Early access · Paid API credit is live. New accounts still get free starter credit.
PricingDocsModelsFAQEarnBlogAboutSign in →

Private inference.Unhosted models.

Uncensored models and community fine-tunes on independent Apple Silicon. Prompts are decrypted in-process and never logged. Apple hardware and running-code attestation are live.

# keep your SDK — swap the base URL
client = OpenAI(
  base_url="https://api.tryumbra.dev/v1",
  api_key="umbra-…"
)

What you send

What the machine owner sees

000000  27 06 85 95 cd e6 97 dc  |'.......|
000008  c2 7f e5 a6 45 40 d6 da  |....E@..|
000010  87 98 ef 14 8e 77 b1 10  |.....w..|
000018  a7 91 0a 98 f8 74 70 12  |.....tp.|
000020  e4 a1 19 6a 1d 69 00 b4  |...j.i..|
000028  a6 33 c3 8c 7f fb d3 19  |.3......|
000030  91 78 7c 38 63 3a 61 38  |.x|8c:a8|
000038  7d 0b 8b 56 d0 8d 0c 8b  |}..V....|
        … 59 further sealed bytes
cipher
ChaCha20-Poly1305
nonce
05121f2c 39465360 6d7a8794
tag
60f12786 57b350bd 8ba6eece df305dfd
Illustration, not a live channel — but the mechanism is real: these bytes are genuine ChaCha20-Poly1305 output, sealed in your browser under a key that never leaves it. In production the sealing key is held by the provider's Secure Enclave and the plaintext exists only inside the inference process.
Start freeOpen anonymous playground →

Up to 10M free tokens on signup. No card required.

Network state

read live · /api/stats

Coordinator
attested CVM
Runs in an attested confidential VM · provider hardware and APNs code identity live
Models live
…
open-weight base models in the public registry
Active providers
…
Apple Silicon · hardware and APNs running-code attestation live
Your prompts
never logged
Decrypted in memory, zeroized after each request

01

Two ways in

Two ways in.

For developers

One base_url swap.

Keep your OpenAI or Anthropic SDK. Reach the models no hosted API will touch, with Apple hardware and APNs running-code attestation live for admitted providers. Up to 10M free tokens, no card.

python

# point your existing OpenAI client at Umbra
client = OpenAI(
  base_url="https://api.tryumbra.dev/v1",
  api_key="umbra-…")

Try one anonymous request

short replies · capped · private

Ask anything — same private path as the API.

Anonymous · capped. Privacy →
Start free →

For Mac owners

Your Mac, idle most of the day.

Host the public models you choose with your own Hugging Face key and earn per token. Apple Silicon, M1 or newer.

shell

# verified macOS install
curl -fsSL tryumbra.dev/install.sh | sh
umbra setup
Review and download →

02

Idle silicon. Long-tail models. No middlemen stack.

Most inference pricing includes several layers between silicon and your app — capacity is bought, rented, repackaged, and metered. Meanwhile high-end Apple Silicon sits idle for long stretches, and the models incumbents refuse to host have nowhere to run. Umbra connects that idle capacity to the uncensored and community GGUF catalog providers choose with their own Hugging Face keys. Hardware is already paid for; the marginal cost is mostly electricity.

Long-tail
Models the big APIs will not list — community fine-tunes and uncensored weights, provider-approved.
In-process
llama.cpp linked in-process. No inference HTTP server, no subprocess, no IPC on the Mac.
Never logged
Prompts decrypted in memory, zeroized after each request. Writing a prompt to disk is a P0 bug.
Attested
Trust from Secure Enclave + SIP + MDM/MDA + APNs running-code identity. Signed per-response receipts remain in progress.

03

Operator-blind

Idle machines only work if the operator can’t read the request.

Prompts can contain customer conversations, internal plans, source code, and other sensitive context. A marketplace promise is not enough when inference runs on hardware you do not own. Umbra is designed around a stricter goal: the coordinator can route, the provider can serve, but neither should get a usable view of the prompt. Private inference needs privacy that can be verified — attestation enforcement is rolling out during alpha.

Requests are encrypted before they leave your app, and the coordinator routes ciphertext. Five layers then establish what the receiving Mac is, each independently checkable.

