MN Uncensored

Public repository · ABLITERATED.cloud website · Model field notes · Latest deployed release: v0.3.1 · Release notes · Security · Apache-2.0

MN Uncensored is a small control plane and authenticated, OpenAI-compatible API backed by a four-model pinned Hugging Face source catalog. The current source prepares exact Hugging Face repository IDs as the public API model IDs and descriptive Modal application names. It does not deploy or start those applications. The 397B profile remains deliberately disabled with deployment_enabled=false. The model servers are designed to run with vLLM on scale-to-zero Modal GPUs. Hermes, Pi, OpenCode, scripts, and other compatible clients use one base URL and select an exact model ID.

The source repository is public. The deployed API is not anonymous: every model request, model listing, lifecycle status request, and wake request requires a valid sk-mn-* Bearer token.

Current boundary: this is a private evaluation service for the owner and invited testers. It is not yet a complete multi-tenant resale platform.

Cost-safety default: all model routes are currently hard-stopped. Use mn start MODEL for one safe session and mn stop MODEL immediately after use. A normal start can no longer keep a warm GPU indefinitely. Read the 2026-07-16 cost incident report. The safety changes are on main but will not be deployed to Modal until a Workspace hard budget is confirmed. Do not restart a model before that.

Website status: abliterated.cloud is the configured GitHub Pages custom domain. Porkbun DNS points the apex and www hostname to GitHub's official Pages targets. website-worker.mjs remains a prepared optional edge layer for behavior static Pages cannot provide, including HTTP content negotiation, custom discovery headers and a live MCP endpoint. The local application-controlled Agent-Ready gate passes; do not claim a public 100% result until the public hostname is measured after TLS provisioning. See website/README.md.

What runs where
Website and agent readiness
Current model catalog
Architecture
How a request starts and stops a model
Why Modal and vLLM were selected
Provider and product comparison
Prices and billing
Capacity and multiple users
Install and operate the current deployment
API and client configuration
Tokens and security
Cloud storage and local downloads
Deploying a separate copy
Troubleshooting
Cost incident: what actually happened
Release process and release history
Path from private API to resale platform
Model and license caveats

What runs where

The stack consists of separate layers. “Hugging Face”, “vLLM”, and “Modal” are not interchangeable:

Layer	Responsibility
Hugging Face	Stores the model repositories and exact pinned weight revisions
Modal	Rents the GPUs, runs containers, stores secrets and volumes, bills compute, and scales containers to zero
vLLM	Loads one model on a Modal GPU and exposes its OpenAI-compatible inference server
MN gateway	Validates Bearer tokens, resolves model IDs, enforces limits, controls lifecycle state, waits through cold starts, and presents one shared API URL
`mn` CLI	Provides start, stop, automatic mode, token management, status, and agent launch commands
Hermes, Pi, OpenCode, Cursor, scripts	Consume the API as clients

vLLM is therefore the inference engine, not the hosting provider. The selected hosting combination is Modal + vLLM, with model artifacts sourced from Hugging Face.

Website and agent readiness

The website has one active delivery target and one prepared optional edge target:

GitHub Pages publishes the dependency-free production site at https://abliterated.cloud/.
Cloudflare Workers can serve the same files through website-worker.mjs in a future migration if dynamic edge behavior is required.
The public blog contains a source-linked HTML and Markdown field note for each exact catalog artifact. It keeps publisher measurements separate from upstream benchmarks and identifies only publicly verifiable publishers or teams.

Local verification:

npm install
npm run dev:website
npm run verify:agent-ready:local

The public target is https://abliterated.cloud. The custom-domain and DNS cutover were completed on 2026-07-18. Public Agent-Ready and PageSpeed results must still be measured against the final HTTPS hostname after GitHub finishes certificate provisioning; the deployment state is documented in website/README.md.

Current model catalog

All four model artifacts and revisions are pinned in config/mn.json and documented in docs/MODELS.md. The first three profiles are enabled in the prepared catalog; Ornith 397B is retained but explicitly disabled. Catalog presence and deployment_enabled=true are configuration, not evidence of a deployment or authorization to start a GPU. Model names such as “abliterated” describe the upstream artifact; they are not a guarantee of zero refusals.

CLI key	Exact API and Hugging Face ID	Prepared Modal app	Pinned revision	GPU	MN context	Maximum output	Modal base GPU price	Source policy
`qwen36`	`huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated`	`huihui-qwen3-6-35b-a3b-abliterated`	`8f0ee727aff5e771ea72466d64d13ecd851d2cc7`	1 × H200	131,072	16,384	$4.5396/hour	Prepared; enabled
`ornith35`	`YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated`	`yuyu1015-ornith-1-0-35b-abliterated`	`86065d1a9008773086a177637d54ec6dc2a56cbf`	1 × H200	131,072	16,384	$4.5396/hour	Prepared; enabled
`qwythos9`	`huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated`	`huihui-qwythos-9b-claude-mythos-5-1m-abliterated`	`efcc73cac15ff8fc5d46b8d41b53c22d571cf97d`	1 × L40S	131,072	16,384	$1.9512/hour	Prepared; enabled
`ornith397`	`cebeuq/Ornith-1.0-397B-abliterated-W4A16`	`cebeuq-ornith-1-0-397b-abliterated-w4a16`	`e5651d291be1c65ff1360eee47ab533ab13b3d97`	2 × H200	32,768	8,192	$9.0792/hour	Prepared; `deployment_enabled=false`

The compatibility aliases mn/god, mn/code, mn/fast, mn/ornith-397b, and nuri/ornith-397b-abliterated remain accepted for old clients. They are not the primary names and must not be shown as model identities in new integrations.

The full 40-character pins, attribution chain, runtime substitutions, and license caveats are documented in docs/MODELS.md.

Current verified deployment state

Checked on 2026-07-16:

the public gateway health endpoint returned {"status":"ok"};
all three deployed model lifecycle records were hard-stopped;
the three legacy-named Modal model applications each reported zero running tasks;
no API request can wake a hard-stopped model;
release v0.3.1 had previously passed one streaming completion and one forced tool call on every route.

