Autonomous agents are starting to move real money on Solana. Most start the way the tutorials do — a raw private key in the agent's environment, so one prompt injection empties the wallet. The production standard is moving to policy-gated signing; Coldstar is the air-gapped, self-custodial root of it. Your agent transacts without ever owning the key: the cold root signs the policy, and the agent acts inside it.
The mistake is putting the agent's brain and the wallet's key in the same box. Separate them. A safe agent-signing stack has three distinct roles, and no single component holds more than one:
In its own runtime — an attested TEE, a server, or normal app space on the Seeker. It observes, decides, and proposes transactions. It never sees a key.
Behind the gate — Coldstar on an air-gapped machine, or Seed Vault's secure element on the Seeker. Signs only what policy allows; the key never leaves.
On-chain, in a policy account or multisig program. Limits, allowlists, and rate caps enforced by Solana itself — not by trusting the agent.
Here is the hard part, stated plainly, because it's the reason this is worth building. A true air gap and a fully autonomous agent pull in opposite directions. An air gap means the signing key lives on a machine with no network path — so something has to carry each transaction across the gap. A human, a QR scan, a USB hop. But an autonomous agent is defined by not waiting for a human. Put those two requirements in the same sentence and they appear to cancel out.
Most "agent wallet" products resolve the tension by quietly dropping the air gap: they hand the agent a hot key and call it a day. That's not a resolution — it's the original problem with extra steps.
The air-gapped key does not need to sign every transaction. It needs to sign the rules — once. Coldstar issues a bounded policy envelope across the gap: a signed grant that says exactly what the agent may do. The agent then operates inside that envelope on its own, with a disposable hot session key, and never touches the cold root for routine work.
X SOL or $Y of a token in one transaction.N transactions per hour; faster is throttled or paused.The cold key comes back across the gap only for the things that genuinely deserve a human: changing the policy, approving a high-value action, or recovery. The air-gapped root authorizes the rules; the agent authorizes the clicks — within limits it cannot exceed no matter how it's compromised.
Once policy is the unit of trust instead of the individual transaction, every remaining bit of friction is about how often you cross the gap. Five things push the common case toward zero crossings while keeping the cold root as the anchor:
Put the policy in an on-chain account, and let Solana enforce the limits trustlessly instead of asking anyone to trust the signer. Two primitives make this real today: Squads v4 spending limits (max amount per period, reset cadence, destination allowlist — formally verified, securing billions) and the Solana Foundation's Subscriptions & Allowances program (a spend cap with optional expiry, built explicitly for agents acting within a budget). The cold key is just the authority that sets the policy, so the agent's routine spending never crosses the gap. Richer rules — per-program allowlists, rate caps by transaction type — are emerging on-chain (Squads' v5 "Hooks" line) and still lean on an off-chain co-signer for the semantic checks. This is the biggest single win.
Cold signs a short-lived delegate key once (say, 24 hours, capped), instead of a standing grant. The agent uses the hot session key freely until it expires. Crossings drop from "every policy change" to "once per session."
A one-tap freeze that invalidates the session key or pauses the policy account without needing the cold device. The kill-switch always in reach is what lets you grant a looser envelope with confidence.
The policy layer checks the agent's TEE attestation before honoring a request — proving the agent is the exact code you shipped, with no human in the loop. Attestation stops being a manual step and becomes part of the gate.
A drop-in Coldstar signer so a builder on a framework like Solana Agent Kit swaps one line to route through policy-gated signing. Pair it with a default-tight envelope that loosens on track record and steps up to cold only on anomalies — so the cold root is the exception path, not the loop.
The through-line: push enforcement on-chain and to hot session keys, and reserve the air-gapped root for issuing policy, high-value approvals, and recovery. That's autonomous within bounds, human only at the edges.
Coldstar was built CLI-first and scriptable — the same shape that makes it air-gapped for humans makes it callable by an agent. The loop your agent runs:
Where the key physically sits is your choice of custody root: Coldstar on an air-gapped machine for an off-device root of trust, or Seed Vault on the Seeker, whose secure element holds the key. Neither is a signer the agent calls on every transaction — Seed Vault approves each signature with the user's biometric, and Coldstar sits behind an air gap. That's exactly why the agent doesn't sign through them per-transaction: the root authorizes the on-chain policy once, and the agent then acts within that allowance using a hot session key. The root holds the key; the chain holds the rules; the agent holds neither.
No — Coldstar is an air-gapped signer, not a place to run code. An agent has to be online to act, which is the opposite of an air gap. The agent runs in its own runtime and calls Coldstar to sign. That separation is the security property, not a limitation.
No. Seed Vault is a signing service backed by the secure element; by design, nothing but Seed Vault runs in that environment, and every signature it makes is approved by the user's biometric — there's no unattended or session signing inside it. So the agent doesn't call Seed Vault per transaction. Seed Vault acts as the human-approved root that authorizes the on-chain policy once; the agent then transacts within that allowance with a hot session key. The key never leaves the secure element.
The cold key signs the policy envelope once, not every transaction. The agent operates inside that envelope autonomously with a hot session key. A human is only needed to change the policy, approve a high-value action, or recover.
Coldstar's signing core ships now (CLI and Seeker app). The on-chain policy layer, session-key delegation, and attestation checks described here are the roadmap — and the reason the architecture is CLI-first and scriptable. The policy engine is part of the planned third-party review.
Open source, CLI-first, scriptable — the signing core is on GitHub today. Read the agent-safe signing thesis or the docs.
pip install coldstar