ProvenExit Checking

NEAR testnet only.

The VPN exit you verify before you connect

The exit runs in an Intel TDX machine on Phala Cloud. Before a byte leaves your machine, the client checks Intel's signature on what is running and asks a NEAR registry whether that build is still allowed.

Run the check yourself Read the limits

Checking

Fetching the latest check.

Not checked

The live check needs JavaScript. The commands under “Run it” do not.

    The checks, in the order the client runs them

    If one fails, the client stops there and opens no tunnel.

    The live result needs JavaScript. The replay command under “Run it” prints the same checks on your machine.

    How one connection is decided

    The NEAR registry

    –

    1. Your machine

      The client and its local proxy

    2. The exit

      –

    3. The website

      It sees the exit's address

    1. Your client sends the exit a fresh random number and asks for its Intel quote.
    2. It checks Intel's signature, that debug is off, and that the quote contains the exit's keys and your number.
    3. It reads the NEAR registry: is this build allowed, is this OS allowed, is this exit registered.
    4. Only then it opens an encrypted tunnel to the key in the quote. If the owner revokes the build, the next connection is refused.

    What the exit runs, and who decides

    The image the exit runs

    These values are part of the measurement Intel signs.

    NEAR ran the Intel check itself

    Who holds each key

    This site

    No key

    No wallet, no signing, no transactions. It reads the registry and the exit and shows the result.

    Every change to the allowlist

    Approvals, revocations and registrations on the registry, newest first.

    The address websites see

    Your address is read by this site and is not stored. The exit's address comes from api.ipify.org, asked through the tunnel.

    Check the exit from your own machine

    Node 22 and a network connection. No accounts.

    Verify the live exit and send one request through it

    npm ci && npx tsc -b && scripts/try-live.sh

    Prints every check, starts a local SOCKS5 proxy on 127.0.0.1:18180, and shows your IP next to the IP a website sees through the exit. It changes no system settings and needs no sudo.

    Replay the recorded check without a network

    npm ci && npx tsc -b && node client/dist/cli.js vpn verify --fixture fixtures/live-exit

    Replays the same exit's quote and registry state from a capture. You see one ✔ line for each check and ✔ VERIFIED (FIXTURE REPLAY …).

    What this does not prove

    1. Testnet only.

      The registry is on NEAR testnet, and there is one live exit. It is paid by the hour and may be stopped outside judging.

    2. Proxy only.

      TCP through a local SOCKS5 proxy. No UDP, no QUIC, no system-wide tunnel.

    3. The usual VPN and TEE caveats.

      The exit sees the hosts you connect to; ProvenExit proves the approved code does not keep them. The network around the exit sees timing and sizes, so use HTTPS. Intel, the TDX module and Phala's dstack OS are trusted roots, as for any app on TDX.

    Every VPN says “no logs”. This one proves it.

    Logging is off in the approved build, Intel signs what is running, and NEAR decides whether it is still allowed.

    Run the check yourself