The gateway itself may briefly keep a small CPU container after a health or API request. That is separate from the H200/L40S model containers.

The latest deployed runtime remains v0.3.1. The five-minute safety release is intentionally pending until the Modal Workspace hard budget is set.

That deployed release predates the new 397B source record. Its historical legacy-alias behavior must not be treated as a live 397B route. The prepared source keeps the exact 397B identity and aliases but blocks deployment with deployment_enabled=false. No deployment is being performed by this documentation change.

Why the 397B model is prepared but not live yet

The original target was cebeuq/Ornith-1.0-397B-abliterated-W4A16, pinned at e5651d291be1c65ff1360eee47ab533ab13b3d97. It is retained under cebeuq/Ornith-1.0-397B-abliterated-W4A16, with the reserved legacy alias nuri/ornith-397b-abliterated, because it remains an interesting future large-model option. It is a poor unbudgeted first product:

it requires much more GPU memory and likely multiple expensive GPUs;
cold starts and weight loading become substantially longer;
one personal request can create a large minimum activation bill;
the first platform version needs reliable routing, tokens, lifecycle control, client compatibility, and cost visibility more than maximum parameter count.

The first practical deployment was therefore changed to two 35B-class routes and one 9B route. This allows the full system to be tested without making every experiment a multi-GPU event.

The upstream model card describes roughly 196 GB of W4A16 weights, native 262,144-token context, multimodal support, vLLM 0.17 or newer, and qwen3_coder tool parsing in its tested DGX Spark example. MN does not claim those native limits or copy that serving configuration directly. The retained profile is deliberately conservative at 32,768 context and 8,192 output, uses the pinned template's qwen3_xml function/parameter format, keeps multimodal loading, disables thinking by default, and leaves prefix caching off until the exact two-H200 runtime is revalidated.

There is no current live cebeuq/Ornith-1.0-397B-abliterated-W4A16 gateway route, and the deployed v0.3.1 /v1/models response does not advertise it. The prepared catalog record has deployment_enabled=false. A future signed, budget-approved change must enable it before any release can deploy it, and lifecycle operations would still require --allow-expensive. Preparing the route in Git does not download, deploy, wake, or bill the model.

Architecture

flowchart LR
    subgraph Clients["Desktop, CLI, and server-side clients"]
        Hermes["Hermes Agent"]
        Pi["Pi"]
        OpenCode["OpenCode"]
        Cursor["Cursor custom OpenAI route"]
        App["OpenAI SDK or other app"]
    end

    Keychain["macOS Keychain<br/>owner token"]
    Gateway["Public-address Modal CPU gateway<br/>abliterated-cloud-api<br/>0-2 containers"]
    State[("Modal Dict<br/>token digests and per-model lifecycle state")]
    ProxySecret["Modal Secret<br/>private backend proxy credentials"]

    God["Prepared app<br/>huihui-qwen3-6-35b-a3b-abliterated<br/>1 x H200"]
    Code["Prepared app<br/>yuyu1015-ornith-1-0-35b-abliterated<br/>1 x H200"]
    Fast["Prepared app<br/>huihui-qwythos-9b-claude-mythos-5-1m-abliterated<br/>1 x L40S"]
    Ornith["Disabled prepared app<br/>cebeuq-ornith-1-0-397b-abliterated-w4a16<br/>2 x H200"]

    HF["Pinned Hugging Face revisions"]
    HFCache[("hf-model-cache")]
    VLLMCache[("vllm-compile-cache")]
    KernelCache[("flashinfer-kernel-cache")]

    Keychain --> Hermes
    Keychain --> Pi
    Keychain --> OpenCode

    Hermes -->|"Bearer sk-mn-*"| Gateway
    Pi -->|"Bearer sk-mn-*"| Gateway
    OpenCode -->|"Bearer sk-mn-*"| Gateway
    Cursor -->|"Bearer sk-mn-*"| Gateway
    App -->|"Bearer sk-mn-*"| Gateway

    Gateway <-->|"digest lookup and desired state"| State
    ProxySecret -->|"Modal-Key and Modal-Secret"| Gateway

    Gateway -->|"private authenticated route"| God
    Gateway -->|"private authenticated route"| Code
    Gateway -->|"private authenticated route"| Fast
    Ornith -.->|"future signed enablement required"| Gateway

    HF --> HFCache
    HFCache --- God
    HFCache --- Code
    HFCache --- Fast
    VLLMCache --- God
    VLLMCache --- Code
    VLLMCache --- Fast
    KernelCache --- God
    KernelCache --- Code
    KernelCache --- Fast

The gateway URL is public because clients must be able to reach it. The GPU backend URLs are also not treated as secrets, but Modal rejects requests that do not contain the separate private proxy credential pair.

The dashed 397B route is prepared in source but disabled. It cannot enter a catalog release until a signed budget-approved change flips its source policy; an explicit expensive-model acknowledgement remains a second gate.

How a request starts and stops a model

Each model has an independent lifecycle. Calling huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated does not start YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated, huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated, or the future cebeuq/Ornith-1.0-397B-abliterated-W4A16 route.

sequenceDiagram
    participant Client
    participant Gateway as MN gateway
    participant State as Modal Dict
    participant Modal as Modal autoscaler
    participant vLLM as Selected vLLM backend

