# Hyrule Cloud

> Putting the autonomous in autonomous system. An ISP operated by
> autonomous agents — no human in the loop by default. Agents discover,
> pay for, and provision compute, network intelligence, and network
> proxy on AS215932. x402 prices are machine-readable contracts.

## Agent purchase model

- Discover prices and schemas in the x402 manifest at
  https://cloud.hyrule.host/.well-known/x402.json and in the OpenAPI
  document at https://cloud.hyrule.host/openapi.json. Both live on the
  API host — resolve them absolutely, not against this document's origin.
- Call the resource normally; HTTP 402 returns exact payment requirements.
- Sign, retry with `Payment-Signature`, and consume the structured response.
- VM creation returns public status and save-once management URLs.
- Optional accounts use generated handles and recovery credentials.
- No-KYC ordering is available; operational service and payment records still apply.

## Products

- [Service catalog](https://hyrule.host/services): every live service group —
  compute, network intelligence, network proxy — with live per-endpoint
  pricing from enabled-only OpenAPI.
- [Toolbox](https://hyrule.host/toolbox): browser-wallet and WebMCP access to
  every currently enabled paid diagnostic.
- [For agents](https://hyrule.host/agents): direct x402 and browser-agent paths,
  including autonomous wallet settlement through WebMCP.
- [Order a VM](https://hyrule.host/order): server-rendered durable quote flow.
- [Service status](https://hyrule.host/status): current customer-impacting
  health for API checkout, compute, intelligence, domains/DNS, and proxy.
- [About & policy](https://hyrule.host/about): mission, operating principles,
  abuse-handling posture, and links to the authoritative service policies.
- [FAQ](https://hyrule.host/faq): integration, recovery, IPv6, and operations.
- [x402 VPS](https://hyrule.host/x402-vps): how an agent buys a VM over HTTP 402,
  with a sourced comparison against other agent VPS providers.
- [No-KYC VPS](https://hyrule.host/no-kyc-vps): what no-KYC ordering means here,
  what data is kept, and crypto payment options.
- [llms-full.txt](https://hyrule.host/llms-full.txt): this document plus live
  VM pricing and long-form answers in one file.
- [Terms](https://hyrule.host/terms), [Privacy](https://hyrule.host/privacy),
  [Abuse](https://hyrule.host/abuse), [Legal](https://hyrule.host/legal):
  service rules, data handling, notice/action flow, contact points.

## API

Canonical API host: https://cloud.hyrule.host (the web frontend at
https://hyrule.host proxies `/api/*` to it, so browser clients hit the same
origin). The brand origin's `/openapi.json` and `/.well-known/x402.json`
redirect here rather than publishing a second, divergent contract. Key URLs:

- OpenAPI schema: https://cloud.hyrule.host/openapi.json
- x402 service manifest: https://cloud.hyrule.host/.well-known/x402.json
- VM catalog: https://cloud.hyrule.host/v1/products/vms
- Service status: https://cloud.hyrule.host/v1/status
- Price a durable order (POST): https://cloud.hyrule.host/v1/vm/quote
- Provision a VM (POST, x402): https://cloud.hyrule.host/v1/vm/create
- Paid network request: https://cloud.hyrule.host/v1/network/request

Golden path (agent), all against https://cloud.hyrule.host:

    GET  /.well-known/x402.json
    GET  /v1/products/vms
    POST /v1/vm/quote  -> {quote_id, amount_usd, expires_at}
    POST /v1/vm/create {quote_id}  -> 402 + Payment-Required
    # sign EIP-3009 TransferWithAuthorization for amount_usd
    POST /v1/vm/create {quote_id} + Payment-Signature  -> 202 {vm_id, management_token}
    GET  /v1/vm/{vm_id}/status  -> poll to ready

## Not yet launched

- Domain registration, transfers, and managed DNS are deferred from the current
  launch catalog. The `/v1/domains/*` endpoints are not payable today, so this
  document does not list them as an agent product. They reappear automatically
  once the enabled x402 catalog advertises a payable domain operation.

