Install Prism
One command to install the build for your machine. On Windows, Prism runs in WSL.
Paste into your terminal on macOS 13+ or Linux. The installer selects Apple silicon, Intel or ARM automatically.
curl -qfsSL --proto '=https' --tlsv1.2 'https://www.prismux.dev/install.sh' | sh -s -- --base-url 'https://www.prismux.dev/releases/stable'Then run prism. /detect shows detected local logins. Use /source codex or /source claude for an installed CLI. For a custom endpoint, set /endpoint <url> and choose /source endpoint.
/version shows your build. Run /upgrade to download and apply a verified update when idle, keeping your session. /update auto <mode> saves your policy: notify, download, apply or off.
Official releases are signed and checked before they run. New CLI builds pin the signing key and reject expired update metadata. Installation requires curl and OpenSSH 8.2+ (ssh-keygen).
These are not screenshots
Every block on this page is captured by running the shipped binary when the site is built, in the terminal’s own truecolour, on both a dark and a light ground. Nothing here is retyped or touched up. A hand-pasted transcript goes stale the first time a column moves and nobody finds out for a year.
The CLI is English-only. This page is published in four languages and the program is not: what you see inside the terminal frames is exactly what the binary prints, in the one language it prints. Translating a transcript would make this page a claim the software does not support.
Verifying what you were billed
A receipt chain proves its records are unaltered and in order. Pinning the head — the hash you were given last time, or the one on your contract — proves nothing was cut off the end.
◢◤ prismux verify
reading 287 receipts from receipts.jsonl
keys 1 from prismux-receipts.pub
✓ rcp_01M1JYQEGR7H5… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEGZKMN… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEH5E2F… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHCGAJ… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHKZJK… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHT2G7… claude-opus-5 direct $0.002836
✓ rcp_01M1JYQEJ1AWG… claude-opus-5 direct $0.002490
✓ rcp_01M1JYQEJ897C… gpt-5.x direct $0.001067
✓ rcp_01M1JYQEJF0HF… claude-sonnet-5 direct $0.000966
✓ rcp_01M1JYQEJNSS2… claude-sonnet-5 direct $0.001079
✓ rcp_01M1JYQEJVVXJ… claude-sonnet-5 failover $0.001109
✓ rcp_01M1JYQEK1C6D… claude-sonnet-5 failover $0.000812
… and 275 more
────────────────────────────────────────────────────────────────────────
✓ signatures 287 of 287 verified against the key you supplied
✓ 287 receipts · chain intact from genesis · total $0.325263
✓ complete the chain ends at the head you pinned
nothing was cut from the end. a request that never produced a receipt
leaves no gap here — that is the invoice comparison, not this one. ◢◤ prismux verify
reading 287 receipts from receipts.jsonl
keys 1 from prismux-receipts.pub
✓ rcp_01M1JYQEGR7H5… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEGZKMN… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEH5E2F… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHCGAJ… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHKZJK… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHT2G7… claude-opus-5 direct $0.002836
✓ rcp_01M1JYQEJ1AWG… claude-opus-5 direct $0.002490
✓ rcp_01M1JYQEJ897C… gpt-5.x direct $0.001067
✓ rcp_01M1JYQEJF0HF… claude-sonnet-5 direct $0.000966
✓ rcp_01M1JYQEJNSS2… claude-sonnet-5 direct $0.001079
✓ rcp_01M1JYQEJVVXJ… claude-sonnet-5 failover $0.001109
✓ rcp_01M1JYQEK1C6D… claude-sonnet-5 failover $0.000812
… and 275 more
────────────────────────────────────────────────────────────────────────
✓ signatures 287 of 287 verified against the key you supplied
✓ 287 receipts · chain intact from genesis · total $0.325263
✓ complete the chain ends at the head you pinned
nothing was cut from the end. a request that never produced a receipt
leaves no gap here — that is the invoice comparison, not this one.The deletion nothing else catches
Delete receipts from the end of a chain and it stays valid by construction — a prefix of a valid chain is a valid chain. Every hash still recomputes and every signature still verifies. Without a pinned head the tool would call this intact, and then accuse an honest invoice of overbilling for the receipts it can no longer see.
