all. A parent wallet tops up a prepaid balance once with POST /api/compute/credits, so one on-chain settle covers the whole amount. USDC settles first and the balance moves after: nothing is lent. The parent then mints one compute key per agent with POST /api/compute/keys, signed with X-Wallet-Auth and named for the agent; the secret is shown once. Each agent sends its create with its key in Authorization: Bearer and no payment header. The machine is paid from the parent's balance at the cheapest network's price, because a draw settles on no chain, and it belongs to the parent wallet.

A key can rent a machine and renew it, list the parent wallet's machines and read the balance it spends. It can never destroy a machine, sign a payment, touch the wallet or list the other keys. The unspent balance is the most a leaked key can spend, and revoking it with POST /api/compute/keys {"revoke": "<key id>"} ends it at once. A wallet holds up to 20 active keys, one per agent.

The two ways mix. Any wallet may pay a machine's renewal over x402, so a parent can keep a child's machine running from its own wallet while the child stays the owner. A renewal drawn from a prepaid balance comes from the owner's own balance.

Starting many machines

One create buys one machine, or up to 10 with the same setup: add "count", and the 402 asks for that many times one machine's price. The answer lists every machine in "deployments", each its own. Quoting is free and repeatable, so a swarm can price its whole batch on every network before it spends anything. Live prices are on /pricing and in GET /api/compute/catalog, and every 402 carries the exact amount for that exact request.

Buy by the hour, or by the quarter-hour where the catalog offers it: "minutes": 15, 30 or 45 in place of "hours", on every plan but GPU. More hours in one payment cost less per hour, since each payment carries one on-chain settle; a quarter-hour costs more per hour than an hour does. The paid clock starts when the machine is up, not at payment.

When a plan has no room, the create answers 503 before any money moves: try again shortly. If a create times out after the payment was sent, send the same request with the same X-PAYMENT: it returns what that payment bought, every machine of it, marked "alreadyPaid": true, and charges nothing. Never sign a new authorization to retry. A machine that fails to start after payment is retried at our cost, and its clock has not started.

Keeping a swarm running

A machine runs until its paid time ends at expiresAt. To keep it, renew before then: POST /api/compute/deployments/{id}/renew with {"hours": 1} (or "minutes") and a fresh payment, or with the owner's signature or a key to draw the balance. Renewals stack on the end of the clock, so renewing early never loses time. The smallest loop is one hour bought and one hour renewed at a time.

Notices tell a wallet what it should know about its machines: about to stop, stopped, about to be deleted, deleted or failed, and a payment refused for lack of USDC (the refusal itself says what the wallet can buy instead). They ride every compute answer. A wallet can also read them from https://api.agentgates.ai/api/notices, follow them live from its stream, or have them posted to a webhook. When one balance pays, the parent's notices cover every machine in the swarm.

When paid time ends, the machine stops and sits in grace: its data is kept and a renewal starts it again, for as long as it was paid for, at least an hour and at most 72 hours. Then it is deleted. Grace is a ceiling, not a reservation: an expired machine may go sooner when a paying buyer needs the room, so renew before expiry if the disk matters. A machine its owner stops is kept 72 hours with its paused hours, then deleted. Nothing is ever owed: stop paying and the machine stops.

Every answer about a machine carries lifecycle: paidUntil, stopsAt, deleteAt, the renewal call with its price on each network and from a balance, and next, the same in words. An expired machine answers restart, start, stop, resize and update with 409 expired: renew to start it again. A machine deleted because its time ran out answers its renewal, restart or start with a 402 for a new machine with its setup, priced as a new machine: a new id and address, and its env values empty unless the owner sends env, since they were never stored. Renewing the old id then renews the new machine. A machine its owner deleted answers 409 deleted, when and why it went, and newMachine, the create call for its plan at today's price.

Every machine proves what it runs

Each machine has a public verify page at https://api.agentgates.ai/compute/verify/{id}: its compose hash, its OS image hash and its Intel TDX hardware quote, with no login. A parent can check a child's machine before it sends secrets, and an agent can show the page to its own customers.

Env values are sealed to the machine's enclave key and never stored. We never look inside a machine, and its logs stay inside it.

What a swarm may not run

No mining pools, no outgoing mail over SMTP, no inbound SSH exposure, and no attacking, scanning or flooding other systems. Every payment is screened against sanctioned wallets. Before a machine is stopped or deleted for breaking a rule, the email proved on the account gets the reason; a machine attacking others is stopped first, and the mail follows at once. The full text is at /terms#machines.

FAQ