## Payment

- x402 USDC on the following facilitator-verified chains:
    - Base — `eip155:8453` (chain id 8453)
    - Polygon — `eip155:137` (chain id 137)
    - Arbitrum — `eip155:42161` (chain id 42161)
- Native VM checkout rails currently enabled: XMR (`POST /api/v1/intent/create`).

## What ships with each VM

- Full SSH root access (ed25519 or RSA public key)
- Global IPv6 with NAT64/DNS64 to reach IPv4 destinations
- Automatic subdomain on `deploy.hyrule.host`
- Paid direct/Tor network requests are available through the API
- SSH, HTTP, HTTPS open by default; outbound SMTP blocked
- 1-365 day runtimes, extendable, 48-hour grace after expiry

## Network

- [AS215932](https://as215932.net): the current source for Hyrule Cloud's
  routing, peering, addressing, and infrastructure details.

## Enabled x402 operations

This list is generated from the API's enabled-only OpenAPI document.
Tagged diagnostics can also be run at https://hyrule.host/toolbox.

- `POST /v1/bgp/lookup` — Inputs: subject type, subject value, datasets, views, sources, time, and more. Returns: request id, subject, resolved, results, assertions, sources, and more. ($0.005–$0.01; toolbox)
- `POST /v1/dns/blocklists/check` — Inputs: domain. Returns: request id, input domain, normalized domain, verdict, categories, checked source count, and more. ($0.003; toolbox)
- `POST /v1/dns/filtering/check` — Inputs: domain. Returns: request id, input domain, normalized domain, vantage, overall, blocked profile count, and more. ($0.01; toolbox)
- `POST /v1/dns/lookup` — Inputs: name, type, resolver, dnssec, trace, timeout ms. Returns: request id, question, answers, authority, additional, rcode, and more. ($0.001; toolbox)
- `POST /v1/dns/propagation` — Inputs: name, type, expected, resolvers, authoritative, timeout ms. Returns: request id, status, summary, target, findings, sources, and more. ($0.001; toolbox)
- `POST /v1/ip/lookup` — Inputs: address, views, max age seconds. Returns: request id, address, geo, network, reverse dns, rdap, and more. ($0.003; toolbox)
- `POST /v1/mx/jobs` — Inputs: profile, target, checks, options. Returns: job id, job access token, status, target, profile, status url, and more. ($0.03; toolbox)
- `POST /v1/mx/check` — Inputs: tool, target, command, options. Returns: request id, tool, target, status, summary, findings, and more. ($0.005; toolbox)
- `POST /v1/mx/bounce/parse` — Inputs: message, context. Returns: status, classification, smtp status, remote mta, probable causes, recommended actions, and more. ($0.005; toolbox)
- `POST /v1/nat/port-forward/check` — Inputs: target, port, protocol, profile, vantage, timeout ms, and more. Returns: request id, status, summary, target, findings, sources, and more. ($0.005; toolbox)
- `POST /v1/ports/check` — Inputs: target, port, protocol, profile, vantage, timeout ms, and more. Returns: request id, status, summary, target, findings, sources, and more. ($0.003; toolbox)
- `POST /v1/rdap/lookup` — Inputs: subject type, subject value, include raw, max age seconds. Returns: request id, subject, registry, bootstrap url, parsed, raw, and more. ($0.003; toolbox)
- `POST /v1/whois/lookup` — Inputs: subject type, subject value, include raw, max age seconds. Returns: request id, subject, registry, server, parsed, raw, and more. ($0.005; toolbox)
- `POST /v1/tunnel/create` — Inputs: hours, allowlist cidrs. Returns: tunnel id, token, endpoint host, ssh port, public port, ssh command, and more. (from $0.05; toolbox)
- `POST /v1/voip/check` — Inputs: target, checks, sip port, timeout ms, include raw. Returns: request id, status, summary, target, findings, sources, and more. ($0.01; toolbox)
- `POST /v1/web/tls/deep` — Inputs: host, port, scan profile, checks, include raw. Returns: request id, status, summary, target, findings, sources, and more. ($0.10; toolbox)
- `POST /v1/web/check` — Inputs: target, checks, vantages, timeout ms, include raw. Returns: request id, status, summary, target, findings, sources, and more. ($0.005; toolbox)
- `POST /v1/vm/create` — Inputs: duration days, size, resources, os, ssh pubkey, domain mode, and more. Returns: vm id, status, status url, estimated ready seconds, management token, management url. (from $0.20; API)
- `POST /v1/vm/quote` — Lock a durable VM price quote (free; pass quote_id to POST /v1/vm/create). Free supporting route — no x402 payment required. (Live 402 quote; API)
- `DELETE /v1/vm/{vm_id}` — Destroy a VM permanently (management token required). Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/vm/{vm_id}/logs` — Provisioning log events (management token required). Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/vm/{vm_id}/status` — Public provisioning and launch-proof status poll. Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/vm/quote/{quote_id}` — Reload a previously locked VM quote. Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/vm/{vm_id}` — Full VM view including SSH target (management token required). Free supporting route — no x402 payment required. (Live 402 quote; API)
- `POST /v1/vm/{vm_id}/reboot` — Hard reboot a VM (management token required). Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/payments/networks` — Enabled payment networks, receiver address, and facilitator. Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/pricing` — Current price list for all resources. Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/products/vms` — Machine-readable VM catalog with customization pricing. Free supporting route — no x402 payment required. (Live 402 quote; API)
- `GET /v1/os/list` — Available OS templates. Free supporting route — no x402 payment required. (Live 402 quote; API)
- `POST /v1/network/request` — Inputs: url, method, headers, body, proxy mode, timeout seconds. Returns: status code, headers, body, elapsed seconds, proxy mode, error. ($0.01–$0.05; API)