◢◤ prismux verify
reading 200 receipts from truncated.jsonl
keys 1 from prismux-receipts.pub
✓ rcp_01M1JYQEGR7H5… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEGZKMN… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEH5E2F… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHCGAJ… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHKZJK… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHT2G7… claude-opus-5 direct $0.002836
✓ rcp_01M1JYQEJ1AWG… claude-opus-5 direct $0.002490
✓ rcp_01M1JYQEJ897C… gpt-5.x direct $0.001067
✓ rcp_01M1JYQEJF0HF… claude-sonnet-5 direct $0.000966
✓ rcp_01M1JYQEJNSS2… claude-sonnet-5 direct $0.001079
✓ rcp_01M1JYQEJVVXJ… claude-sonnet-5 failover $0.001109
✓ rcp_01M1JYQEK1C6D… claude-sonnet-5 failover $0.000812
… and 188 more
────────────────────────────────────────────────────────────────────────
✓ signatures 200 of 200 verified against the key you supplied
✓ 200 receipts · chain intact from genesis · total $0.226875
✗ complete the chain does NOT end at the head you pinned
pinned sha256:b5d0351c2f9ce4f40cfaa5f237d6b8974157db9a80b03639d6178ce9ac76330c
found sha256:352f1982312a999d1627f930075f06d4e8cfd84a7daac10c4f53da5038eeed6d
Records were added after the head you pinned, or removed before it. Every
hash below this point may still recompute: a prefix of a valid chain is a
valid chain, which is why the head has to come from outside the file. ◢◤ prismux verify
reading 200 receipts from truncated.jsonl
keys 1 from prismux-receipts.pub
✓ rcp_01M1JYQEGR7H5… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEGZKMN… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEH5E2F… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHCGAJ… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHKZJK… claude-sonnet-5 direct $0.000785
✓ rcp_01M1JYQEHT2G7… claude-opus-5 direct $0.002836
✓ rcp_01M1JYQEJ1AWG… claude-opus-5 direct $0.002490
✓ rcp_01M1JYQEJ897C… gpt-5.x direct $0.001067
✓ rcp_01M1JYQEJF0HF… claude-sonnet-5 direct $0.000966
✓ rcp_01M1JYQEJNSS2… claude-sonnet-5 direct $0.001079
✓ rcp_01M1JYQEJVVXJ… claude-sonnet-5 failover $0.001109
✓ rcp_01M1JYQEK1C6D… claude-sonnet-5 failover $0.000812
… and 188 more
────────────────────────────────────────────────────────────────────────
✓ signatures 200 of 200 verified against the key you supplied
✓ 200 receipts · chain intact from genesis · total $0.226875
✗ complete the chain does NOT end at the head you pinned
pinned sha256:b5d0351c2f9ce4f40cfaa5f237d6b8974157db9a80b03639d6178ce9ac76330c
found sha256:352f1982312a999d1627f930075f06d4e8cfd84a7daac10c4f53da5038eeed6d
Records were added after the head you pinned, or removed before it. Every
hash below this point may still recompute: a prefix of a valid chain is a
valid chain, which is why the head has to come from outside the file.One receipt, straight off a response header
You do not need a chain file to check a single request. A non-streaming response carries x-prism-receipt — base64 of the exact line that was appended to the chain, not a second rendering of the same facts — so whatever SDK you already use hands you the evidence along with the answer. Pipe it in and the tool recomputes the content hash and checks the signature against a key you pinned.
◢◤ prismux verify
✓ rcp_01M1JYQEGR7H5… claude-sonnet-5 direct $0.000785
────────────────────────────────────────────────────────────────────────
✓ content hash recomputes — this receipt was not altered after it was written
✓ signature verifies under a key you pinned ◢◤ prismux verify
✓ rcp_01M1JYQEGR7H5… claude-sonnet-5 direct $0.000785
────────────────────────────────────────────────────────────────────────
✓ content hash recomputes — this receipt was not altered after it was written
✓ signature verifies under a key you pinnedWhat you spent, from your own copy
Per organisation, per model, per endpoint, with the refusals counted and the unpriced requests named as unpriced rather than silently counted as free. Computed from the receipts you hold, with no network and no trust in us.
◢◤ prismux usage
reading 287 receipts from receipts.jsonl
────────────────────────────────────────────────────────────────────────
· signatures not checked — every receipt carries one; pass --keys <file> to check it
✓ 287 receipts · chain intact from genesis · total $0.325263
these receipts are signed; pass --keys <file> to check the signatures too.
