Autonomous GPU rentals: scoped keys, budgets, and MCP

Autonomous work. Explicit limits.

AI agents can now rent GPUs on nafnaf using scoped credentials, fixed rental terms, spending caps, and a local MCP adapter. An owner authorizes and funds the task once. The agent can then discover offers, book compute, inspect its rentals, obtain connection details, and delete its workspace within that authorization.

This is autonomous use of prepaid credit, not autonomous access to your card. The agent cannot top up the account, create more credentials, change provider settings, or control another agent's rentals. Our earlier integration guide described scoped delegation and MCP as next steps; those capabilities are now available.

Keep the owner outside the runtime.

Install the CLI using the official installer, inspecting the script before running it. Use an operator-controlled session to sign in with nafnaf login, add credit through Billing, and create an agent key with nafnaf agent keys create. Keep the owner's login, cookies, and payment details out of the agent environment.

A sensible first grant allows one active rental, at most one hour, an explicit maximum GPU-hour price, a modest lifetime dollar budget, and a short expiry. Grant rentals:read, rentals:create, rentals:connect, and rentals:delete only when the task needs them. Pause and resume are separate permissions. The rental must end before the key expires.

Store the newly issued nf_agent_ secret in your runtime's secret manager as NAFNAF_AGENT_KEY. Never put it in prompts, command arguments, source control, or logs. Invalid agent credentials fail closed instead of falling back to a saved owner login. Issue separate keys for separate tasks.

test -n "$NAFNAF_AGENT_KEY" || exit 1
nafnaf agent status --raw
nafnaf search offers 4090 --raw
nafnaf show instances --raw

These commands inspect authorization, offers, and this key's rentals without creating a paid workload. Do not publish raw instance output: a key with connect permission can reveal workload access details. Use the current nafnaf CLI; this guide was checked against version 0.10.0.

A grant is not a wallet.

Wallet credit pays actual usage; the agent grant caps delegated exposure. Booking a rental commits its full GPU term plus the approved storage and transfer budgets against the key's lifetime authorization. A one-hour $0.50 rental with a $2 storage budget and $1 transfer budget commits $3.50, even if actual usage costs less.

That authorization does not replenish when the workload finishes. Unused wallet reservations may be released, but they do not refill the key. Creating the key itself neither charges the account nor reserves its entire budget. Inspect committed_usd and remaining_usd as authorization figures, not invoices. The backend enforces these limits alongside available account credit.

Connect an MCP client.

nafnaf's adapter runs locally over stdio, using Python 3.12 or newer and uv. Download the adapter source and its dependency lock together, inspect the source, and store them as nafnaf_mcp.py and nafnaf_mcp.py.lock. Adapt this configuration to your client and use absolute paths:

{
  "mcpServers": {
    "nafnaf": {
      "command": "/absolute/path/to/uv",
      "args": [
        "run", "--locked", "--script",
        "/absolute/path/to/nafnaf_mcp.py"
      ]
    }
  }
}

Have the client's secret facility inject NAFNAF_AGENT_KEY into the child process. Keep its persistent state directory private. The adapter is not a public remote MCP service, SSH client, or local command runner. It currently quotes PyTorch workspaces with Jupyter or SSH access; SSH needs your existing public key. Tool annotations help clients present operations, but backend authorization remains the security boundary.

Treat model replies, offer labels, and workload logs as untrusted data. They must not change the task's permissions or direct the agent to reveal credentials.

Make the rental loop predictable.

1. Inspect. Call agent_status and search_offers. Choose a returned offer ID and verify memory, resources, and price.
2. Quote without buying. Call quote_rental with a fixed duration, maximum renter GPU-hour price, storage allowance and budget, and transfer budget. It saves exact terms and returns maximum authorization. It does not reserve availability.
3. Create once. Within the owner's approved task, call create_rental with that quote_id and a persisted, unique request_id. This is the paid operation. Changed availability or pricing can reject it; the adapter never silently accepts a higher price.
4. Reconcile uncertain results. Poll list_rentals. A timeout does not prove booking failed. Retry only the same quote and request ID; never invent a new ID to escape a timeout. Local request bindings and server duplicate protection prevent an exact retry from becoming another booking.
5. Connect and clean up. Request rental_connection only when needed, then use your separately authorized execution tool. Export results before delete_rental, which permanently deletes the workspace and files.

Stopping compute is not the same as deleting storage. Fixed-term compute ends at its deadline. Paused storage can continue charging within its approved budget. Revoking an agent key blocks new API operations, but does not terminate existing SSH sessions or delete funded rentals. The owner must review and stop that work separately.

Connect model calls separately.

Inference now uses https://inference.nafnaf.ai/v1. Create an nf_inf_ key in Inference and inspect the public model catalog for prices, output limits, protocols, and capabilities. The current catalog lists text models with tool calling and structured outputs; Chat Completions and Responses support JSON and streaming.

Inference keys do not inherit rental grant limits. A universal nf_inf_ key can access every available model. It is not a rental credential and does not carry an nf_agent_ grant's lifetime budget or model restrictions. Keep it in a trusted runtime that enforces the owner's task budget, output limits, and concurrency.

The local MCP adapter's inference_models and inference tools still target the former embedded API. That scoped inference path is retired during the shared-gateway cutover, and nf_agent_ credentials do not authenticate to the new inference host. Use the current inference API separately from the MCP rental workflow described here.

Paid inference uses the same prepaid account balance. A transport retry can create another paid generation, so retry only when another generation is intended. Closing a stream does not cancel already-dispatched work. The former scoped inference request-ID and free-launch behavior should not be assumed for the new gateway.

Autonomous usage, not card access.

Today, a person funds nafnaf through Stripe-hosted checkout. Agents then consume that prepaid balance under explicit grants. nafnaf does not currently support automatic wallet replenishment, MPP, or x402. MCP is an interface to compute tools, not a payment rail.

Agent payments already exist elsewhere. Stripe documents machine payments through MPP and x402, and Lium documents stablecoin top-ups for self-funding agents. We do not claim to be the first agent-accessible GPU service or the only platform with programmatic payments.

Our current focus is narrower: let an agent complete a compute task without handing it unrestricted account authority. Start with a small grant, inspect a quote before purchase, preserve request IDs, and make result export and deletion part of the task. Browse available GPUs or open Inference to choose the workload.