# AI Foundry Compute

> Sandboxed compute for autonomous agents, paid per use in USDC over x402.
> A durable Linux workspace with a terminal, a filesystem that persists between
> calls, and network access to the APIs you actually need. No account, no
> signup, no API key — pay with a wallet and start working.

Base URL: https://api.aifoundry.sh

## Why this exists

Agents need somewhere to run code. Existing options want a human to sign up,
enter a credit card, and manage a dashboard. An autonomous agent has none of
those things — it has a wallet.

This service takes payment over the x402 protocol, so an agent can discover it,
pay it, and use it without a human in the loop.

## Quick start

    # 1. Ask for a session. Unpaid requests get HTTP 402 with payment terms.
    curl -X POST https://api.aifoundry.sh/v1/session \
      -H 'content-type: application/json' \
      -d '{"credit_usd": 5, "tier": "isolate"}'

    # 2. Pay the 402 with any x402 client, then retry. You receive a token.
    # 3. Run code against your workspace.
    curl -X POST https://api.aifoundry.sh/v1/compute/run \
      -H "authorization: Bearer $TOKEN" \
      -H 'content-type: application/json' \
      -d '{"backend": "worker-shell", "source": "curl -s https://api.github.com/zen"}'

Files persist. The next call sees the same workspace.

## Rates

Every line is metered separately and marked up 40% on its own cost. You are not
subsidising anyone else's model choice: a job using a cheap model is billed
cheaply.

### Compute — per minute, 10-minute minimum

| Tier      | Instance   | Resources             | Per minute  | 10-min minimum |
|-----------|------------|-----------------------|-------------|----------------|
| isolate   | basic      | 0.25 vCPU / 1 GiB     | $0.00065    | $0.0065        |
| container | standard-2 | 1 vCPU / 6 GiB / 12 GB| $0.00301    | $0.0301        |

Billed on container-*awake* minutes, not wall-clock. Idle sandboxes sleep in
45 seconds and stop billing.

Larger instances on request, up to 4 vCPU / 12 GiB / 20 GB.

### Model tokens — per million, at 1.4x our cost

| Model                        | Input   | Output  |
|------------------------------|---------|---------|
| llama-3.1-8b-instruct-fp8    | $0.063  | $0.538  |
| glm-5.3-flash                | $0.210  | $0.700  |
| gpt-oss-120b                 | $0.490  | $1.050  |
| llama-3.3-70b-instruct-fp8   | $0.410  | $3.154  |
| kimi-k2.7-code               | $1.330  | $5.600  |
| llama-guard-3-8b (safety)    | $0.678  | $0.042  |

Safety screening is mandatory and billed like any other model call. It adds
roughly $0.008 to a typical job.

### Storage

$0.28 per GB-month. A 50 MB workspace costs about $0.014/month.

## Tiers

### isolate — the default
A V8 isolate with a POSIX-ish shell (`just-bash`): `curl`, `jq`, `grep`, `awk`,
`sed`, `sort`, plus file tools. Starts in about 5 milliseconds. No Linux kernel,
no native binaries, no package installs.

Right for: API orchestration, data transformation, text processing, scraping,
JSON wrangling. Most agent work.

### container — full Linux
A real Debian userland: Node 22, Python 3, git, ripgrep, build-essential.
Install packages, compile things, run native binaries.

Right for: `npm install`, builds, test suites, anything needing a real kernel.

Both tiers share the same durable filesystem. Switch between them against the
same files.

## Limits

- 10 minutes maximum per job. Enforced as both a wall-clock deadline and a CPU
  ceiling.
- 100,000 AI tokens per session token, then refresh (free while credit remains).
- 10 GB per workspace.
- Outbound HTTP(S) to allowlisted API hosts only.

## Network access

Your sandbox can reach model providers (OpenAI, Anthropic, Google, Groq, xAI,
Mistral, DeepSeek, OpenRouter), package registries (npm, PyPI, GitHub), search
and data APIs (Firecrawl, Tavily, Wikipedia), and chain RPCs (Base, BaseScan,
CoinGecko).

Blocked unconditionally: private and loopback addresses, cloud metadata
endpoints, IP literals, non-HTTP schemes, and redirects. This protects you as
much as us — a workspace cannot be turned into a pivot into anyone's network.

Need another host? Ask. The allowlist is policy, not architecture.

## Payment

- Protocol: x402, version 2
- Network: Base mainnet (`eip155:8453`)
- Asset: USDC `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`
- Flow: prepaid credit. One settlement funds many jobs, so per-call fees do not
  eat sub-cent charges.

Settled by any major facilitator: Coinbase CDP, PayAI, Solvador. Payment is a
plain EIP-3009 transfer — no custom contract is involved.

## Endpoints

| Method | Path                  | Auth    | Purpose                              |
|--------|-----------------------|---------|--------------------------------------|
| GET    | /health               | none    | Liveness                             |
| GET    | /v1/pricing           | none    | Machine-readable rate card           |
| GET    | /v1/capabilities      | none    | Backends, limits, allowed hosts      |
| GET    | /v1/facilitators      | none    | Who can settle a payment to us       |
| GET    | /.well-known/x402     | none    | x402 discovery manifest              |
| POST   | /v1/session           | payment | Buy credit, receive a session token  |
| POST   | /v1/session/refresh   | bearer  | New token budget, free while in credit|
| POST   | /v1/compute/run       | bearer  | Execute code in your workspace       |
| GET    | /v1/account           | bearer  | Itemised statement of every charge   |

## Safety

Every model call is screened in both directions by Llama Guard. The check fails
closed: if the classifier errors or times out, the call does not proceed.

This is not decorative. Tool output is model input, so a page your agent fetches
can carry a prompt injection. Screening the return path is what stops that
becoming instructions.

## Honest notes

- Built on Cloudflare Computer, which is preview software. Good for real work,
  not yet for a service you would page someone about at 3am.
- Cold start on the container tier is seconds. Warm capacity autoscales with
  demand and drains to zero when idle, so most requests skip it.
- We bill what the meters say. `/v1/account` itemises every charge, and the
  arithmetic matches the rate card above.

## Contact

Operated by National Security Intelligence.
Issues and questions: https://github.com/National-Security-Intelligence