    Client->>Gateway: POST /v1/chat/completions plus Bearer token
    Gateway->>State: Hash token and load metadata
    State-->>Gateway: Active or invalid

    alt Missing, invalid, or revoked token
        Gateway-->>Client: 401 OpenAI-style error
    else Valid token
        Gateway->>Gateway: Resolve allowlisted model and validate limits
        Gateway->>State: Read selected model lifecycle

        alt Lifecycle is stopped or stopping
            Gateway-->>Client: 503 model_stopped
        else Lifecycle is auto or a legacy active state
            Gateway->>Modal: Forward original request

            alt Backend is already warm
                Modal->>vLLM: Forward request
                vLLM-->>Gateway: Stream completion
                Gateway-->>Client: Stream completion
            else Empty Modal 503 signals scale-from-zero
                Modal-->>Gateway: 503 with empty body
                Modal->>vLLM: Start GPU container
                loop Health polling for at most 30 minutes
                    Gateway->>Modal: GET /health
                    Note over Gateway: Backoff 30, 60, 120, 240,<br/>then at most 300 seconds
                    Modal-->>Gateway: Not ready or HTTP 200
                end
                Gateway->>vLLM: Replay original request once
                vLLM-->>Gateway: Stream completion
                Gateway-->>Client: Stream completion
            else Backend returns 503 with a body
                Gateway-->>Client: Pass application error through
            end
        end
    end

    Note over Modal,vLLM: In auto mode the GPU scales to zero<br/>300 idle seconds after the final backend request

Lifecycle modes

stateDiagram-v2
    [*] --> Stopped
    Stopped --> AutoZero: mn auto model
    Stopped --> ColdStarting: mn start model
    AutoZero --> ColdStarting: inference request or mn wake
    ColdStarting --> Serving: health check becomes ready
    Serving --> AutoZero: 300 idle seconds
    AutoZero --> Stopped: mn stop model
    ColdStarting --> Stopped: mn stop model
    Serving --> Stopped: mn stop model

The operational modes are:

Mode	Command	Behavior
Safe start	`mn start ornith35`	Arms `YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated`, wakes it once, and scales to zero after five idle minutes
Automatic	`mn auto ornith35`	Arms `YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated` without immediately starting a GPU; the next inference request wakes it
Hard-stopped	`mn stop ornith35`	Route fails closed; an API request cannot wake it

mn stop without a model hard-stops the full catalog. mn start, mn auto, and mn wake require an explicit model so an accidental command cannot arm or start the whole catalog. The 397B model additionally requires --allow-expensive.

Five idle minutes is not a five-minute maximum charge. Startup, weight loading, kernel compilation, queued work, an active generation, an open stream, health checks, and new client requests are activity. The idle countdown begins only after that activity ends. The Modal Workspace hard budget remains the real outer spending limit.

Why Modal and vLLM were selected

The goal was not merely to call somebody else’s API. The goal was to own:

the exact Hugging Face artifacts and revisions;
the public model names;
the OpenAI-compatible base URL;
token issuance and revocation;
cold-start and shutdown behavior;
the serving configuration and context limits;
the path toward later metering and resale.

Modal was selected as the initial GPU host because it provides per-second resource billing, programmable scale-to-zero, persistent volumes, secrets, and Python-controlled deployment. vLLM was selected because it is an efficient open inference server with an OpenAI-compatible interface and tool-calling support.

MN adds the product-facing layer that neither component provides by itself: one branded catalog, friend tokens, strict routing, lifecycle controls, cold-start waiting, and client launchers.

The practical conclusion from the provider discussion

Cheapest for occasional personal calls: a token-priced service such as Featherless can be cheaper when it already serves the desired model.
Best for the exact owned service: Modal + vLLM gives control over revisions, context, parsers, caches, model names, and authentication. The source prepares three enabled profiles and keeps the fourth disabled behind both policy and cost acknowledgement gates.
Best future Bitcoin payment layer: Routstr could sit in front of MN, but it does not replace the GPU host.
Best UX inspiration: Ollama’s launch experience is excellent, which is why mn launch configures coding tools automatically.

Provider and product comparison

Prices and product facts in this section were checked on 2026-07-16. Provider prices and terms can change; follow the linked primary source before making a purchasing or resale decision.

Option	What it actually provides	Exact arbitrary HF pin	Scale to zero	Billing style	Fit for MN
Modal + vLLM	Programmable GPU hosting plus our own inference server	Yes	Yes, configured here at 5 idle minutes	Resource-seconds	Selected foundation
Hugging Face Inference Endpoints	Managed dedicated endpoint with selectable engines and hardware	Yes	Yes	Instance-minutes	Simpler alternative, less custom control
Featherless	Large shared catalog through one hosted API	Only when cataloged	Provider-managed	Subscription or tokens	Cheapest light testing for supported models
OpenRouter	Router across many existing providers	No arbitrary deployment	Provider-dependent	Tokens plus platform fee	Excellent model evaluation and fallback
Venice	Finished privacy/uncensored-oriented hosted API	No arbitrary deployment	Provider-managed	Tokens or plan credits	Competitor and price benchmark
Ollama local/cloud	Local runtime and curated cloud access with strong CLI UX	Local imports vary; cloud cataloged	Local lifecycle or provider-managed	Own hardware or subscription	UX inspiration, not our cloud host
Routstr	OpenAI proxy with Cashu/Lightning balances and reseller markup	Uses an upstream	Not a GPU host	Per request/token in sats	Potential future payment layer
LNVPS	Bitcoin/Lightning-paid CPU VPS	Files can be hosted, but no listed GPU	No serverless GPU	Monthly VPS	Possible cheap control plane, not model inference

Modal

Modal’s pricing page lists H200 at $0.001261/second and L40S at $0.000542/second. The Starter plan currently includes $30/month of compute credit. Modal provides the GPUs, containers, secrets, and volumes; this repository provides vLLM and the gateway.

This is the best fit when exact model control matters more than eliminating all infrastructure work.

Hugging Face Inference Endpoints

Hugging Face endpoint pricing currently lists AWS H200 at $5.00/hour and AWS L40S at $1.80/hour, billed by the minute while initializing and running.

Hugging Face supports vLLM and scale-to-zero. Its autoscaling documentation warns that a scaled-to-zero endpoint returns 502 Bad Gateway while starting and currently has no request queue. A client or gateway must therefore handle the cold start. MN already implements that control path for Modal.

HF Endpoints are a strong alternative when a managed UI and conventional dedicated endpoint are more important than a custom control plane.

Featherless

Featherless plans currently start at $25/month; business request pricing starts with prepaid credits and charges successful requests by token according to the request-pricing documentation.

