Darkbloom

// Overview

Darkbloom is a decentralized private-inference network for Apple Silicon. Consumers call a standard HTTPS, OpenAI-compatible API; a Go coordinator running in a GCP Confidential VM authenticates the request, picks a provider, handles billing and relays the payload; and providers are Macs running the `darkbloom` Swift CLI, which connect outbound over WebSocket and run inference in-process on the GPU via MLX. Because providers dial out, no port forwarding or inbound firewall change is needed to run one.

The hard problem the project sets itself is that the person running a provider node has root and physical custody of the machine doing your inference, yet must not be able to read your prompts or the responses. Darkbloom closes the software paths to that plaintext: inference runs in-process via MLX so there is no subprocess, local server or IPC to tap; the process denies debugger attachment at the kernel level with `PT_DENY_ATTACH` and blocks memory-reading APIs through Hardened Runtime; the coordinator re-seals every request with NaCl Box (X25519 + XSalsa20-Poly1305) to the provider's attested key; and a four-layer attestation chain — Secure Enclave signatures, MDM cross-checks, Apple Managed Device Attestation and APNs code-identity — proves each node's posture.

The project is careful about what it does and does not claim. Plaintext is exposed only inside the coordinator's hardware-encrypted Confidential-VM memory, is never logged or retained, and is immediately re-encrypted for the selected provider; the residual threat is the same one Apple accepts for Private Cloud Compute, namely physically de-soldering and probing memory. Darkbloom is labelled public alpha, with breaking changes and downtime expected, and its billing invariants, platform fee and payout rules are stated once in the billing document.

// What it does

• OpenAI- and Anthropic-compatible API — most clients work by changing one base URL
• Providers are Apple Silicon Macs running a Swift CLI; inference runs in-process on the GPU through MLX
• Mandatory per-request NaCl Box encryption from the coordinator to the provider's attested X25519 key, with a fresh ephemeral key each request
• Provider hardening via Hardened Runtime, SIP and PT_DENY_ATTACH, immutable for the process lifetime
• Four-layer hardware attestation: Secure Enclave signatures, MDM SecurityInfo cross-check, Apple Managed Device Attestation and APNs code identity
• Per-response trust signals returned as X-Provider-Trust-Level, X-Provider-Attested, X-Provider-Encrypted and related headers
• Providers connect outbound over WebSocket, so no port forwarding or inbound firewall rules are required

// Getting started

There are two ways in. As a consumer you point an OpenAI SDK at the Darkbloom base URL. As a provider you run the Swift CLI on an Apple Silicon Mac and let it sell idle capacity. Both paths are documented in the repository; the consumer path is the fastest thing to try.

from openai import OpenAI

client = OpenAI(
    base_url="https://api.darkbloom.dev/v1",
    api_key="sk-db-...",
)

stream = client.chat.completions.create(
    model="gemma-4-26b",
    messages=[{"role": "user", "content": "Hello, Darkbloom!"}],
    stream=True,
)

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Serve inference where the machine operator must not be able to read prompts or responses, without building your own confidential-computing stack
• Point an existing OpenAI or Anthropic SDK application at a cheaper inference backend by changing the base URL
• Monetise idle Apple Silicon capacity by running a provider node on hardware you already own
• Study a working design for attested, end-to-end encrypted inference across untrusted operator machines

// How Darkbloom compares

Darkbloom alongside other open-source gpu & compute clouds tools AI/TLDR tracks, ranked by GitHub stars.