Lit is the most ambitious design in this set: key authority defined in smart contracts, enforced by a sealed TEE that reads the chain on every request, and programmable conditions in JavaScript. Vincent layers agent delegation on top. Coldstar is the least ambitious: a file, an offline machine, and a short rule list.
Lit for cross-chain conditional signing in a product; Coldstar for the treasury root and the agents that spend your own funds.
| Coldstar | Lit Protocol | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Lit's network. Current docs: key authority lives in contracts on Base; a sealed TEE reads them on every request; nothing off-chain, including Lit, can sign outside the on-chain rules. Solana historically via Wrapped Keys: threshold-encrypted Ed25519 keys decrypted inside a Lit Action, and exportable. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Attested TEE (Dstack stack); wrapped keys are encrypted blobs decrypted in-enclave. Whether PKPs are MPC-sharded across nodes or single-enclave was not stated on the fetched page. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Lit Actions: JavaScript conditions evaluated in the TEE, gated by on-chain scopes. Vincent adds Policies as guardrails on Abilities plus an on-chain app registry. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Signature refused by the enclave. Vincent's Connect Page handles grant-time user approval; per-transaction human escalation not documented. |
| Cold / offline root | Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. Root of trust is on-chain plus TEE; self-hosting of nodes is documented. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Vincent: open framework for user-controlled agents and vaults, with delegated permissions. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes via Wrapped Keys and Sign-in-with-Solana; Vincent claims Solana, EVM, Bitcoin (its docs site was unreachable during review). |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Core (API server, Actions runtime, contracts) published; TEE stack is Dstack; JS SDK MIT; crypto libraries Apache-2.0. Vincent repo showed no licence to GitHub's API. |
| Pricing | Free software plus a ~$10 drive. | Credit-based: $0.01 per second of management calls and Action execution, roughly $0.01 per signature; packages from $5; token discount; reads free. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production network; current architecture ("Chain Secured") is recent. |
Lit's model is elegant and it is a lot of moving parts: a chain, a TEE, a JavaScript runtime, and for Solana an encrypted key inside all of it. Coldstar has three parts and you can hold all of them.
Lit asks you to trust a sealed TEE that reads authority from contracts on Base, the correctness of the Lit Action code that expresses your conditions, and for Solana the wrapped-key path where an Ed25519 secret is decrypted inside the enclave to sign. The upside is that rules are on-chain and the network is decentralised. The downside is surface area.
Coldstar asks you to trust an encrypted file, an offline machine, and a short rule list evaluated locally. The agent holds a disposable session key; the root never goes online; anything over threshold waits for a human over QR.
Lit is a production network. Coldstar is beta, pre-audit.
Lit's current docs say no off-chain party, including Lit, can make a key sign outside the on-chain rules. The key material still lives inside Lit's TEE network. Coldstar's root lives on your drive.
Through Wrapped Keys: an Ed25519 key that is threshold-encrypted and decrypted inside a Lit Action to sign, and that can be exported. Vincent also claims Solana support; its documentation site refused connections during our review.
No. Coldstar's policy is amounts, program and recipient lists, an escalate threshold, and a daily cap. If you need arbitrary conditions, Lit or Cubist are the tools.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.