Para is an embedded-wallet vendor with a real agents page: pregenerated wallets, transfer limits, chain restrictions, and a permissions system with default deny. Its 2-of-2 MPC assumes a human's device holds the second share. Coldstar assumes there is no human device in the loop and puts the root offline instead.
Para for your users' wallets; Coldstar for the agents and treasury on your side of the product.
| Coldstar | Para | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | 2-of-2 MPC: one share on the user's device, one in Para's cloud HSMs; both needed, so Para cannot sign alone. For agent and pregenerated wallets, who holds the "user" share is not documented. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Para cloud HSMs (TEE vendor not named) plus user device. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold. Evaluated locally, first match wins, before any signature exists. | Policies → scopes → permissions, default deny: value caps, recipient allowlists, per-chain scoping, function-level restrictions. Enforced server-side before the MPC ceremony, at the API layer. Daily caps and time windows not confirmed. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. | Denied. User consent at scope grant; no per-transaction human approval queue documented. |
| Cold / offline root | Yes — the root key never touches a networked machine. | No. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. CLI signer today; MCP server in progress. | Agents page: REST API, wallet pregeneration, transfer limits, chain restrictions, spending conditions; customers include ElizaOS. Solana Agent Kit ships a Para example. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: EVM, Solana, Cosmos; Swig smart-account integration on Solana. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs public; MPC code closed. Hosted. |
| Pricing | Free software plus a ~$10 drive. | Free to 1,200 monthly active users; Starter $200/month (2,500); Growth $500/month (10,000); Scale $1,000/month (25,000); Enterprise custom. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II. |
Para's design makes the most sense when there is a human whose phone holds the second share. Agents do not have phones. That is the whole gap Coldstar is built to fill.
Para splits the key between a user's device and its HSMs and evaluates permissions server-side before the signing ceremony. For a consumer wallet that is sensible: the user's phone is a real second factor. For an agent, the question is who holds the device share, and Para's docs do not say.
Coldstar's two factors are the offline root and the disposable session key it authorises. The policy that bounds the session key is evaluated locally, before a signature exists; the root never goes online.
Para is production and SOC 2 certified. Coldstar is beta, pre-audit.
Para's docs describe the user-device share for consumer wallets; for pregenerated and agent wallets the holder of that share was not documented at review time.
Server-side, before the MPC signing ceremony, so they cannot be bypassed client-side. That is an API-layer control. Coldstar enforces policy on the signing machine itself.
Yes, in different places: Para for your users' embedded wallets and Coldstar for your own agents and treasury.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.