· complete not proved — a chain proves order and content, not that nothing was cut from the end
pin this head and pass it back as --head to prove it next time:
sha256:b5d0351c2f9ce4f40cfaa5f237d6b8974157db9a80b03639d6178ce9ac76330c
01 period ────────────────────────────────────────────────────────────────────
covering 2026-09-03 06:19 to 2026-09-03 06:23
from t0, which the canonical form signs
receipts 287 counted of 287 read
02 totals ────────────────────────────────────────────────────────────────────
delivered 278
refused 9
with failover 22
tokens in 1,995
tokens out 20,734
provider cost $0.258065
margin $0.067198
charged $0.325263
absorbed $0.000380
cost we ate rather than passed on
unpriced 78 requests — a zero here means unknown, not free
synthetic 287 requests were served by the mock upstream
03 by org ────────────────────────────────────────────────────────────────────
KEY REQUESTS TOKENS IN TOKENS OUT CHARGED
org_northwind 287 1,995 20,734 $0.325263
all synthetic
04 by model ──────────────────────────────────────────────────────────────────
KEY REQUESTS TOKENS IN TOKENS OUT CHARGED
claude-sonnet-5 182 1,272 13,311 $0.167526
all synthetic
claude-opus-5 58 432 3,666 $0.115921
all synthetic
gpt-5.x 24 120 1,929 $0.028938
all synthetic
gemini-3-pro 12 84 1,012 $0.011728
all synthetic
llama-4-405b 11 87 816 $0.001150
all synthetic
05 by endpoint ───────────────────────────────────────────────────────────────
KEY REQUESTS TOKENS IN TOKENS OUT CHARGED
ep_mock_anthropic_dire… 161 1,208 11,990 $0.151058
all synthetic
ep_mock_anthropic_dire… 48 408 3,321 $0.105114
all synthetic
ep_mock_openai_direct_… 24 120 1,929 $0.028938
all synthetic
ep_mock_bedrock_euc1_s… 16 64 1,321 $0.016468
all synthetic
ep_mock_vertex_usc1_ge… 12 84 1,012 $0.011728
all synthetic
ep_mock_vertex_euw4_op… 5 20 276 $0.008651
all synthetic
ep_mock_bedrock_apse1_… 1 4 69 $0.002156
all synthetic
ep_mock_bedrock_euw1_l… 11 87 816 $0.001150
all synthetic
(nothing was served) 9 0 0 $0.000000
all synthetic
06 refusals ──────────────────────────────────────────────────────────────────
from attempts and delivery, both inside the signature
refused before any upstream attempt 7
refused after every attempt failed 2
from the attempt ladder — NOT covered by the signature
(no reason in the ladder) 9
N E X T
prism sessions <id> · which requests made up a session
prism why <receipt-id> -f receipts.jsonl
prism reconcile receipts.jsonl --invoice <amount> ◢◤ prismux usage
reading 287 receipts from receipts.jsonl
────────────────────────────────────────────────────────────────────────
· signatures not checked — every receipt carries one; pass --keys <file> to check it
✓ 287 receipts · chain intact from genesis · total $0.325263
these receipts are signed; pass --keys <file> to check the signatures too.
· complete not proved — a chain proves order and content, not that nothing was cut from the end
pin this head and pass it back as --head to prove it next time:
sha256:b5d0351c2f9ce4f40cfaa5f237d6b8974157db9a80b03639d6178ce9ac76330c
01 period ────────────────────────────────────────────────────────────────────
covering 2026-09-03 06:19 to 2026-09-03 06:23
from t0, which the canonical form signs
receipts 287 counted of 287 read
02 totals ────────────────────────────────────────────────────────────────────
delivered 278
refused 9
with failover 22
tokens in 1,995
tokens out 20,734
provider cost $0.258065
margin $0.067198
charged $0.325263
absorbed $0.000380
cost we ate rather than passed on
unpriced 78 requests — a zero here means unknown, not free
synthetic 287 requests were served by the mock upstream
03 by org ────────────────────────────────────────────────────────────────────
KEY REQUESTS TOKENS IN TOKENS OUT CHARGED
org_northwind 287 1,995 20,734 $0.325263
all synthetic
04 by model ──────────────────────────────────────────────────────────────────
KEY REQUESTS TOKENS IN TOKENS OUT CHARGED
claude-sonnet-5 182 1,272 13,311 $0.167526
all synthetic
claude-opus-5 58 432 3,666 $0.115921
all synthetic
gpt-5.x 24 120 1,929 $0.028938
all synthetic
gemini-3-pro 12 84 1,012 $0.011728
all synthetic
llama-4-405b 11 87 816 $0.001150
all synthetic
05 by endpoint ───────────────────────────────────────────────────────────────
KEY REQUESTS TOKENS IN TOKENS OUT CHARGED
ep_mock_anthropic_dire… 161 1,208 11,990 $0.151058
all synthetic
ep_mock_anthropic_dire… 48 408 3,321 $0.105114
all synthetic
ep_mock_openai_direct_… 24 120 1,929 $0.028938
all synthetic
ep_mock_bedrock_euc1_s… 16 64 1,321 $0.016468
all synthetic
ep_mock_vertex_usc1_ge… 12 84 1,012 $0.011728
all synthetic
ep_mock_vertex_euw4_op… 5 20 276 $0.008651
all synthetic
ep_mock_bedrock_apse1_… 1 4 69 $0.002156
all synthetic
ep_mock_bedrock_euw1_l… 11 87 816 $0.001150
all synthetic
(nothing was served) 9 0 0 $0.000000
all synthetic
06 refusals ──────────────────────────────────────────────────────────────────
from attempts and delivery, both inside the signature
refused before any upstream attempt 7
refused after every attempt failed 2
from the attempt ladder — NOT covered by the signature
(no reason in the ladder) 9
N E X T
prism sessions <id> · which requests made up a session
prism why <receipt-id> -f receipts.jsonl
prism reconcile receipts.jsonl --invoice <amount>A session, and what it costs as it goes
The agent is the part you spend the day in. Every round is accounted as it happens — tokens, the stop reason, and a receipt id — and the rounds the model spends calling tools use compact summaries, so the answer is not buried in accounting. Commands start with a slash; anything that is not one is a prompt, and an unknown command is answered locally rather than sent to the model.
