Hive Compute and testnet assets

Use Hive Compute when an agent needs hosted GPU work. Use the testnet faucet when a developer needs supported test assets with no monetary value. Both use the account’s Agent Credits and do not need a desktop session.

The primary compute operations are marketplace.search, models.list, chat.create, images.create, jobs.create, artifacts.upload, and artifacts.get. marketplace.listings and marketplace.status show live offers and capacity. The faucet operations are assets.list, claims.create, and claims.get. Read the complete live set through GET /capabilities/{serviceId}.

const issued = await createHivemindOSApiKey({
  creditToken: process.env.HIVEMINDOS_CREDIT_TOKEN!,
  label: "Compute and testnet backend",
  scopes: ["services:read", "services:invoke", "files:read", "files:write"],
  allowedServices: ["hive-compute", "testnet-faucet"],
  allowedOperations: [
    "capabilities.list",
    "services.invoke.hive-compute.marketplace.search",
    "services.invoke.hive-compute.marketplace.listings",
    "services.invoke.hive-compute.marketplace.status",
    "services.invoke.hive-compute.models.list",
    "services.invoke.hive-compute.chat.create",
    "services.invoke.hive-compute.images.create",
    "services.invoke.hive-compute.jobs.create",
    "services.invoke.hive-compute.jobs.get",
    "services.invoke.hive-compute.jobs.submit",
    "services.invoke.hive-compute.artifacts.upload",
    "services.invoke.hive-compute.artifacts.get",
    "services.invoke.hive-compute.artifacts.acknowledge",
    "services.invoke.testnet-faucet.assets.list",
    "services.invoke.testnet-faucet.claims.create",
    "services.invoke.testnet-faucet.claims.get",
  ],
  limits: {
    "services.invoke.hive-compute.marketplace.search": {
      requestsPerMinute: 60,
      maxConcurrent: 8,
    },
    "services.invoke.hive-compute.chat.create": {
      requestsPerMinute: 20,
      maxConcurrent: 4,
    },
    "services.invoke.testnet-faucet.claims.create": {
      requestsPerDay: 10,
      maxConcurrent: 1,
    },
  },
  idempotencyKey: "compute-testnet-key-v1",
});

Search the compute marketplace

Search before execution when an agent needs GPU work. The server resolves the privacy requirement, filters unavailable or ineligible hosts, calculates each offer’s maximum charge from its authenticated listing, and returns a recommended offer with a listingId that can be pinned on the execution call.

const capacity = await hive.services.invokeOperation(
  "hive-compute",
  "marketplace.search",
  undefined,
  {
    query: {
      modality: "chat",
      model: "hive-compute/auto",
      privacy: "auto",
      dataSensitivity: "public",
      estimatedInputTokens: 2_000,
      estimatedOutputTokens: 1_000,
    },
    idempotencyKey: "compute-search-public-chat-001",
  },
);

if (!capacity.ok || !capacity.result.available) {
  throw new Error("No eligible compute offer is live.");
}

console.log(capacity.result.privacy.resolved);
console.log(capacity.result.recommended.trust.label);
console.log(capacity.result.recommended.estimatedChargeCredits);

Privacy values:

Standard and Confidential Verified hosts both earn from completed customer-paid jobs. Attested hosts carry a visible Confidential Verified trust badge even when the particular request is Standard. The signed completion receipt records both the actual execution privacy tier and the selected worker’s trust tier.

Never send wallet secrets, passwords, API keys, private keys, or recovery phrases to a GPU worker in either tier.

Run managed inference

Read the live model catalog before selecting a model:

const models = await hive.services.invokeOperation(
  "hive-compute",
  "models.list",
  undefined,
  { idempotencyKey: "compute-models-2026-08-25" },
);

For public or low-sensitivity work, select Standard and pin the offer returned by marketplace search:

const completion = await hive.services.invokeOperation(
  "hive-compute",
  "chat.create",
  {
    model: "hive-compute/auto",
    messages: [{ role: "user", content: "Summarize this public benchmark." }],
    stream: false,
    hivemindos: {
      privacy: "standard",
      dataSensitivity: "public",
      listingId: capacity.result.recommended.listingId,
    },
  },
  { idempotencyKey: "risk-summary-001" },
);

if (!completion.ok) throw new Error(completion.error);
console.log(completion.chargedCredits);
console.log(completion.result);

For private work, keep the matching RSA-OAEP private key in your application and send only its SPKI PEM public key. A confidential request without this key, or without eligible attested capacity, fails without charge and never falls back to Standard:

const privateCompletion = await hive.services.invokeOperation(
  "hive-compute",
  "chat.create",
  {
    model: "hive-compute/auto",
    messages: [{ role: "user", content: privatePrompt }],
    stream: false,
    hivemindos: {
      privacy: "confidential",
      dataSensitivity: "confidential",
      outputPublicKey: process.env.COMPUTE_OUTPUT_PUBLIC_KEY_PEM!,
    },
  },
  { idempotencyKey: "private-summary-001" },
);

Use images.create for image generation. It uses the same encrypted-output option and returns base64 image data inside result:

const image = await hive.services.invokeOperation(
  "hive-compute",
  "images.create",
  {
    model: "hive-compute/image",
    prompt: "A clean studio product photograph",
    n: 1,
    response_format: "b64_json",
    hivemindos: { privacy: "standard", dataSensitivity: "public" },
  },
  { idempotencyKey: "product-image-001" },
);

Streaming is not available on the managed-credit route because the service reports one exact settled charge after completion. Use stream: false and read chargedCredits from the successful invocation.

