CubeSigner is what staking operators and bridges use when they need arbitrary policy code to run next to the key: HSM-sealed keys, Nitro Enclaves, and a programmable policy engine that executes your Rust or Wasm inside the TEE. Coldstar is a smaller idea, aimed at agents and treasuries rather than validators.
CubeSigner for validator and protocol infrastructure; Coldstar for the operator treasury and agents that spend from it.
| Coldstar | Cubist CubeSigner | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Cubist's enclaves. Only the enclave can access keys in the HSM; Cubist says not even its administrators can see keys. Imported keys encrypt directly to the enclave; cold-storage backup ciphertexts decrypt only for the owner. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | AWS Nitro Enclaves plus KMS and FIPS 140 HSMs, TPM 2.0 attestation; explicitly not Intel SGX. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Built-ins: receiver allowlist, RequireMfa with approver count and MFA types. Programmable Policy Engine runs custom Rust/Wasm in the TEE. Signature issued only if all checks pass. Solana instruction-level built-ins not confirmed. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Denied, or held for MFA by N approvers. |
| Cold / offline root | Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No offline signing root. Owner-decryptable cold backup ciphertexts exist. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | No dedicated AI-agent product or docs found. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: SDK supports Bitcoin and Solana alongside EVM. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs public; enclave and policy runtime closed. Hosted. |
| Pricing | Free software plus a ~$10 drive. | Not public; contact sales. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; audited by Veridise (ongoing); SOC 2 referenced. |
CubeSigner's programmable policies are the most powerful in this set. They are also code you write and maintain inside someone else's runtime. Coldstar trades that power for a rule list you can read in a minute and a root that is never online.
CubeSigner's promise is complete mediation: every signature passes through policy code executing inside an attested enclave, with the key sealed in an HSM. That is a strong model for infrastructure that must sign constantly and cannot have a human in the loop. You trust Cubist's enclave operation and your own policy code.
Coldstar's promise is that the root is never reachable: it lives encrypted on a drive, signs a policy envelope offline, and the agent works from a disposable session key under a short, fixed rule list evaluated locally. Less power, less to get wrong, nothing to attest.
CubeSigner is production and audited. Coldstar is beta, pre-audit.
For most agents, yes; it is built for validators, bridges, and exchanges. Its programmable policies would work for agents, but Cubist publishes no agent documentation or pricing.
No. Coldstar's policy is a fixed, ordered rule list: blocklist, program allowlist, escalate threshold, per-transaction limit, recipient allowlist, daily cap. That is deliberate; a rule list is easier to audit than a runtime.
Different jobs. CubeSigner defends an always-online key with hardware and attestation. Coldstar keeps the root offline and limits what the online part can do.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.