Use /perf to inspect response timing and output throughput in tok/s. The view separates reported token counts from estimates and shows which interval was measured. /display performance off hides the inline figures; /display performance on restores them and saves your preference.
◢◤ prismux chat claude-opus-5 • MOCK synthetic responses, no network
────────────────────────────────────────────────────────────────────
/help for commands · /quit to leave
reachable as cli_run — other sessions can /msg it
→
commands
/version show the running CLI version and platform without a model request
/upgrade [check|download|restart|cancel] download and apply a verified release at idle, preserving this session
/update [check|download|restart|auto on|off] check trusted releases, stage a verified update, or restart at the idle boundary
/source [endpoint|codex|claude|opencode] show or switch execution source; configured endpoint is retained
/reasoning [level|auto] show or set reasoning for the active source/model; /effort is an alias
/help this list
/tokens context size against the budget
/limits membership usage and reset windows for the active SDK source; no inference
/usage membership usage; alias of /limits (session accounting: /cost)
/retry re-send your last prompt now; `/retry reset` sends it when the SDK's rate-limit window resets; `/retry off` cancels
/selfprompt [idle|after|every|loop|list] schedule future prompts; inspect, pause, resume, cancel, or run a schedule
/window the context window prism plans against: `/window` shows it and its source, `/window 1m` sets it and remembers it for this model, `/window forget` drops it (`/context` shows usage)
/compact fold the history into a digest now
/reset drop the conversation, keep the session and its receipts
/clear clear the screen (the conversation stays — that is /reset)
/model [name|list] show or switch the model; `list` queries the selected source
/endpoint [url] show or switch the router this session talks to
/transcript browse retained messages; alt+v preserves the draft
/tools what this session can call, MCP included
/agents sub-agent definitions, and what children have cost
/agent [n] open one sub-agent: what it did, its tokens, its bill
/main leave a focused sub-agent and come back here
/receipts the receipt ids issued this session
/session id, turns, store path
/restart reload the installed CLI here, preserving this session and unsent input
/cost what this session has cost, and how that was derived
/perf last request timing, observed tok/s, and measurement limits
/status diagnose this session: endpoint, model, auth, MCP, receipts
/memory the project instructions loaded, and where they live
/init write a PRISMUX.md from what is on disk
/diff what this session changed on disk, read off the disk
/rewind [n] return to a prompt; add files or both to restore tracked edits
/sessions every recorded conversation, newest first
/resume [id] bring another conversation's context in here
/mode [name] show or change what may run: plan, ask, accept-edits, full-auto
/theme [name|preview|save|terminal] preview, select and save themes; opt into terminal-wide colors
/display [what] show or change tool output, thinking and performance visibility
/settings [name] every setting in force, and which layer set it
/detect [refresh|local|login|verify|models|limits] refresh discovery, sign in, verify access and fetch live models
/todos the task list the model is keeping
/tool [n] inspect a call; add page N, args, or all; alt+t opens the latest
/approve accept the plan just submitted and start work
/peers sessions and sub-agents you can message, and their addresses
/accounts the credential pool: which one is serving, which are cooling
/msg <name> <text> send one message to a session or a running sub-agent
/inbox take anything waiting for this session now
/quit leave (so do exit, and Ctrl-C at the prompt)
the : spelling works for all of them · anything else is a prompt
attachments
@path inline a file, list a directory, or attach an image
@clipboard attach the image on the clipboard (macOS)
PNG, JPEG, GIF and WebP, decided by the file's bytes and not its name
→
T H I N K I N G
This is the mock transport, not a model. The script inspects the working
tree so the tool path is exercised.
Reading the working tree for: look at the tree
→ ls .
· ok `.` holds 1 directory and 1 file.
src/
README.md
→ ls src
· ok `src` holds 0 directories and 1 file.
main.zig
turn 1 · in 8602 out 30 · tool_use · rcp_6aa6beb6001 · counted in path
The tools reported: . holds 1 directory and 1 file; src holds 0
directories and 1 file.
