Private stock execution, one checked plan at a time.

From ticker to private settlement.

The integration is organized around a checked trade plan. Each plan binds the asset, route, transaction order, simulation evidence, privacy mode, policy verdict, and expiry into one result.

Your first shielded trade plan.

This example plans a 500 USDG purchase of NVDA. It returns unsigned transactions. It does not move money and never signs for the wallet.

npm install @veilrail/sdk

import { VeilRail } from "@veilrail/sdk";

const veil = new VeilRail({
  apiKey: process.env.VEILRAIL_API_KEY
});

const plan = await veil.trades.plan({
  side: "buy",
  symbol: "NVDA",
  quote: "USDG",
  amountIn: "500",
  privacy: { mode: "shielded" }
});

console.log(plan.verdict);      // allow | warn | block
console.log(plan.transactions); // unsigned

Separate test and live environments.

Project keys are environment-specific and scope-limited. Use veil_test_ for deterministic sandbox calls and veil_live_ only when the live service is available.

VEILRAIL_API_KEY=veil_test_...

Test the decision path without funds.

The sandbox provides deterministic prices, simulated USDG, a funded test wallet, stable error cases, and the same plan shape intended for live execution.

Resolve the stock before routing the token.

VeilRail maps familiar ticker symbols to canonical Robinhood Chain Stock Tokens and checks whether each deployment can be traded.

One privacy object. No second integration.

The rest of the request stays the same. Select the disclosure boundary required by the trade.

privacy: { mode: "shielded" }

Five layers protect different parts of the trade.

Identity, balances, pre-trade intent, public-market impact, and auditability are handled separately.

Route, proof, policy, and simulation in one result.

A trade plan is the durable object reviewed before wallet signing. It expires when its price or observed chain state is no longer reliable.

Every decision names the rule.

Applications should branch on the verdict and structured reason codes, not parse prose.

What stays visible.

A public observer can still see protocol-level facts in shielded mode.

Small surface. Explicit outputs.

These routes define the intended v0 interface. The production base URL and OpenAPI schema will ship with the live service.

One client for public and private plans.

@veilrail/sdk wraps authentication, idempotency, typed errors, plan retrieval, local proof generation, and request validation. It never signs transactions.

Give an agent the same checked flow.

@veilrail/mcp exposes eight local tools. The project key stays in the MCP process. A wallet still performs every signature.

{
  "mcpServers": {
    "veilrail": {
      "command": "npx",
      "args": ["-y", "@veilrail/mcp"],
      "env": {
        "VEILRAIL_API_KEY": "veil_test_..."
      }
    }
  }
}

Optional for builders. Required for network coordination.

The API, SDK, and agent tools work without holding $VEIL. The token pays for private execution, bonds and rewards infrastructure, supports policy staking, and captures protocol fees.

Failures are designed for software.

Branch on stable error codes. Human-readable messages can improve without changing program behavior.

The privacy cost is explicit.

Confidentiality with auditability.

VeilRail is not designed to conceal funds from lawful reporting obligations or a party granted viewing authority. Deposit screening and selective disclosure are protocol features.