Add verify_ssl parameter to LLM client for self-signed cert support

docs/CLAUDE_SDK_USERS.md

@@ -40,6 +40,12 @@ Each service has its own client class:
 # LLM inference (Base Sepolia OPG tokens for x402 payments)
 llm = og.LLM(private_key="0x...")
 
+# Connect directly to a known TEE IP instead of using the on-chain registry.
+# WARNING: TLS certificate verification is automatically disabled when using
+# llm_server_url, as self-hosted TEE servers typically use self-signed certs.
+# Only connect to servers you trust over secure network paths.
+llm = og.LLM(private_key="0x...", llm_server_url="https://1.2.3.4")
+
 # On-chain model inference (OpenGradient testnet gas tokens)
 alpha = og.Alpha(private_key="0x...")
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "opengradient"
-version = "0.8.0"
+version = "0.8.1"
 description = "Python SDK for OpenGradient decentralized model management & inference services"
 authors = [{name = "OpenGradient", email = "adam@vannalabs.ai"}]
 readme = "README.md"

src/opengradient/client/llm.py

@@ -68,6 +68,22 @@ class LLM:
 
         result = await llm.chat(model=TEE_LLM.CLAUDE_HAIKU_4_5, messages=[...])
         result = await llm.completion(model=TEE_LLM.CLAUDE_HAIKU_4_5, prompt="Hello")
+
+    Args:
+        private_key (str): Ethereum private key for signing x402 payments.
+        rpc_url (str): RPC URL for the OpenGradient network. Used to fetch the
+            active TEE endpoint from the on-chain registry when ``llm_server_url``
+            is not provided.
+        tee_registry_address (str): Address of the on-chain TEE registry contract.
+        llm_server_url (str, optional): Bypass the registry and connect directly
+            to this TEE endpoint URL (e.g. ``"https://1.2.3.4"``). When set,
+            TLS certificate verification is disabled automatically because
+            self-hosted TEE servers typically use self-signed certificates.
+
+            .. warning::
+                Using ``llm_server_url`` disables TLS certificate verification,
+                which removes protection against man-in-the-middle attacks.
+                Only connect to servers you trust and over secure network paths.
     """
 
     def __init__(
@@ -90,7 +106,10 @@ def __init__(
         self._tee_payment_address = tee_payment_address
 
         ssl_ctx = build_ssl_context_from_der(tls_cert_der) if tls_cert_der else None
-        self._tls_verify: Union[ssl.SSLContext, bool] = ssl_ctx if ssl_ctx else True
+        # When connecting directly via llm_server_url, skip cert verification —
+        # self-hosted TEE servers commonly use self-signed certificates.
+        verify_ssl = llm_server_url is None
+        self._tls_verify: Union[ssl.SSLContext, bool] = ssl_ctx if ssl_ctx else verify_ssl
 
         # x402 client and signer
         signer = EthAccountSignerv2(self._wallet_account)