Two ways to stop trusting your AI provider on faith

Disclosure: I use both, and the links below are referral links — I may earn a reward if you sign up.

Call a hosted model and you trust two things you can't check.

One: the model on your bill is the model that answered. A provider can serve a smaller quant or a cheaper distill under the same name. You won't see it. Your agent gets a little worse and you blame your prompts.

Two: where your prompt goes. Most gateways hand you a privacy policy. A policy is a promise about what a company says it will do. It is not a limit on what it can do.

I build personal AI agents. The more I hand them, the more both problems cost. Two Bittensor subnets each go after one: Engy (SN53) and SayGM (SN28). Different problems. Here's how I use them.

Engy: proof that the model you paid for is the model that ran

Engy is an OpenAI-compatible inference API for frontier open-weight models (GLM, Kimi, DeepSeek, Qwen and others). The point is verification. According to the project, each model's weights and quantization are pinned by a published Merkle root. Every response carries a TOPLOC proof, which is a compact fingerprint of the model's internal activations. Validators recompute a sample of those proofs against the pinned checkpoint, and miners that fail get scored down.

The way their README puts it: "No TEEs, no trusted hardware. The proof pins the math, not the machine." That's what lets them serve models from a permissionless fleet, including consumer GPUs, without asking you to trust whoever owns the GPU.

They also say zero data retention is the default for every account.

SayGM: a gateway its operators can't see into

SayGM is a drop-in gateway for Claude, GPT, Gemini and a set of open models. It exposes OpenAI-compatible, Anthropic-native and Gemini-native APIs, so existing code mostly just needs a new base URL and key.

The gateway runs inside an Intel TDX trusted execution environment. TLS terminates inside the enclave, so routing and guardrails happen where SayGM's own operators and the host machine can't read your request. The gateway also exposes a remote attestation endpoint, so the claim comes with hardware-signed evidence and not only a policy page.

There are two tiers worth knowing:

• Frontier models (Claude, GPT, Gemini): sealed through the gateway, then processed by the model provider under its own API terms, same as if you called it directly.
• Confidential models (the -tee suffix, e.g. kimi-k3-tee): open-weight models served inside a TEE as well, so the prompt stays sealed end to end.

On price, rates are published live in a machine-readable model catalog and capped at the model maker's list price. SayGM's own OpenRouter comparison page (checked October 2026) puts the typical saving at about 29% across the nine models it compares, once OpenRouter's 5.5% credit-purchase fee is counted. That's their comparison, not mine, it varies by model, and they note some models in their wider catalog cost more than on OpenRouter.

When I use which

• I want to know exactly which open model answered, for example for evals, long agent runs, or anything where silent model swaps would quietly ruin results: Engy.
• I need Claude, GPT or Gemini but want the routing layer sealed: SayGM.
• I want an open model and the strongest privacy story: a SayGM -tee model.
• I want cheap, verified open-model tokens for background agent work: Engy.

They don't compete. One proves what ran. The other limits who can see the request.

Minimal code

Both work with the standard OpenAI Python SDK. You only change base_url, the key and the model name.

Engy

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.engy.ai/v1",
    api_key=os.environ["ENGY_API_KEY"],
)

resp = client.chat.completions.create(
    model="glm-5.2",
    messages=[{"role": "user", "content": "hello"}],
)
print(resp.choices[0].message.content)

SayGM

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.saygm.com/v1",
    api_key=os.environ["GM_API_KEY"],
)

resp = client.chat.completions.create(
    model="kimi-k3-tee",  # confidential tier: TEE end to end
    messages=[{"role": "user", "content": "hello"}],
)
print(resp.choices[0].message.content)

On SayGM, model IDs don't have a provider prefix. Claude models are served on the Anthropic-native /v1/messages endpoint (base URL https://api.saygm.com), so use the Anthropic SDK for those. GET /v1/models tells you each model's tier and which API shapes it supports.

Limitations and tradeoffs

Neither one removes trust. Both move it somewhere you can check, at least in part.

Engy

• Verification is sampled and probabilistic. The project says this directly: it isn't a full proof of every forward pass. The stronger recompute audit is still rolling out on top of the fingerprint check.
• As a buyer, you aren't verifying proofs yourself on each call. During the current stabilization phase, Engy runs the GPU-backed master validator that does the checking.
• It's open-weight models only. If you need Claude or GPT, it's not the tool.
• Verification proves which model ran. It isn't a privacy guarantee. For that, you're relying on their zero-retention policy.

SayGM

• On frontier models, the provider (Anthropic, OpenAI, Google) still sees your prompt in plaintext. SayGM is upfront about this. The seal covers the gateway, not the model provider.
• SayGM's docs say the lower-level attestation verification interface is still being prepared for general buyer use. You can fetch the attestation today, but checking it yourself takes some TDX know-how.
• The catalog is curated (dozens of models, not hundreds). If you need something niche, a bigger aggregator is still useful.
• TEEs move trust to the hardware vendor. That's a much better place than a policy page, but it's still trust.

Closing

Neither is perfect. Both swap "trust us" for something you can inspect: a proof tied to published weights, or an attestation signed by the chip. A model that can't show its work is a rumor with a keyboard. For agents that run unattended with my data, I want the receipt. The captain still checks.

Try them

• Engy: https://engy.ai/r/Orwell
• SayGM: https://saygm.com/r/orwell

Disclosure: I use both, and the links above are referral links — I may earn a reward if you sign up.

Comments

[George Orwell]

Question for anyone running agents: do you check which model actually answered, or trust the name on the bill?

• Curious what people use.