At the time of review:

Artifact	Featherless status	Advertised context	Input / 1M	Output / 1M
`huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated`	Available	32,768	$1.06	$2.60
`huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated`	Available	32,768	$0.431	$1.12
`YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated`	Not found in catalog	—	—	—

Official live records: Qwen3.6 35B · Qwythos 9B

Featherless is likely cheaper for light personal use of the two supported artifacts. It is not currently a complete replacement for MN because the exact Ornith route was unavailable, the reviewed context was 32K rather than the configured MN 131K, and MN would lose control over the serving revision, runtime configuration, lifecycle, and backend.

Do not place a paid resale gateway in front of a consumer plan without confirming that the provider contract explicitly permits it.

OpenRouter

OpenRouter pricing currently describes a pay-as-you-go router across hundreds of models and providers with a 5.5% platform fee. It is excellent for testing many existing APIs and receiving provider fallbacks.

It does not deploy the arbitrary pinned Hugging Face repositories in this catalog, so using OpenRouter would make MN a reseller of somebody else’s model selection rather than the operator of its own inference backend.

Venice

Venice’s API pricing provides a useful benchmark for finished privacy- and uncensored-oriented APIs. Venice is already a hosted service with token pricing and an OpenAI-compatible interface. It is a product competitor and possible upstream, not the host for these exact pinned artifacts.

Ollama

Ollama pricing currently lists Free, Pro at $20/month, and Max at $100/month. Ollama is excellent for running models on owned hardware and for configuring development tools. Its cloud service uses a provider-managed catalog and usage allowances.

MN deliberately does not download these 35B models to the Mac. The useful idea taken from Ollama is the launch experience:

mn start qwythos9
mn launch --model qwythos9 pi
mn stop qwythos9

Routstr

Routstr is not a GPU host. It is an OpenAI-compatible proxy and payment system designed for operators who want to resell upstream inference or monetize hardware with Cashu/Lightning.

Its pricing engine supports upstream cost pass-through, an exchange-rate buffer, operator margin, per-model overrides, minimum charges, and verifiable cost headers.

A later architecture could be:

flowchart LR
    Client["Customer or coding agent"]
    Routstr["Routstr<br/>balance, Cashu, Lightning, markup"]
    Gateway["MN gateway<br/>auth, catalog, lifecycle"]
    Modal["Modal GPU"]
    vLLM["vLLM"]
    HF["Pinned Hugging Face weights"]

    Client --> Routstr
    Routstr --> Gateway
    Gateway --> Modal
    Modal --> vLLM
    HF --> vLLM

Routstr would add customer balances and payment, while Modal would still host vLLM. Its database, wallet backups, accounting, security, and GPL-3.0 license implications require review before integration.

LNVPS

LNVPS currently advertises a 4-vCPU, 4-GB RAM, 160-GB SSD VPS for €13.80/month, paid through Bitcoin Lightning. No GPU product is listed.

That VPS cannot run the current 9B/35B GPU models. It could later host an always-on website, reverse proxy, Routstr node, or other lightweight control plane while Modal supplies the GPUs.

Prices and billing

Modal base GPU prices

These calculations use the official Modal rates checked on 2026-07-16. They exclude CPU, memory, storage beyond included allowance, network, taxes, and future price changes.

Route or ceiling	GPU	Per second	Per minute	Per hour	Five-minute idle tail	Status
`huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated`	1 × H200	$0.001261	$0.07566	$4.5396	$0.3783	Prepared; enabled
`YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated`	1 × H200	$0.001261	$0.07566	$4.5396	$0.3783	Prepared; enabled
`huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated`	1 × L40S	$0.000542	$0.03252	$1.9512	$0.1626	Prepared; enabled
Three enabled profiles	—	$0.003064	$0.18384	$11.0304	$0.9192	Hypothetical simultaneous ceiling
`cebeuq/Ornith-1.0-397B-abliterated-W4A16`	2 × H200	$0.002522	$0.15132	$9.0792	$0.7566	Prepared; `deployment_enabled=false`
Four-model ceiling	4 × H200 + 1 × L40S	$0.005586	$0.33516	$20.1096	$1.6758	Hypothetical only

The rough GPU formula is:

estimated GPU cost =
  (startup seconds + inference seconds + billable idle seconds)
  × GPU price per second

Examples:

Example	Approximate base GPU cost
One H200 model active for 1 minute	$0.07566
One H200 five-minute idle tail	$0.3783
`huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated` five-minute idle tail	$0.1626
Dormant `cebeuq/Ornith-1.0-397B-abliterated-W4A16` five-minute tail if later deployed	$0.7566
Three enabled profiles' five-minute idle tails	$0.9192
Potential all-four five-minute idle tails	$1.6758
Three enabled profiles active continuously for one hour	$11.0304
Potential all four active continuously for one hour	$20.1096
Potential all four active continuously for 730 hours	$14,680.01

The five-minute column is not a fixed request price. It illustrates only the final idle tail after the last backend activity. A real activation also includes startup, compilation, queued work, and generation time. The 397B and four-model rows are hypothetical risk ceilings, not current usage or evidence of deployment.

Modal currently lists $30/month of Starter compute credit. Ignoring all other resources, that is approximately:

6.61 H200 GPU-hours; or
15.38 L40S GPU-hours.

See Modal pricing and Modal billing for current rates and billable-resource definitions.

Does the price increase when more people use it?

Not automatically per person. Modal charges the resources that are running, not a separate seat fee for every API token.

If one H200 container is already active, two people sharing it do not create two H200 bills because this deployment caps that backend at one container. However, additional users can:

keep the GPU running longer;
continually reset the five-minute idle timer;
cause requests to queue;
increase latency;
wake different catalog models at the same time.

The practical cost is therefore driven by active GPU time, not merely user count. A busy group can turn an occasional serverless endpoint into an effectively always-on GPU.