This answer came from the mock transport. No model was called and nothing
was billed.
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
turn 2 · in 8946 · out 58 · cache r0 w0
· end_turn counted in path
✓ receipt rcp_6aa6beb6002
• MOCK no network, nothing billed
· complete
2 round-trips this turn · session so far: 17k tokens (in 17k · cache r 0 w 0
· out 88 · reasoning 31); mock: nothing was billed
→
session ses_06aa6beb6063c7 · 2 rounds · 17k tokens (in 17k · cache r 0 w 0 · out 88 · reasoning 31)
resume it with prism chat --resume ses_06aa6beb6063c7 ◢◤ prismux chat claude-opus-5 • MOCK synthetic responses, no network
────────────────────────────────────────────────────────────────────
/help for commands · /quit to leave
reachable as cli_run — other sessions can /msg it
→
commands
/version show the running CLI version and platform without a model request
/upgrade [check|download|restart|cancel] download and apply a verified release at idle, preserving this session
/update [check|download|restart|auto on|off] check trusted releases, stage a verified update, or restart at the idle boundary
/source [endpoint|codex|claude|opencode] show or switch execution source; configured endpoint is retained
/reasoning [level|auto] show or set reasoning for the active source/model; /effort is an alias
/help this list
/tokens context size against the budget
/limits membership usage and reset windows for the active SDK source; no inference
/usage membership usage; alias of /limits (session accounting: /cost)
/retry re-send your last prompt now; `/retry reset` sends it when the SDK's rate-limit window resets; `/retry off` cancels
/selfprompt [idle|after|every|loop|list] schedule future prompts; inspect, pause, resume, cancel, or run a schedule
/window the context window prism plans against: `/window` shows it and its source, `/window 1m` sets it and remembers it for this model, `/window forget` drops it (`/context` shows usage)
/compact fold the history into a digest now
/reset drop the conversation, keep the session and its receipts
/clear clear the screen (the conversation stays — that is /reset)
/model [name|list] show or switch the model; `list` queries the selected source
/endpoint [url] show or switch the router this session talks to
/transcript browse retained messages; alt+v preserves the draft
/tools what this session can call, MCP included
/agents sub-agent definitions, and what children have cost
/agent [n] open one sub-agent: what it did, its tokens, its bill
/main leave a focused sub-agent and come back here
/receipts the receipt ids issued this session
/session id, turns, store path
/restart reload the installed CLI here, preserving this session and unsent input
/cost what this session has cost, and how that was derived
/perf last request timing, observed tok/s, and measurement limits
/status diagnose this session: endpoint, model, auth, MCP, receipts
/memory the project instructions loaded, and where they live
/init write a PRISMUX.md from what is on disk
/diff what this session changed on disk, read off the disk
/rewind [n] return to a prompt; add files or both to restore tracked edits
/sessions every recorded conversation, newest first
/resume [id] bring another conversation's context in here
/mode [name] show or change what may run: plan, ask, accept-edits, full-auto
/theme [name|preview|save|terminal] preview, select and save themes; opt into terminal-wide colors
/display [what] show or change tool output, thinking and performance visibility
/settings [name] every setting in force, and which layer set it
/detect [refresh|local|login|verify|models|limits] refresh discovery, sign in, verify access and fetch live models
/todos the task list the model is keeping
/tool [n] inspect a call; add page N, args, or all; alt+t opens the latest
/approve accept the plan just submitted and start work
/peers sessions and sub-agents you can message, and their addresses
/accounts the credential pool: which one is serving, which are cooling
/msg <name> <text> send one message to a session or a running sub-agent
/inbox take anything waiting for this session now
/quit leave (so do exit, and Ctrl-C at the prompt)
the : spelling works for all of them · anything else is a prompt
attachments
@path inline a file, list a directory, or attach an image
@clipboard attach the image on the clipboard (macOS)
PNG, JPEG, GIF and WebP, decided by the file's bytes and not its name
→
T H I N K I N G
This is the mock transport, not a model. The script inspects the working
tree so the tool path is exercised.
Reading the working tree for: look at the tree
→ ls .
· ok `.` holds 1 directory and 1 file.
src/
README.md
→ ls src
· ok `src` holds 0 directories and 1 file.
main.zig
turn 1 · in 8602 out 30 · tool_use · rcp_6aa6beb6001 · counted in path
The tools reported: . holds 1 directory and 1 file; src holds 0
directories and 1 file.
This answer came from the mock transport. No model was called and nothing
was billed.