Umbra · chain of custody

Operator-blind by design

The mechanism behind each line is in the attestation spec; the value the coordinator checked against it is on the record.

document
chain-of-custody
stated in full
/docs/trust/
status
alpha · rolling out
  1. Secure EnclaveidentityP-256 on-chip. The private key never leaves.
  2. MDM profileenrollmentSecurityInfo cross-checks the Secure Enclave serial.
  3. Apple MDApolicyChain to the Apple Enterprise Attestation Root.
  4. Release identitycodeSigned, notarized release. Runtime attestation rolling out.
  5. GGUF SHA-256modelPinned revision, verified every request.

The operator contributes compute, not visibility.

Your prompt is decrypted in-process on the matched Mac, held in memory only, and zeroized after the request. Writing a prompt or output to disk or a log is a P0 bug.

Per-request signed receipts are still rolling out during alpha, so this chain covers which machine is admitted to serve — not a signature over an individual response. Threat model →

04

OpenAI- and Anthropic-compatible

Keep your SDK, request shape, and streaming code. Point the client at Umbra and start routing private inference to the long-tail catalog.

Base URL
https://api.tryumbra.dev/v1
Streaming
SSE · chat-completions shape
Keys
minted in the console after signup
Free credit
up to 10M tokens · no card
Docs
quickstart · trust · attestation

python

from openai import OpenAI

client = OpenAI(
    base_url="https://api.tryumbra.dev/v1",
    api_key="umbra-…"
)

response = client.chat.completions.create(
    model="…",  # from /v1/models
    messages=[
        {"role": "user", "content": "Hello"}
    ],
    stream=True
)

05

Built for the models with no other home.

Open-weight base models and community fine-tunes, served from Apple Silicon. The catalog is small and growing during alpha — pick one and point your client at it.

No plans or seats. Rates are per-model and identical for every provider serving that model. Live numbers come from GET /v1/models.

ModelArchQuantMin RAMInputOutput
hf-deepreinforce-ai-ornith-1.0-35b-gguf-ornith-1-0-35b-q4-k-mqwen35moeQ4_K_M23 GB$0.40/M$1.20/M
hf-deepreinforce-ai-ornith-1.0-9b-gguf-ornith-1-0-9b-q4-k-mqwen35Q4_K_M8 GB$0.10/M$0.30/M
hf-empero-ai-qwythos-9b-claude-mythos-5-1m-gguf-qwythos-9b-claude-mythos-5-1m-mtp-q4-k-mqwen35Q4_K_M16 GB$0.10/M$0.30/M
hf-hauhaucs-qwen3.6-35b-a3b-uncensored-hauhaucs-aggressive-qwen3-6-35b-a3b-uncensored-hauhaucs-aggressive-q4-k-mqwen35moeQ4_K_M23 GB$0.40/M$1.20/M

Pinned HF revisions on attested Apple hardware; attestation enforcement is in progress during alpha. Full pricing page ↗ · up to 10M free tokens on signup.

Browse the full catalog12 models live in the registry. Search by tag, license, trust level, or HF repo.→your-org/your-finetunePublish it to Hugging Face, and a provider can host it tomorrow. Provider-curated, public weights, the Umbra way.→

06

Earn from your Mac

Install the provider, choose public HF models with your own key, and earn per token when demand hits your machine. Apple Silicon, M1 or newer.

Install from Terminal

One verified command.

The supported installer verifies the signed and notarized app, installs the umbra command, then guided setup handles sign-in, enrollment, model choice, and hosting.

shell

curl -fsSL https://tryumbra.dev/install.sh | sh
umbra setup
Follow the setup guideVerify publisher and system changes

Earnings estimate

A projection, not a promise.

Modelled on idle capacity at platform-set rates. Live demand fluctuates, and nothing below is a commitment.

Projected net / moprojection · not billedSee calculator →
Full calculator →

Read the threat model

Architecture, attestation chain, and what is still rolling out during alpha: the Umbra equivalent of a research paper.

Threat model ↗

The machine owner shouldn’t be able to read your prompt. You should be able to prove it.

umbra (n.) · in a total eclipse, the innermost shadow: the region where the light source is completely hidden. Your prompts run there.

Private-prompt inference shouldn’t be a feature you take on faith. Apple hardware attestation and APNs running-code identity are live for admitted providers. Signed per-response receipts that bind an individual request to that evidence are still rolling out during alpha.

Start freeRead the attestation spec →

Your idle Mac can host the models the cloud won’t.

Most Apple Silicon machines sit idle for much of the day. Umbra turns that into verified per-token earnings and gives the long-tail model market the hosts it can’t find anywhere else.

Become a provider →

Check the numbers yourself.

Model, provider and request counts come straight from the coordinator. No fabricated supply, no invented traffic.

Live network stats →