Capacity and multiple users

Each deployed model backend currently has:

max_containers=1;
one configured GPU;
max_num_seqs=1;
a 16,384-token output ceiling.

flowchart TB
    Users["Many authenticated users"]
    Gateway["Gateway<br/>up to 2 CPU containers<br/>concurrent HTTP inputs"]

    subgraph Backends["Independent backend ceilings"]
        God["huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated<br/>max 1 H200 container<br/>1 generation sequence"]
        Code["YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated<br/>max 1 H200 container<br/>1 generation sequence"]
        Fast["huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated<br/>max 1 L40S container<br/>1 generation sequence"]
    end

    Users --> Gateway
    Gateway --> God
    Gateway --> Code
    Gateway --> Fast

Multiple clients may connect, but generations sent to the same model may serialize or queue. Different models can run simultaneously. This is suitable for controlled testing, not a high-throughput public service.

The prepared cebeuq/Ornith-1.0-397B-abliterated-W4A16 profile requires one container with two H200s and an 8,192-token output ceiling. It remains excluded from deployment by deployment_enabled=false and would additionally require an explicitly acknowledged lifecycle command after any future enablement.

Before public multi-user access, measure:

time to first token and tokens per second;
queue time at realistic prompt sizes;
memory behavior at long context;
tool-call reliability;
failure recovery;
cost per successful request;
per-token and per-customer fairness.

Install and operate the current deployment

These commands operate the already configured MN deployment from this repository on the owner’s Mac.

Install the CLI

./scripts/install-macos.sh

The script runs uv sync and symlinks the mn command into ~/.local/bin/mn.

Show the menu

mn

The menu provides start, auto, stop, status, agent launch, token, and API actions.

Safest default

mn stop
mn status

This leaves every route fail-closed. No client can wake a GPU.

One safe session

Start with the inexpensive route:

mn start qwythos9

Use the API or an agent, then stop it explicitly:

mn stop qwythos9

mn start qwythos9 first enforces min_containers=0, wakes the route, and leaves it with a five-minute idle shutdown. The explicit stop is still recommended; it closes the route immediately instead of waiting for the idle timer.

Operate individual models

mn status ornith35
mn wake ornith35
mn start ornith35
mn auto ornith35
mn stop ornith35

Operate all models

mn status
mn stop

To arm several models, name them separately:

mn auto qwen36
mn auto ornith35
mn auto qwythos9

Command reference

Command	Result
`mn`	Interactive menu
`mn status [model]`	Show desired lifecycle, GPU ceiling, context, and API URL
`mn api [model]`	Print API base URL and model IDs
`mn auto MODEL`	Arm one route for request-triggered start and five-minute idle shutdown
`mn wake MODEL`	Explicitly wait until one automatic route is ready
`mn start MODEL`	Safely arm and wake one model; never keep `min_containers=1`
`--allow-expensive`	Required with 397B start, auto, wake, or launch operations
`mn stop [model]`	Hard-stop one model; without a model, stop all
`mn token create NAME`	Create a named API token
`mn token list`	List token names and creation times
`mn token revoke NAME`	Revoke one token immediately
`mn token copy owner`	Copy the Keychain-backed owner token
`mn launch --model MODEL TOOL`	Launch an armed model, waking it if needed

Valid selectors are qwen36, ornith35, qwythos9, and their public IDs huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated, YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated, and huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated.

The fourth selector is ornith397, with public ID cebeuq/Ornith-1.0-397B-abliterated-W4A16 and alias nuri/ornith-397b-abliterated. It can be inspected normally, but expensive lifecycle operations require acknowledgement:

mn start ornith397 --allow-expensive
mn auto ornith397 --allow-expensive
mn wake ornith397 --allow-expensive
mn launch --model ornith397 --allow-expensive hermes

These commands remain blocked while deployment_enabled=false. They do not make the route live or deploy an application.

API and client configuration

Base connection values

Base URL: https://eminhenri--abliterated-cloud-api-api.modal.run/v1
API key:  a valid sk-mn-* token
Models:   huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated, YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated, huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated

The tested interface is OpenAI Chat Completions, including streaming and tool calls. /v1/models is also supported. Do not assume complete parity with every OpenAI endpoint or every proprietary client feature.

The disabled 397B profile is intentionally omitted from a deployable model list. A future reviewed release may advertise it only after the tracked policy is enabled and validation succeeds.

cURL

curl "https://eminhenri--abliterated-cloud-api-api.modal.run/v1/chat/completions" \
  -H "Authorization: Bearer $MN_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated",
    "messages": [
      {"role": "user", "content": "Explain this repository briefly."}
    ],
    "max_tokens": 200,
    "stream": false
  }'

Python OpenAI SDK

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://eminhenri--abliterated-cloud-api-api.modal.run/v1",
    api_key=os.environ["MN_API_TOKEN"],
    timeout=60 * 60,
    max_retries=0,
)

response = client.chat.completions.create(
    model="YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated",
    messages=[
        {"role": "user", "content": "Say MN API OK in one short sentence."}
    ],
    max_tokens=80,
)

print(response.choices[0].message.content)

The long timeout is intentional because a cold 35B backend can take several minutes to download, load, or compile.

Tool calling

The release smoke test forces one tool call on every route. A client should use the normal OpenAI tools and tool_choice fields.

response = client.chat.completions.create(
    model="YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated",
    messages=[
        {"role": "user", "content": "Call echo with value catalog-ok."}
    ],
    tools=[
        {
            "type": "function",
            "function": {
                "name": "echo",
                "description": "Echo a value.",
                "parameters": {
                    "type": "object",
                    "properties": {"value": {"type": "string"}},
                    "required": ["value"],
                    "additionalProperties": False,
                },
            },
        }
    ],
    tool_choice={"type": "function", "function": {"name": "echo"}},
    max_tokens=256,
)

Qwen thinking

Thinking is disabled by default so clients that only consume the standard OpenAI content field do not receive an apparently empty answer. A direct client can opt in:

{
  "chat_template_kwargs": {
    "enable_thinking": true
  }
}

Clients must know how to consume the model-specific reasoning field before enabling this.

