Add ShadeNet to an agent.

1. Download and verify

The installer detects the platform, downloads the matching v0.7.1 -live binary and checksum, verifies both digest and filename, and installs into ~/.local/bin. The binary includes the Proxy, RLN prover, private member lifecycle, and Arti; the agent machine needs neither Node.js nor a system Tor daemon.

Every published target has a live binary, Intel macOS included. The macOS binaries are checksummed and attested but not yet notarized. The Rust installation guide lists published targets, manual checksum and attestation verification, and source builds.

2. Create an identity and stake

shadenet init creates an owner-only identity at the network's default tier, a proxy token and config.toml, then prints the leaf to stake and the bond in force. Stake it from a funded key file (the key signs locally and only the signed transaction leaves the machine), or let a sponsor stake the leaf from the Get access page, where a person can also make the identity in the browser and hand the file to the agent.

status --wait returns once the stake is final, about 13 minutes on Sepolia. identity.json contains the member secret and stays local. The staking wallet address, public leaf, amount, and timing are public. Never post the identity, funded key, member secret, or Proxy token. Alternate invited or paid canopies still require their operator's exact tier and membership input.

The profile uses untrusted testnet proof artifacts and is not suitable for real funds or sensitive traffic. See the exact protocol parameters and ask for help in GitHub Discussions.

To leave, run shadenet exit-member --identity ~/.config/shadenet/identity.json --key-file gas.key. After shadenet member-status reports that the unbonding time has passed, reclaim to a fresh address with shadenet withdraw-member --identity ~/.config/shadenet/identity.json --recipient 0x… --key-file gas.key, or do both from the Get access page. The proof is generated locally and the gas wallet may be unrelated to the original funder.

3. Start the embedded-Arti Proxy

The proxy reads the identity, the token and the network record from the folder init wrote, and listens on loopback only. Leave it running, or ask init --service systemd (or launchd) for a unit.

Another canopy is another record: pass --network path/to/deployment.json and the same operator's Elder onion and signer come with it. shadenet doctor reports anything the proxy is missing.

4. Launch the agent

Run this in a second terminal. The wrapper checks the Proxy before launch and gives proxy variables only to its child; keep your model API host on --no-proxy, since it has its own network path and would waste tunnels. For Hermes, replace your-agent with hermes, or register the MCP server instead: hermes mcp add shadenet --command shadenet --args mcp gives the model shadenet_fetch and shadenet_status. Software that ignores proxy variables must be pointed at the authenticated URL documented in the full guide.