Connect an agent through MCP

The remote Hive Compute MCP server is a request-driven facade over the same SuperAgent API operations:

URL: https://compute-mcp.hivemindos.app/mcp
Authentication: Authorization: Bearer hmos_live_...
Transport: Streamable HTTP

It does not create a separate balance or permission system. The bearer key’s service allowlist, exact operation allowlist, project boundary, per-endpoint limits, and HivemindOS credit balance remain authoritative.

Available tools:

Give an agent the smallest API key it needs. A search-only agent can be limited to services.invoke.hive-compute.marketplace.search. A chat agent can add services.invoke.hive-compute.chat.create with independent request, daily, credit, and concurrency ceilings.

MCP clients that support custom authorization headers can use SuperAgent API keys directly. Products that require OAuth for remote MCP connectors need a future HivemindOS OAuth authorization flow; do not paste a SuperAgent API key into a client that cannot store bearer credentials securely.

Run a confidential asynchronous workload

Start with capabilities.list to read the live workload kinds, MIME types, limits, billing units, and eligible models. Then use this sequence:

1. Call jobs.create with the workload descriptor and your output public key. Plaintext workload parameters are rejected.
2. Encrypt the input for the returned job and enclave key.
3. Upload the ciphertext to the Platform file store.
4. Attach that managed ciphertext file with artifacts.upload.
5. Call jobs.submit with the encrypted payload and the same output public key.
6. Poll jobs.get until the job completes.
7. Download each encrypted result with artifacts.get, decrypt it locally, then call artifacts.acknowledge to remove it.

Create the draft:

type ComputeJobDraft = {
  id: string;
  worker: { encryptionKeySha256: string };
};

const created = await hive.services.invokeOperation<ComputeJobDraft>(
  "hive-compute",
  "jobs.create",
  {
    protocol: "hive-compute.workload.v1",
    kind: "video",
    task: "text-to-video",
    model: selectedModel,
    inputMimeTypes: ["application/octet-stream"],
    outputMimeTypes: ["video/mp4"],
    billingUnit: "second",
    requestedUnits: 1,
    outputPublicKey: process.env.COMPUTE_OUTPUT_PUBLIC_KEY_PEM!,
  },
  { idempotencyKey: "confidential-video-001" },
);

if (!created.ok) throw new Error(created.error);

Upload only ciphertext. The artifacts.upload capability declares requestFormat: "binary", accepts exactly one managed file, and derives the ciphertext digest from that file’s verified record:

const ciphertextFile = await hive.files.upload(
  {
    name: "job-input.enc",
    contentType: "application/octet-stream",
    bytes: ciphertextBytes,
  },
  { idempotencyKey: "confidential-video-input-001" },
);

if (!ciphertextFile.ok) throw new Error(ciphertextFile.error);

await hive.services.invokeOperation(
  "hive-compute",
  "artifacts.upload",
  {
    encryptedMimeType: "application/octet-stream",
    encryptionPublicKeySha256: created.result.worker.encryptionKeySha256,
    encryptedKey: wrappedContentKeyBase64,
    chunkSize: ciphertextBytes.byteLength,
    chunks: 1,
  },
  {
    pathParameters: {
      jobId: created.result.id,
      artifactId: `${created.result.id}.input.1`,
    },
    fileIds: [ciphertextFile.file.id],
    idempotencyKey: "confidential-video-artifact-001",
  },
);

artifacts.get returns encrypted bytes as a JSON-safe envelope with contentType, encoding: "base64", and data. The SuperAgent API accepts managed input files up to 25 MB and returns encrypted compute artifacts up to 25 MB per call.

Request testnet assets

Testnet assets have no monetary value. Read assets.list immediately before a claim to get the supported network and asset pairs, amount, quota, and exact priceCredits:

const catalog = await hive.services.invokeOperation(
  "testnet-faucet",
  "assets.list",
  undefined,
  { idempotencyKey: "faucet-assets-2026-08-25" },
);

Create a claim using a pair returned by the live catalog. The input idempotency key identifies the faucet claim; the request option protects the outer Platform invocation:

type FaucetClaimResult = {
  claim: { id: string; status: string };
};

const claim = await hive.services.invokeOperation<FaucetClaimResult>(
  "testnet-faucet",
  "claims.create",
  {
    network: selected.network,
    asset: selected.asset,
    recipient: testnetRecipient,
    idempotencyKey: "onboarding-wallet-001",
  },
  { idempotencyKey: "platform-onboarding-wallet-001" },
);

if (!claim.ok) throw new Error(claim.error);
console.log(claim.chargedCredits, claim.result.claim);

Retry an uncertain request with both original idempotency keys. Use claims.get with the returned claim id to read its current state:

const status = await hive.services.invokeOperation(
  "testnet-faucet",
  "claims.get",
  undefined,
  {
    pathParameters: { claimId: claim.result.claim.id },
    idempotencyKey: "claim-status-onboarding-wallet-001",
  },
);

Claims are isolated to the HivemindOS account behind the API key. Another account cannot read a claim by guessing its id. Provider failures release the credit reservation; a delivered and settled claim returns the exact final charge.

Next: set exact endpoint limits, inspect usage and audit records, or browse every service.