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
turn 2 · in 8946 · out 58 · cache r0 w0
· end_turn counted in path
✓ receipt rcp_6aa6beb6002
• MOCK no network, nothing billed
· complete
2 round-trips this turn · session so far: 17k tokens (in 17k · cache r 0 w 0
· out 88 · reasoning 31); mock: nothing was billed
→
session ses_06aa6beb60c8bc · 2 rounds · 17k tokens (in 17k · cache r 0 w 0 · out 88 · reasoning 31)
resume it with prism chat --resume ses_06aa6beb60c8bcWhat the agent may call, and where it may reach
The agent reads and writes files, edits them, searches, lists and runs commands. Every tool declares a permission class, and the class is what a rule is written against rather than a tool name, so a policy stays true when a tool is added. Read-only observes and changes nothing. Mutating writes inside the workspace. Execute runs a program — and the registry says out loud that execute is not bounded by the path sandbox, because a shell reaches the whole filesystem and pretending otherwise would be the most dangerous sentence on this page.
tools · 19 registered
01 registry ──────────────────────────────────────────────────────────────────
◇ view_image read-only path*
view a local PNG, JPEG, GIF or WebP image
◇ read read-only path*, offset, limit
read a text file with line numbers
• write mutating path*, content*
create or overwrite a file
• edit mutating path*, old_string*, new_string*, replace_all
replace an exact, unique string in a file
◆ bash execute command*, timeout_ms, cwd
run a shell command with an explicit deadline and bounded diagnostics
◇ glob read-only pattern*, path, no_ignore
find files by path pattern
◇ grep read-only pattern*, path, glob, ignore_case, max_matches, no_…
search file contents with a regular expression
◇ ls read-only path, all
list one directory
◇ peers read-only (none)
other prism sessions running now
• msg mutating to*, text*
send one message to another session
◇ await_msg read-only timeout_s
wait, bounded, for a message from another session
◇ web_search read-only query*, limit
search the web through the operator's own instance
◇ web_fetch read-only url*
fetch a URL and read it as text
◇ todo read-only todos*
keep the task list the operator can see
◇ exit_plan read-only plan*
submit a plan for approval and stop
◆ bg_start execute command*, cwd, max_seconds
start a long-running command in the background
◇ bg_output read-only id
read new output from a background command
◆ bg_stop execute id*
kill a background command and everything it started
◇ ask_user read-only question*, option_1*, option_2*, option_3, option_4
put a short question with 2-4 options to the operator
and `task` — offered to the model as well, appended at session start when
sub-agents are enabled. Not in the static registry above because it is bound
to this session's own spawner. `--no-subagents` removes it.
02 permission classes ────────────────────────────────────────────────────────
◇ read-only observes the workspace; changes nothing on disk
• mutating writes inside the workspace; changes survive the run
◆ execute runs a program; NOT bounded by the path sandbox
03 sandbox ───────────────────────────────────────────────────────────────────
R O O T
/private/tmp/prism-agent-workspace
R E F U S E D
`..` above the root; absolute paths outside it; symlinks whose target
leaves it, at any depth; NUL bytes, control bytes and invalid UTF-8 in a
path.
• note
the execute class is NOT bounded by the sandbox: a shell reaches the whole
filesystem. tools · 19 registered
01 registry ──────────────────────────────────────────────────────────────────
◇ view_image read-only path*
view a local PNG, JPEG, GIF or WebP image
◇ read read-only path*, offset, limit
read a text file with line numbers
• write mutating path*, content*
create or overwrite a file
• edit mutating path*, old_string*, new_string*, replace_all
replace an exact, unique string in a file
◆ bash execute command*, timeout_ms, cwd
run a shell command with an explicit deadline and bounded diagnostics
◇ glob read-only pattern*, path, no_ignore
find files by path pattern
◇ grep read-only pattern*, path, glob, ignore_case, max_matches, no_…
search file contents with a regular expression
◇ ls read-only path, all
list one directory
◇ peers read-only (none)
other prism sessions running now
• msg mutating to*, text*
send one message to another session
◇ await_msg read-only timeout_s
wait, bounded, for a message from another session
◇ web_search read-only query*, limit
search the web through the operator's own instance
◇ web_fetch read-only url*
fetch a URL and read it as text
◇ todo read-only todos*
keep the task list the operator can see
◇ exit_plan read-only plan*
submit a plan for approval and stop
◆ bg_start execute command*, cwd, max_seconds
start a long-running command in the background
◇ bg_output read-only id
read new output from a background command
◆ bg_stop execute id*
kill a background command and everything it started
◇ ask_user read-only question*, option_1*, option_2*, option_3, option_4
put a short question with 2-4 options to the operator
and `task` — offered to the model as well, appended at session start when
sub-agents are enabled. Not in the static registry above because it is bound
to this session's own spawner. `--no-subagents` removes it.
