Run a VPN node on your server. Your AI agent can set it up.
Give your AI agent the ProofKit MCP server and SSH access to your server. It registers the node, installs it, runs the network's checks and fixes what they find. You set the price per GB and are paid in TON.
$ claude mcp add --transport http \
proofkit-operator \
https://proofkit.org/mcp/operator
> /mcp → sign in → Allow
✓ proofkit-operator · 22 tools
> Put a ProofKit exit on
[email protected]. It is in Brazil,
0.003 TON per GB.
▸ get_account 1.2 TON · covered
▸ wanted_locations exit · BR wanted
▸ server_requirements x86_64 · 1 GB
▸ ssh … install.sh --check x86_64 ok
▸ create_node br-1 · 1 TON staked
▸ ssh … install.sh --mode=docker online
▸ node_checks all pass
→ br-1 is in review. ProofKit tells you
when it is live.Run it the way you work
All four reach the same nodes. Start in one, switch to another whenever you like.
With your AI agent
An MCP server at proofkit.org/mcp/operator with 22 tools: register and install nodes, read their checks, change prices and settings, read your earnings. ChatGPT, Claude, Claude Code, Cursor, Codex and VS Code: sign in, or a key for scripts.
One command
# curl -fsSL https://proofkit.org/install.sh | bash -s -- \
--mode=docker --type=origin --token=…
The dashboard fills in the token. Run it as root.
The dashboard
Every node's checks, users, traffic and earnings on one page. What to fix comes with the command that fixes it.
See the dashboardThe Operator API
REST with an OpenAPI document, versioned like the Partner API: nothing is removed or renamed within v1. Keys with scopes, and an explorer to try calls.
Where the network needs nodes
Kept by the ProofKit team, with no traffic figures. Your agent reads the same list from the API and the MCP server.
| Node | Where | Why it is needed | |
|---|---|---|---|
| Entry | RURussia | Users in Russia connect through an entry inside the country. Entries at more providers keep them connected when one provider is blocked. | wanted |
| Exit | BRBrazil | The network has no exit in South America. | wanted |
| Exit | AUAustralia | The network has no exit in Oceania. | wanted |
| Exit | anyA country that already has one exit | A second exit keeps the country open to users while the first is down or full. | wanted |
From sign-up to earning
The network tests your node from outside before it sends anyone to it.
-
01
Deposit
1 TON per node, from your TON wallet. It becomes the node's stake.
-
02
Register, install
The address, country and your price, then one command as root. Or your agent does both.
-
03
Checks
The network tests the node's ports and cover site from outside and reads its disk and agent version from what the agent reports. You see each result and how to fix it.
-
04
Fix
A failing check comes with the command that fixes it, in the dashboard, the API and your email.
-
05
Review
ProofKit reviews each public node before it routes users there.
-
06
Live
Users connect. Earnings show up as their traffic is billed.
The stake keeps the network to people who mean it. It comes back to your balance when you delete the node, less any slash.
What you earn
You set a price per GB for each node: at least 0.001 TON for an exit, while an entry may be free. Users see it with the 20% network fee added, and you receive 0.96 times your price for every GB they move, upload and download both counted.
How much traffic a node gets depends on its country, price, uptime and demand, and the network is young. Do not plan around a fixed income.
| Your price | User pays / GB | You get / GB | You get / 100 GB |
|---|---|---|---|
| 0.001 TON | 0.0012 TON | 0.00096 TON | 0.096 TON |
| 0.01 TON | 0.012 TON | 0.0096 TON | 0.96 TON |
What an agent may do
You stay in charge. A sign-in asks at Allow whether the agent may only read or also manage your nodes, and a key's scopes are chosen when it is made. You can end either at once. Some things no key and no sign-in can do.
With the scopes you give it
- Register nodes and get their install command
- Read checks, metrics and events
- Change the price, name, limits, transports and cover site
- Restart, reinstall or delete a node
- Link an entry to an exit, and invite people to a private node
- Read your earnings, your balance and what you can claim
Never, with any key
- Link or change your wallet
- Withdraw your deposit
- Claim a payout: you press Claim yourself
- Change your password, email or two-factor
- See who your users are
What the server needs
- Linux on x86-64 with a public IPv4 address, kernel 5.6 or newer
- 1 vCPU and 1 GB of RAM at least; 2 vCPU and 2 GB recommended
- At least 1 GB of free disk to install; keep 2 GB free so updates can download
- Root access, with port 443 free on TCP and UDP
- Docker on any distribution, or AlmaLinux / CentOS Stream 10+
- A TON wallet with TonConnect, such as Tonkeeper, for the stake and payouts
Check a server before you register it. The command reads the machine, changes nothing and says what is missing:
$ curl -fsSL https://proofkit.org/install.sh | bash -s -- --check --type=exit
Common questions
Do I need an AI agent?
No. The dashboard and the one-line install do the same. The agent saves you the reading: it runs the commands, reads the checks and fixes what it can.
Is the stake refundable?
Yes. Deleting the node releases its 1 TON stake to your balance, minus any slash, and you can withdraw it. Claim the node's earnings first: a node with unclaimed earnings cannot be deleted.
Which agents work?
ChatGPT, Claude, Claude Code, Cursor, Codex and VS Code sign in with your ProofKit account; anything that speaks HTTPS can use a key.
What does an exit expose me to?
Users' traffic leaves from your server's address, so complaints about it reach you and your hosting provider. Torrent Guard blocks BitTorrent, and WARP sends users' TCP traffic out through Cloudflare while WARP answers; UDP, and TCP during a WARP outage, leave from your address.
Your server, your price.
Register a node in a minute and watch it pass the network's checks.