Alchemy's agent pitch is right: don't put a private key in a prompt or a .env; grant scoped, time-bound session keys instead. Its implementation is an ERC-4337 smart account, which means it is EVM-only. On Solana, Alchemy offers gas sponsorship and no smart accounts, bundler, or session keys.
Alchemy session keys for the EVM side of a multichain agent; Coldstar for its Solana side.
| Coldstar | Alchemy Smart Wallets | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Owner key is bring-your-own or a hosted embedded signer (historically Turnkey enclaves). Permissions live in the on-chain ERC-4337 account. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | External signer or TEE for the owner; permissions on-chain (Modular Account v2). EVM. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold. Evaluated locally, first match wins, before any signature exists. | Session keys: native transfer limit, ERC-20 cumulative allowance, gas limit, contract and function-selector allowlists, expiry. Validated on-chain. EVM only. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. | Reverted on-chain; sessions revocable from the dashboard. |
| Cold / offline root | Yes — the root key never touches a networked machine. | Owner can be a hardware wallet in principle; no documented cold-root workflow. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. CLI signer today; MCP server in progress. | Agents page: scoped, time-bound permissions; CLI scoped sessions. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Partial. Solana: gas sponsorship yes; bundler, smart accounts, and session keys no. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | aa-sdk MIT (EVM/viem). Hosted APIs. |
| Pricing | Free software plus a ~$10 drive. | Compute units per call (e.g. prepareCalls 1,750 CU, sendPreparedCalls 3,000 CU); plan tiers vary. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; a leading EVM account-abstraction stack. |
If you are on EVM, Alchemy's session keys are a strong answer and Coldstar's EVM support is secondary. If you are on Solana, this page exists to save you a search: Alchemy's smart wallets do not run there.
Alchemy's model anchors permissions in an on-chain smart account: the session key can only do what the account's validation logic allows, and anyone can verify that. The owner signer is yours or a hosted enclave. This is a good design for EVM agents and it simply does not exist on Solana, where Alchemy's supported-chains table lists gas sponsorship only.
Coldstar's model is off-chain but local: a cold root signs a policy envelope; a session key acts inside it under a rule list enforced before signing. It works on Solana today and has secondary EVM support.
Alchemy is production. Coldstar is beta, pre-audit.
No. At review time Alchemy's supported-chains table showed Solana with gas sponsorship only: no smart accounts, no bundler, no session keys.
Coldstar's core is chain-agnostic and EVM signing exists, but Solana is the first-class chain. For an EVM-only agent, Alchemy's session keys are the more mature option.
The policy envelope: the offline root authorises a disposable session key bounded by limits, allowlists, and a daily cap, enforced locally rather than on-chain.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.