Confidential MCP Server
Sealed in Intel TDX
MODEL CONTEXT PROTOCOL · CONFIDENTIAL HOSTING

Confidential MCP Server —
Sealed in Intel TDX.

Run Model Context Protocol servers inside hardware enclaves. Tools, resources, prompts — provider-blind.

MCP traffic carries database schemas, internal file paths, customer identifiers and audit events. Run it where neither the hypervisor nor the cloud operator can read it.

What is MCP?

Model Context Protocol is an open standard for connecting LLM clients to external tools, resources, and prompt templates. Released in late 2024 and broadly adopted through 2025-2026, MCP became the de-facto agent integration spec across IDEs (Cursor, Continue, Zed), AI desktops (Claude Desktop, Cline) and orchestration frameworks (CrewAI, LangChain, LlamaIndex).

An MCP server exposes three primitives: tools (callable functions with typed inputs / outputs), resources (read-only references such as files or database rows), and prompts (parametric prompt templates). The full spec lives at modelcontextprotocol.io.

Why confidential MCP matters

Tool calls leak more than chat

Inputs include schemas, file paths, secrets-in-context. Outputs include records, audit events, identifiers.

Comply launched MCP in April 2026

Compliance teams now wire MCP into the agent loop. The 2026 standard demands TEE-grade isolation for that traffic.

Regulated industries need TEE

Legal, financial and healthcare workloads cannot send tool traffic to US-hosted MCP servers under DORA / RGPD / HIPAA.

Setup walkthrough

Point your MCP client at the VoltageGPU streaming endpoint. The server runs sealed inside Intel TDX and authenticates via your VoltageGPU API key.

Claude Desktop · claude_desktop_config.json
JSON
// claude_desktop_config.json
{
  "mcpServers": {
    "voltage-confidential": {
      "transport": "https",
      "url": "https://api.voltagegpu.com/v1/mcp",
      "headers": {
        "Authorization": "Bearer vg-..."
      }
    }
  }
}
Python · MCP client over confidential streaming HTTP
PYTHON
# Python MCP client over confidential transport
from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client

async with streamablehttp_client(
    "https://api.voltagegpu.com/v1/mcp",
    headers={"Authorization": "Bearer vg-..."},
) as (read, write, _):
    async with ClientSession(read, write) as session:
        await session.initialize()

        tools = await session.list_tools()
        result = await session.call_tool(
            "search_precedents",
            {"matter_id": "M-2026-0419", "query": "auto-renewal cap"},
        )
        print(result.content)

For Cursor, Continue, Zed and other MCP-aware tools, follow the same pattern: HTTPS streaming transport, base URL https://api.voltagegpu.com/v1/mcp, bearer token from your API keys page.

Use cases

Compliance MCP

Query NIS2, DORA, ISO 27001 control mappings inside the enclave. Control IDs and findings never leave EU jurisdiction.

NIS2DORAISO 27001

Legal MCP

Tool calls into internal precedents, matter notes, and clause libraries stay sealed. The agent reasons over confidential context without exposing it.

LegalMatter notes

Audit MCP

Stream signed audit events into reasoning loops while keeping raw events provider-blind. Suitable for SOC 2, ISAE 3000.

AuditSOC 2

Confidentiality model

TLS 1.3 terminates inside the enclave

MCP traffic is never decrypted in untrusted memory. The TDX trust domain holds the TLS session keys.

AES-256 memory encryption at runtime

Tool inputs, resource reads and prompt templates remain encrypted in CPU memory. The hypervisor cannot inspect RAM.

ECDSA attestation per session

Each MCP session is bound to a signed attestation report identifying the TDX module and code measurement.

Zero retention

Tool inputs and outputs are not logged or stored. Native RGPD Article 28 DPA available without negotiation.

Pricing

MCP traffic is metered at the same per-token rate as standard confidential inference. No additional MCP hosting fee. No retention. No training on tool traffic.

Qwen3-32B-TEE
in $0.50 / 1Mout $1.50 / 1M
Qwen3-235B-A22B-Instruct-2507-TEE
in $1.20 / 1Mout $3.50 / 1M
DeepSeek-R1-0528-TEE
in $1.80 / 1Mout $5.40 / 1M

Volume contracts available beyond 100M tokens / mo.

EXPLORE FURTHER

Bring Your Own Agent

Parent pillar

Sovereign agentic AI

Architectural overview

CrewAI deployment

Multi-agent crews

API reference

OpenAPI spec

All integrations

Frameworks & tools

MCP specification

modelcontextprotocol.io

Wire your MCP client to a confidential endpoint

Generate an API key and ship a tool call from inside the enclave today.

Get started