VoltageGPU hosts confidential MCP servers inside Intel TDX hardware enclaves. The Model Context Protocol carries far more sensitive payloads than ordinary chat: tool inputs and outputs include database schemas, file paths, internal API URIs, customer identifiers, signed audit events. Running the MCP server inside TDX keeps that traffic encrypted in CPU memory at runtime — the hypervisor cannot inspect it, and VoltageGPU operators cannot extract it.
Same per-token pricing as standard confidential inference. Qwen3-32B-TEE input at $0.50 / 1M, Qwen3-235B-TEE at $1.20 / 1M, DeepSeek-R1-TEE at $1.80 / 1M. No additional MCP hosting fee. No retention, no training on tool traffic.
Run Model Context Protocol servers inside hardware enclaves. Tools, resources, prompts — provider-blind.
MCP traffic carries database schemas, internal file paths, customer identifiers and audit events. Run it where neither the hypervisor nor the cloud operator can read it.
Model Context Protocol is an open standard for connecting LLM clients to external tools, resources, and prompt templates. Released in late 2024 and broadly adopted through 2025-2026, MCP became the de-facto agent integration spec across IDEs (Cursor, Continue, Zed), AI desktops (Claude Desktop, Cline) and orchestration frameworks (CrewAI, LangChain, LlamaIndex).
An MCP server exposes three primitives: tools (callable functions with typed inputs / outputs), resources (read-only references such as files or database rows), and prompts (parametric prompt templates). The full spec lives at modelcontextprotocol.io.
Tool calls leak more than chat
Inputs include schemas, file paths, secrets-in-context. Outputs include records, audit events, identifiers.
Comply launched MCP in April 2026
Compliance teams now wire MCP into the agent loop. The 2026 standard demands TEE-grade isolation for that traffic.
Regulated industries need TEE
Legal, financial and healthcare workloads cannot send tool traffic to US-hosted MCP servers under DORA / RGPD / HIPAA.
Point your MCP client at the VoltageGPU streaming endpoint. The server runs sealed inside Intel TDX and authenticates via your VoltageGPU API key.
// claude_desktop_config.json
{
"mcpServers": {
"voltage-confidential": {
"transport": "https",
"url": "https://api.voltagegpu.com/v1/mcp",
"headers": {
"Authorization": "Bearer vg-..."
}
}
}
}# Python MCP client over confidential transport
from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client
async with streamablehttp_client(
"https://api.voltagegpu.com/v1/mcp",
headers={"Authorization": "Bearer vg-..."},
) as (read, write, _):
async with ClientSession(read, write) as session:
await session.initialize()
tools = await session.list_tools()
result = await session.call_tool(
"search_precedents",
{"matter_id": "M-2026-0419", "query": "auto-renewal cap"},
)
print(result.content)For Cursor, Continue, Zed and other MCP-aware tools, follow the same pattern: HTTPS streaming transport, base URL https://api.voltagegpu.com/v1/mcp, bearer token from your API keys page.
Compliance MCP
Query NIS2, DORA, ISO 27001 control mappings inside the enclave. Control IDs and findings never leave EU jurisdiction.
Legal MCP
Tool calls into internal precedents, matter notes, and clause libraries stay sealed. The agent reasons over confidential context without exposing it.
Audit MCP
Stream signed audit events into reasoning loops while keeping raw events provider-blind. Suitable for SOC 2, ISAE 3000.
TLS 1.3 terminates inside the enclave
MCP traffic is never decrypted in untrusted memory. The TDX trust domain holds the TLS session keys.
AES-256 memory encryption at runtime
Tool inputs, resource reads and prompt templates remain encrypted in CPU memory. The hypervisor cannot inspect RAM.
ECDSA attestation per session
Each MCP session is bound to a signed attestation report identifying the TDX module and code measurement.
Zero retention
Tool inputs and outputs are not logged or stored. Native RGPD Article 28 DPA available without negotiation.
MCP traffic is metered at the same per-token rate as standard confidential inference. No additional MCP hosting fee. No retention. No training on tool traffic.
Volume contracts available beyond 100M tokens / mo.
EXPLORE FURTHER
Wire your MCP client to a confidential endpoint
Generate an API key and ship a tool call from inside the enclave today.