Hermes Agent

mn start ornith35
mn launch --model ornith35 hermes --yolo
mn stop ornith35

The launcher:

checks that the selected lifecycle is armed for automatic use;
reads the owner token from the macOS Keychain;
wakes the model if it is in automatic mode;
configures the Hermes mn-uncensored custom provider;
sets a 2,700-second request and stale timeout;
starts Hermes with the selected MN model.

Pi

mn start qwythos9
mn launch --model qwythos9 pi
mn stop qwythos9

The launcher injects MN_API_TOKEN, selects the tracked Pi configuration in config/pi-agent, and starts Pi with provider mn.

OpenCode

mn start ornith35
mn launch --model ornith35 opencode
mn stop ornith35

The launcher builds an in-memory OpenCode configuration using @ai-sdk/openai-compatible. It does not write the token into a tracked config file.

Manual equivalent:

{
  "$schema": "https://opencode.ai/config.json",
  "model": "mn/YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated",
  "provider": {
    "mn": {
      "name": "MN Uncensored",
      "npm": "@ai-sdk/openai-compatible",
      "options": {
        "apiKey": "{env:MN_API_TOKEN}",
        "baseURL": "https://eminhenri--abliterated-cloud-api-api.modal.run/v1"
      },
      "models": {
        "YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated": {
          "name": "Ornith 1.0 35B — Abliterated",
          "limit": {
            "context": 131072,
            "output": 16384
          }
        }
      }
    }
  }
}

Cursor

Cursor compatibility is more limited than a generic OpenAI SDK. Cursor officially documents bring-your-own keys for supported providers, while custom base URL behavior and custom model support can change between versions. Specialized features such as tab completion may continue using Cursor’s own models.

If the installed Cursor version offers Override OpenAI Base URL, use:

OpenAI API key: an MN named token
Override URL:   https://eminhenri--abliterated-cloud-api-api.modal.run/v1
Model name:     YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated

Treat Cursor as a compatibility target, not as proof of complete Cursor feature parity. Hermes, Pi, OpenCode, cURL, and the OpenAI SDK are the directly configured/tested paths.

Browser applications and CORS

The current gateway intentionally has no permissive CORS middleware. Desktop, CLI, and server-side clients can call it. A browser-only frontend on another origin may be blocked by the browser even with a valid token.

A production web application should call MN through its own server-side backend rather than exposing a long-lived API token to browser JavaScript.

Tokens and security

Create tokens

Create the owner token once:

mn token create owner

The plaintext owner token is stored in the macOS login Keychain under mn-uncensored-owner-token.

Create a separate token for every friend or test client:

mn token create alice
mn token create cursor-test
mn token list

A non-owner token is printed once. Save it in the intended client immediately. The service cannot recover its plaintext later.

Revoke tokens

mn token revoke alice

Revocation removes the active digest record. Future requests with that token receive 401 invalid_api_token.

Token flow

flowchart TD
    OwnerCreate["mn token create owner"]
    FriendCreate["mn token create alice"]
    Plaintext["Random sk-mn-* plaintext token"]
    Keychain["macOS login Keychain<br/>owner plaintext only"]
    Once["Friend token printed once"]
    Hash["SHA-256"]
    Dict[("Modal Dict<br/>digest, name, active flag, creation time")]

    Request["Authorization: Bearer sk-mn-*"]
    Gateway["MN gateway"]
    Lookup["Hash presented token"]
    Allowed{"Active digest exists?"}
    Reject["401 invalid_api_token"]
    Route["Resolve allowlisted model"]
    Proxy["Attach private Modal proxy credentials"]
    Backend["Private vLLM backend"]

    OwnerCreate --> Plaintext
    FriendCreate --> Plaintext
    Plaintext --> Keychain
    Plaintext --> Once
    Plaintext --> Hash
    Hash --> Dict

    Request --> Gateway
    Gateway --> Lookup
    Lookup --> Allowed
    Dict --> Allowed
    Allowed -->|No| Reject
    Allowed -->|Yes| Route
    Route --> Proxy
    Proxy --> Backend

The gateway stores SHA-256 token digests, not recoverable plaintext tokens. Every valid token currently has access to the three live models. After the next budgeted release, the same token layer can access all four gateway routes when their lifecycle is armed. The CLI acknowledgement protects owner operations; it is not a per-token quota system. Per-token model permissions, quotas, rate limits, and billing accounts are not yet implemented.

Separate credential layers

Credential	Stored where	Used for
Owner `sk-mn-*` token	macOS Keychain	Local CLI and agent launchers
Friend `sk-mn-*` token	Given once to friend/client; digest in Modal Dict	Gateway API authentication
Modal proxy ID and secret	macOS Keychain and Modal Secret	Gateway-to-private-backend authentication
Modal account token	Modal CLI profile	Deployment and workspace control
Hugging Face token	Not needed by current public profiles	Only needed if a future model is gated/private

Never treat an unshared URL as security. URLs are discoverable; credentials are the access control.

Cloud storage and local downloads

No model weights are downloaded to this Mac by the normal deployment or inference flow.

flowchart LR
    HF["Hugging Face model repository"]
    ModalHF[("Persistent Modal HF volume")]
    ModalCompile[("Persistent Modal vLLM compile volume")]
    ModalKernel[("Persistent Modal FlashInfer kernel volume")]
    GPU["Ephemeral Modal GPU container"]
    Mac["Mac<br/>source code and CLI only"]
    GitHub["GitHub<br/>source and public metadata only"]

    HF -->|"first use of pinned revision"| ModalHF
    ModalHF --> GPU
    ModalCompile --> GPU
    ModalKernel --> GPU
    Mac -->|"deploy source and config"| GPU
    Mac --> GitHub

Cloud storage includes:

hf-model-cache for Hugging Face artifacts;
vllm-compile-cache for vLLM compilation artifacts;
flashinfer-kernel-cache for reusable CUDA kernels.

The first use of a new revision can download weights and compile kernels in Modal. Later cold starts reuse compatible cached artifacts.

