eigen-skills

EigenCompute MCP Server & Agent Skill — Deploy and manage apps in Trusted Execution Environments (TEE)

What is this?

eigen-skills gives AI agents the ability to deploy and manage apps on EigenCompute — hardware-isolated TEEs powered by Intel TDX with encrypted secrets and cryptographic attestation.

Works with:

• MCP Clients — Cursor, Claude Desktop, Antigravity, Cline, etc.
• Claude Code — via SKILL.md standard

npm install -g eigen-skills@latest

MCP Server Setup (Cursor, Claude Desktop, etc.)

1. Install

npm install -g eigen-skills

2. Configure your MCP client

Cursor (~/.cursor/mcp.json):

{
  "mcpServers": {
    "eigencompute": {
      "command": "eigen-mcp"
    }
  }
}

Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "eigencompute": {
      "command": "eigen-mcp"
    }
  }
}

3. Available MCP Tools

| Tool | Description | |------|-------------| | eigencompute_deploy | Deploy Docker image to TEE | | eigencompute_list | List all deployed apps | | eigencompute_info | Get app status, IP, details | | eigencompute_logs | View app logs | | eigencompute_start | Start stopped app | | eigencompute_stop | Stop running app | | eigencompute_terminate | Destroy app permanently | | eigencompute_whoami | Check CLI auth status | | eigencompute_env_set | Set sealed secrets | | eigencompute_upgrade | Upgrade running app |

Prerequisites

npm install -g @layr-labs/ecloud-cli@latest   # minimum v0.4.3
ecloud auth login
ecloud auth whoami

CRITICAL: CLI v0.4.3+ is required. Older versions have broken ITA attestation metadata causing deploy failures on all instance types.

Instance Types

| Type | vCPUs | Memory | TEE | Notes | |------|-------|--------|-----|-------| | g1-micro-1v | 2 shared | 1 GB | Shielded VM | Cheapest, attestation can be flaky | | g1-medium-1v | 2 shared | 4 GB | Shielded VM | | | g1-custom-2-4096s | 2 | 4 GB | SEV-SNP | | | g1-standard-2s | 2 | 8 GB | SEV-SNP | | | g1-standard-4t | 4 | 16 GB | TDX | Recommended — most reliable | | g1-standard-8t | 8 | 32 GB | TDX | |

Deploy (Non-Interactive, Agent-Friendly)

ecloud compute app deploy has 6+ interactive prompts. Use the full flag set for CI/agent contexts:

Step 1: Build & push Docker image (must be linux/amd64)

docker build --platform linux/amd64 -t <registry/image:tag> .
docker push <registry/image:tag>

Step 2: Deploy

# Remove Dockerfile to avoid "Choose deployment method" prompt
rm -f Dockerfile
touch .env  # create empty .env if no secrets

echo "n" | ecloud compute app deploy \
  --name <app-name> \
  --image-ref <registry/image:tag> \
  --skip-profile \
  --env-file .env \
  --instance-type g1-standard-4t \
  --log-visibility public \
  --resource-usage-monitoring enable \
  --verbose

Dockerfile Requirements

• Use EXPOSE <port> to declare your port
• App must listen on 0.0.0.0, not localhost
• EigenCompute wraps your CMD with compute-source-env.sh entrypoint — do NOT set your own ENTRYPOINT to source it manually

Manage Apps

ecloud compute app list
ecloud compute app info <APP_ID>
ecloud compute app logs <APP_ID>
ecloud compute app start <APP_ID>
ecloud compute app stop <APP_ID>
ecloud compute app upgrade <APP_ID>

Terminate (interactive confirm — pipe "y")

echo "y" | ecloud compute app terminate <APP_ID>

Sealed Secrets

ecloud compute app env set MY_SECRET="value" API_KEY="key"

Secrets are encrypted and only decryptable inside the TEE via KMS attestation. At boot, compute-source-env.sh fetches them and writes to /tmp/.env.

TEE Internals

┌─────────────────────────────────────────┐
│            EigenCompute TEE             │
│         (Intel TDX Enclave)             │
│                                         │
│  ┌─────────────────────────────────┐    │
│  │     Your Docker Container       │    │
│  │                                 │    │
│  │  • Encrypted memory             │    │
│  │  • Sealed secrets               │    │
│  │  • KMS signing key              │    │
│  │  • Cryptographic attestation    │    │
│  └─────────────────────────────────┘    │
│                                         │
│  /usr/local/bin/                         │
│  ├── compute-source-env.sh  (secrets)   │
│  ├── kms-signing-public-key.pem         │
│  └── kms-client                         │
└─────────────────────────────────────────┘

| Path | What | |------|------| | /usr/local/bin/compute-source-env.sh | Entrypoint — fetches secrets, then runs your CMD | | /usr/local/bin/kms-signing-public-key.pem | KMS signing public key | | /usr/local/bin/kms-client | KMS client binary |

Verify your app: https://verify-sepolia.eigencloud.xyz/app/<APP_ID>

Troubleshooting

| Symptom | Cause | Fix | |---------|-------|-----| | no ITA verifier client present | CLI too old (< v0.4.3) | sudo npm install -g @layr-labs/ecloud-cli@latest | | failed to quote: error code 0x15 | CLI too old or flaky Shielded VM | Update CLI, use g1-standard-4t | | No space left on device during layering | Docker disk full | docker system prune -f && docker builder prune -f | | "Choose deployment method" prompt hangs | Dockerfile present in deploy dir | rm -f Dockerfile before deploying | | App "Running" but port refuses connections | Attestation failed, app never started | Check ecloud compute app logs <APP_ID> | | IP changes on every deploy | Expected behavior | Don't hardcode IPs | | App ID changes on terminate + redeploy | Expected behavior | No persistent identity across deploys |

Scaffold a New App (Optional)

ecloud compute app create --name my-app --language typescript --template-repo minimal
# Languages: typescript, python, golang, rust

License

MIT