Payment uses the exact requirements returned by HTTP 402; discovery prices
are estimates. Browser agents can quote, sign, pay, and consume results with
WebMCP. Headless agents should call https://cloud.hyrule.host directly.

## VM pricing (live)

| size | name | vCPU | RAM | disk | price |
|---|---|---|---|---|---|
| xs | 1C-1G-10G | 1 | 1 GB | 10 GB | $0.20/day |
| sm | 1C-2G-20G | 1 | 2 GB | 20 GB | $0.40/day |
| md | 2C-4G-20G | 2 | 4 GB | 20 GB | $0.60/day |
| lg | 4C-4G-40G | 4 | 4 GB | 40 GB | $0.80/day |

Authoritative prices: https://cloud.hyrule.host/v1/products/vms and the
x402 manifest at https://cloud.hyrule.host/.well-known/x402.json.

## Common questions

### Can an AI agent buy a VPS without an account?
Yes. A VM order is itself the paid x402 request: HTTP 402 returns exact USDC
requirements, the agent retries with `Payment-Signature`, and the API answers
202 with a public status URL and a save-once management URL. No signup, API
key, or balance top-up is needed. Optional accounts use generated handles.

### Is it no-KYC?
Yes. No government ID, phone number, card, or email is required for one-shot
orders. Payment and lifecycle records are still kept as described at
https://hyrule.host/privacy, and https://hyrule.host/terms applies.

### How long does provisioning take, and what happens at expiry?
Typical builds finish in about 60 seconds. VMs are prepaid per day for 1-365
days and can be extended; expired VMs keep a 48-hour grace period before
deletion.

### What about IPv4?
VMs are IPv6-native in 2a0c:b641:b51::/48 on AS215932. Outbound IPv4 works via
NAT64/DNS64. Inbound IPv4 to customer VMs is not available in v1.

### Who operates it?
Hyrule Networks, AS215932, from the Netherlands: https://as215932.net/