The prepared cebeuq/Ornith-1.0-397B-abliterated-W4A16 record does not trigger a Hugging Face download by itself. Its roughly 196 GB artifact would be fetched into Modal storage only after an approved deployment starts or validates that backend; editing the catalog locally does not download it.

The repository stores only source code, model IDs, full public revision pins, deployment names, URLs, and other non-secret configuration.

Deploying a separate copy

The current repository is reproducible for the existing MN workspace, but a fresh fork is not yet a universal one-command installer. It contains the existing Modal app names and generated URLs.

A separate operator must:

create and authenticate a Modal account;
fork or clone the repository;
replace workspace-specific app names, gateway URL, backend URLs, and state object names in config/mn.json;
create a Modal proxy token pair;
store the proxy pair in the operator’s macOS Keychain;
sync it into a Modal Secret;
deploy each backend and the gateway;
create an owner API token;
enable one model at a time;
acknowledge the two-H200 release gate with MN_RELEASE_ORNITH397=I_ACCEPT_2XH200;
deploy and smoke-test all four routes.

The release refuses to begin without the exact acknowledgement. A successful release deploys all four scale-to-zero backends, smoke-tests every route, and finishes with every route hard-stopped.

Local dependency and Modal setup

uv sync
.venv/bin/modal setup
./scripts/install-macos.sh

Create private backend proxy credentials

Modal’s official command is:

.venv/bin/modal workspace proxy-tokens create

It prints a token ID and secret only once. Store them in the macOS Keychain:

read -r -s "modal_proxy_id?Modal proxy ID (wk-...): "
print
security add-generic-password -U -a "$USER" \
  -s uncensored-modal-key -w "$modal_proxy_id"
unset modal_proxy_id

read -r -s "modal_proxy_secret?Modal proxy secret (ws-...): "
print
security add-generic-password -U -a "$USER" \
  -s uncensored-modal-secret -w "$modal_proxy_secret"
unset modal_proxy_secret

Then sync them into Modal without writing a plaintext environment file:

./scripts/sync-modal-secret.sh

Current public model profiles do not set hf_secret_name, so they do not need a Hugging Face token. A future private or gated model must use a Modal Secret; never put an HF token into config/mn.json.

Deployment warning

The release workflow assumes:

a clean Git worktree;
a verified SSH-signed HEAD commit;
SSH-signed tags enabled;
a created owner token for smoke tests;
correct generated Modal URLs in the catalog;
permission to push the branch/tag and create a GitHub release.

Read docs/OPERATIONS.md before deploying a fork. Do not copy credentials from the existing deployment.

Troubleshooting

Result	Meaning	Action
`401 missing_api_token`	No Bearer token was sent	Configure `Authorization: Bearer ...`
`401 invalid_api_token`	Token is invalid or revoked	Create or replace a named token
`404 model_not_found` for `cebeuq/Ornith-1.0-397B-abliterated-W4A16`	The profile is disabled	Keep it disabled, or perform a separate signed budget review before enabling and deploying it
`400 max_tokens_exceeded`	Requested output exceeds 16,384	Lower `max_tokens` or equivalent
`413 request_too_large`	Body exceeds 16 MiB	Reduce attachments or request payload
`503 model_stopped`	Route is hard-stopped	Run `mn auto MODEL` or `mn start MODEL`
Empty upstream `503`	Modal is starting a zero-scale Server	Gateway waits internally with backoff
`502 backend_unreachable`	Private backend could not be reached	Check deployment and proxy credentials
`504 model_start_timeout`	Model was not ready within 30 minutes	Check Modal logs, capacity, weights, and vLLM startup
Client times out before MN	Client timeout is too short for cold start	Configure a timeout up to 30 minutes
Browser reports CORS	Browser blocked cross-origin request	Use a server-side proxy or explicitly design CORS
Responses appear empty	Client ignored model-specific reasoning output	Keep thinking disabled or update the client

/healthz is intentionally public and returns only service health. /status, /wake, /v1/models, and proxied /v1/* routes require a valid Bearer token.

Why the old Pi request returned repeated 503 errors

The original client called the private Modal backend path directly and treated scale-from-zero 503 responses as terminal failures. The current design sends clients to the shared gateway. The gateway recognizes an empty Modal 503, waits for health with exponential backoff, and replays the original request once.

Cold start expectations

A cold start can include:

allocating a GPU;
restoring or downloading model files;
loading weights into GPU memory;
compiling or loading kernels;
starting vLLM;
passing health checks.

The 9B route should generally be cheaper and faster to start than a 35B route, but no fixed startup time is guaranteed. The prepared 397B route has a substantially larger startup, download, and validation burden and remains unavailable while deployment_enabled=false.

Cost incident: what actually happened

On 2026-07-16, Modal reported $45.9634 of raw usage before credits:

Application	Raw cost before credits
Legacy `nuri-ornith-397b`	$32.8227
`huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated`	$9.4604
`YuYu1015/YuYu1015-Ornith-1.0-35B-abliterated`	$3.1430
`huihui-ai/Huihui-Qwythos-9B-Claude-Mythos-5-1M-abliterated`	$0.5121
Gateway	$0.0252

The evidence does not show a Modal autoscaler defect:

the stable final 397B auto session shut down about ten minutes after its last inference request, matching its then-configured idle window;
the legacy 397B work created 26 GPU container starts across three app versions;
huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated produced 23 server starts during repeated deployments and debugging;
before v0.3.1, the gateway polled a cold backend every five seconds, accumulating redundant pending start requests;
the old mn start command explicitly set min_containers=1, which makes scale-to-zero impossible regardless of scaledown_window.

The exact contribution of every local command cannot be reconstructed from Git history alone. What is proven is that the old interface exposed an unsafe permanent-warm mode under the ordinary word start, polling was too aggressive for long cold starts, the legacy app was separate from the later catalog, and development repeatedly redeployed and restarted expensive GPUs.