02 permission classes ────────────────────────────────────────────────────────
◇ read-only observes the workspace; changes nothing on disk
• mutating writes inside the workspace; changes survive the run
◆ execute runs a program; NOT bounded by the path sandbox
03 sandbox ───────────────────────────────────────────────────────────────────
R O O T
/private/tmp/prism-agent-workspace
R E F U S E D
`..` above the root; absolute paths outside it; symlinks whose target
leaves it, at any depth; NUL bytes, control bytes and invalid UTF-8 in a
path.
• note
the execute class is NOT bounded by the sandbox: a shell reaches the whole
filesystem.Above the registry sits a permission layer that composes in a fixed order, strictest first: your deny rules, then the mode — plan, ask, accept-edits, full-auto — then your allow rules, then the mode default. An allow skips a prompt; it never lifts a deny and never lifts plan mode. Both enforcement points are on the dispatch path, so a tool that arrives from an MCP server is gated by the same decision as bash, and neither gate can disagree with the other.
A rule over a shell command is a rule over text, and a shell is a language with eval in it. So the asymmetry is deliberate and stated rather than discovered: commands are decomposed across pipes, &&, substitutions and wrappers and matched segment by segment, and anything the decomposer cannot follow is refused auto-approval and shown as NOT ANALYSED with the construct named. Denies are best-effort against an adversarial language; allows fail to ask rather than to yes. The prompt used to render an unreadable command in the same typeface as one it had fully matched, which invites a yes on a false impression.
Tools you bring yourself, over MCP
Model Context Protocol servers attach over stdio, SSE or HTTP, and their tools join the same registry under the same permission classes. A server named loopback is built in so the whole path — spawn, framing, discovery, call — can be exercised with nothing installed. It is a mock: it answers as prism-loopback-mock, every result it returns starts with [mock], and its row carries a caution chip, because a demonstration that looks like a working integration is how somebody ships one.
◢◤ prismux mcp list
config none found — the built-in loopback only
server transport status detail
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
loopback mock • mock 3 tools · prism-loopback-mock 0.…
◇ 1 of 1 servers answered ◢◤ prismux mcp list
config none found — the built-in loopback only
server transport status detail
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
loopback mock • mock 3 tools · prism-loopback-mock 0.…
◇ 1 of 1 servers answeredWhat is on the shelf, and at what price
◢◤ prismux models
20 endpoints · model x substrate x region, because that tuple is what a
provider actually is. same model, different price, terms and jurisdiction.
claude-opus-5 direct·us-east-1 ✗ retaining US ◆ full
in 5.00 out 25.00 cache 0.50 observed • 2026-08-31
claude-opus-5 bedrock·eu-central-1 ✗ retaining EU ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
claude-opus-5 vertex·europe-west4 ✗ retaining EU ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
claude-opus-5 bedrock·ap-southeast-1 ✗ retaining APAC ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
claude-sonnet-5 direct·us-east-1 ✗ retaining US ◆ full
in 2.00 out 10.00 cache 0.20 observed • 2026-08-31
claude-sonnet-5 bedrock·eu-central-1 ✗ retaining EU ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gpt-5.x direct·us ✗ retaining US · counted
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gpt-5.x azure·sweden-central ✗ retaining EU · counted
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gemini-3-pro vertex·europe-west4 ✗ retaining EU ◇ summary
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gemini-3-pro vertex·us-central1 ✗ retaining US ◇ summary
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
llama-4-405b bedrock·eu-west-1 ✗ retaining EU ✗ none
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
llama-4-405b fireworks·us-west ✗ retaining US ✗ none
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
deepseek-v4-pro direct·global ✗ retaining CN · counted
in 1.32 out 3.96 cache 0.044 observed 2026-09-02
deepseek-v4-f... direct·global ✗ retaining CN · counted
in 0.44 out 1.32 cache 0.014 observed 2026-09-02
kimi-k3 direct·global ✗ retaining CN · counted
in 3.00 out 15.00 cache 0.30 observed 2026-09-02
glm-5.3 direct·global ✗ retaining CN · counted
in 1.40 out 4.40 cache 0.26 observed 2026-09-02
local-ollama self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
local-llamacpp self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
local-lmstudio self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
local-vllm self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
L E G E N D
◆ zdr contractual zero retention; requires a DPA on file
• transient held a stated number of days for abuse review
✗ retaining may be retained or trained on; a zdr floor refuses it
◆ full the reasoning tokens themselves reach your vault
◇ summary a vendor summary only; the tokens are not obtainable
· counted billed and counted, never emitted to you
✗ none no reasoning on this endpoint
• stale past its max age; it no longer backs a margin
✗ not read no vendor page yielded a price for this endpoint
no endpoint here claims a zero-retention posture. every retention block in
router/data/rate-card.json reads `unverified`: no DPA, zero-retention
addendum or organisation setting has been read for any of them, and no such
contract exists to read, so `retaining` is the only posture any of them may
claim.