The source catalog now retains the exact old 397B artifact as cebeuq/Ornith-1.0-397B-abliterated-W4A16 so its pin, attribution, conservative endpoint limits, and cost risk remain visible. The prepared fourth route does not recreate the legacy app: no deployment occurs from this documentation work. Its deployment_enabled=false policy must be changed in a future signed, budget-approved commit before the release workflow will consider it.

Immediate and permanent corrections:

every route was hard-stopped and verified at zero tasks;
normal mn start now means automatic mode plus one wake;
no normal CLI path sets min_containers=1;
the idle window is five minutes and configuration rejects anything above five minutes;
backend startup is capped at 30 minutes instead of 90;
release workflows finish hard-stopped instead of leaving every route armed;
future releases test that the autoscaler policy is exactly min_containers=0, max_containers=1;
a Modal Workspace hard budget is mandatory before more GPU testing.

The code changes are published on main, but the Modal runtime remains hard-stopped and will not receive the safety deployment until that budget is confirmed.

Full evidence, timeline, limits, and commands: docs/INCIDENT-2026-07-16-MODAL-COST.md.

Release process and release history

Every runtime deployment must begin from a clean, verified, signed commit:

./scripts/deploy-release.sh catalog v1.2.3

The release script:

verifies the SSH signing configuration and signed HEAD;
runs all tests;
runs the secret scan;
refuses to continue while ornith397.deployment_enabled=false, then—only after a future signed budget approval—deploys qwen36, ornith35, qwythos9, and ornith397;
deploys the shared gateway;
enables automatic mode;
verifies /v1/models;
runs streaming and forced tool-call smoke tests against every model;
hard-stops each tested GPU;
leaves every model hard-stopped;
creates a signed annotated tag;
pushes branch and tag;
publishes curated GitHub release notes.

If a smoke test fails, no release tag should be created. A best-effort hard stop prevents a failed release from leaving an expensive test GPU warm.

The release refuses to start unless MN_RELEASE_ORNITH397=I_ACCEPT_2XH200 is set. After the operator confirms the Workspace budget and provides that exact acknowledgement, it deploys and smoke-tests all four routes, including 397B text, vision, structured tool-call, and shutdown validation. The release finishes with every route hard-stopped.

Release history

Release	Main result
`v0.1.0`	Minimal CLI, shared gateway, Bearer tokens, Hermes/Pi/OpenCode launchers, and signed release workflow
`v0.2.0`	API-triggered cold starts, automatic ten-minute shutdown, wake endpoint, and reproducible lifecycle
`v0.3.0`	Three-model catalog, 131K context, tool calling, independent routes, shared cloud caches, and pinned model/license record
`v0.3.1`	Exponential cold-start health backoff to prevent redundant queued GPU starts

Detailed curated notes are in docs/RELEASE_NOTES.md and CHANGELOG.md.

The latest runtime deployment is v0.3.1. Documentation commits after its tag describe that runtime but are not themselves a claim that a new Modal runtime was deployed.

Path from private API to resale platform

The current service has named credentials, but those credentials are access tokens, not customer accounts or billing records.

Before selling access, add:

per-token model permissions;
per-token and per-customer rate limits;
concurrency quotas and queue limits;
token-accurate usage metering;
reservation and reconciliation for streamed requests;
cost and margin accounting;
spending limits and automatic circuit breakers;
customer balances, invoices, refunds, and tax handling;
abuse reporting and incident response;
privacy policy, terms of service, and data-retention rules;
audit logs that avoid storing prompt content by default;
health monitoring, alerts, status page, and support process;
model license, training-data, and provider-terms review;
load tests and capacity planning;
controlled model rollouts and rollback support.

Possible future commercial architecture

flowchart LR
    Customer["Customer"]
    Product["MN product API<br/>accounts, quotas, metering"]
    Payments["Billing or Routstr<br/>card, Lightning, Cashu"]
    Router["MN model router"]

    subgraph Compute["Inference providers"]
        Owned["Owned Modal plus vLLM routes"]
        External["Optional Featherless, OpenRouter,<br/>Venice, or other fallbacks"]
    end

    Customer --> Product
    Product <--> Payments
    Product --> Router
    Router --> Owned
    Router --> External

The current code implements the owned inference path, not the customer, payment, or production operations layers.

Model and license caveats

“Abliterated” is an upstream checkpoint label, not independently verified proof of zero refusals.
Benchmark results from a base model do not automatically apply to an abliterated derivative.
Results from one derivative do not apply to a different derivative.
The configured 131,072 context is a deployment setting, not proof that every workload is reliable at that length.
The retained 397B model card advertises native 262,144-token context, but MN's un-revalidated source profile remains 32,768 context and 8,192 output.
The 397B source profile uses qwen3_xml, qwen3 reasoning with thinking disabled by default, multimodal loading, and no prefix caching. The old prototype's qwen3_coder and experimental Mamba-aligned prefix-caching choices are not carried forward without new tests.
The 1M in the Qwythos repository name is not the current MN context limit.
Repository license metadata does not by itself clear all training data, notices, trademarks, provider terms, or commercial resale rights.
Complete legal and contractual review is required before public commercial access.

The originally selected WWTCyber Qwen3.6 checkpoint declared an architecture that the pinned vLLM 0.21 runtime did not register. huihui-ai/Huihui-Qwen3.6-35B-A3B-abliterated therefore uses the compatible Huihui checkpoint documented in docs/MODELS.md. That substitution is recorded explicitly and must not be presented as an equivalence benchmark.

Name		Name	Last commit message	Last commit date
config		config
docs		docs
scripts		scripts
src/mn_uncensored		src/mn_uncensored
tests		tests
website		website
.dockerignore		.dockerignore
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
deployment.env.example		deployment.env.example
modal_gateway.py		modal_gateway.py
modal_vllm.py		modal_vllm.py
package-lock.json		package-lock.json
package.json		package.json
pyproject.toml		pyproject.toml
run-pi.sh		run-pi.sh
test_endpoint.py		test_endpoint.py
uv.lock		uv.lock
website-worker.mjs		website-worker.mjs
wrangler.jsonc		wrangler.jsonc

Latest commit

History

Folders and files

Repository files navigation