10 of 20 endpoints have no published price: a vendor page was fetched and
carried no number for them. they are shown without rates rather than with
plausible ones, and nothing can be priced against them.
2 of the 10 cards that do carry a price are past their max age of 7 days. a
card past its age no longer backs a margin: it is a number we would have to
re-read before quoting it.
these ages are measured against 2026-09-08, pinned by PRISM_TODAY, and not
against today. this is a reading of a fixture catalogue at a fixed date
rather than of live prices.
catalogue built into this binary, snapshot 2026-09-04, mirroring
router/data/rate-card.json. no network call was made.
--stale for the cautioned cards only, --json for the whole registry as
machine data.
this list is also our subprocessor list: the endpoints traffic can reach and
the parties named under GDPR Art. 28 are the same set, by construction. ◢◤ prismux models
20 endpoints · model x substrate x region, because that tuple is what a
provider actually is. same model, different price, terms and jurisdiction.
claude-opus-5 direct·us-east-1 ✗ retaining US ◆ full
in 5.00 out 25.00 cache 0.50 observed • 2026-08-31
claude-opus-5 bedrock·eu-central-1 ✗ retaining EU ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
claude-opus-5 vertex·europe-west4 ✗ retaining EU ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
claude-opus-5 bedrock·ap-southeast-1 ✗ retaining APAC ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
claude-sonnet-5 direct·us-east-1 ✗ retaining US ◆ full
in 2.00 out 10.00 cache 0.20 observed • 2026-08-31
claude-sonnet-5 bedrock·eu-central-1 ✗ retaining EU ◆ full
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gpt-5.x direct·us ✗ retaining US · counted
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gpt-5.x azure·sweden-central ✗ retaining EU · counted
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gemini-3-pro vertex·europe-west4 ✗ retaining EU ◇ summary
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
gemini-3-pro vertex·us-central1 ✗ retaining US ◇ summary
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
llama-4-405b bedrock·eu-west-1 ✗ retaining EU ✗ none
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
llama-4-405b fireworks·us-west ✗ retaining US ✗ none
no published price was read for this endpoint. the bundle names it in
`unpriced`, with the vendor URL that failed to yield a number.
deepseek-v4-pro direct·global ✗ retaining CN · counted
in 1.32 out 3.96 cache 0.044 observed 2026-09-02
deepseek-v4-f... direct·global ✗ retaining CN · counted
in 0.44 out 1.32 cache 0.014 observed 2026-09-02
kimi-k3 direct·global ✗ retaining CN · counted
in 3.00 out 15.00 cache 0.30 observed 2026-09-02
glm-5.3 direct·global ✗ retaining CN · counted
in 1.40 out 4.40 cache 0.26 observed 2026-09-02
local-ollama self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
local-llamacpp self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
local-lmstudio self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
local-vllm self-hosted·on-prem ✗ retaining LOCAL ✗ none
in 0.00 out 0.00 cache 0.00 observed 2026-09-04
L E G E N D
◆ zdr contractual zero retention; requires a DPA on file
• transient held a stated number of days for abuse review
✗ retaining may be retained or trained on; a zdr floor refuses it
◆ full the reasoning tokens themselves reach your vault
◇ summary a vendor summary only; the tokens are not obtainable
· counted billed and counted, never emitted to you
✗ none no reasoning on this endpoint
• stale past its max age; it no longer backs a margin
✗ not read no vendor page yielded a price for this endpoint
no endpoint here claims a zero-retention posture. every retention block in
router/data/rate-card.json reads `unverified`: no DPA, zero-retention
addendum or organisation setting has been read for any of them, and no such
contract exists to read, so `retaining` is the only posture any of them may
claim.
10 of 20 endpoints have no published price: a vendor page was fetched and
carried no number for them. they are shown without rates rather than with
plausible ones, and nothing can be priced against them.
2 of the 10 cards that do carry a price are past their max age of 7 days. a
card past its age no longer backs a margin: it is a number we would have to
re-read before quoting it.
these ages are measured against 2026-09-08, pinned by PRISM_TODAY, and not
against today. this is a reading of a fixture catalogue at a fixed date
rather than of live prices.
catalogue built into this binary, snapshot 2026-09-04, mirroring
router/data/rate-card.json. no network call was made.
--stale for the cautioned cards only, --json for the whole registry as
machine data.
this list is also our subprocessor list: the endpoints traffic can reach and
the parties named under GDPR Art. 28 are the same set, by construction.