This is the real incumbent. Solana Agent Kit, ElizaOS, and GOAT all start the same way: a base58 secret in SOLANA_PRIVATE_KEY, decoded with Keypair.fromSecretKey, held in the agent's process. It works in ten minutes. It also means one prompt injection, one leaked log, or one bad dependency is the whole wallet.
Keep the .env key for devnet. On mainnet the agent gets a Coldstar session key bounded by policy, and the root stays on the drive.
| Coldstar | a private key in .env | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | The agent process. Whatever runs the model holds the full secret; so does anything that can read its memory, environment, or logs. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | An environment variable, a .env file, a secrets manager, a container image layer. Solana's cookbook warns never to embed it client-side or commit it, and points production users to a key-management backend. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | None. Any transaction the agent builds, it can sign. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | There is no such thing; every transaction is in policy. |
| Cold / offline root | Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. The key is on an online host by definition. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Universal: Solana Agent Kit's KeypairWallet, ElizaOS's Solana plugin, GOAT's examples all read SOLANA_PRIVATE_KEY. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | Free; it is the Solana SDK. |
| Pricing | Free software plus a ~$10 drive. | Free. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | It is how most agents run today, and how most agent wallets get drained. |
Every framework author knows this is the weak point. Solana Agent Kit's wallet interface, AgentKit's wallet providers, and ElizaOS's plugin structure all exist so you can swap the raw key for a signer. Coldstar is one of the signers you can swap in.
An agent with a raw key is trusting every input it reads. A malicious string in a web page, a tool result, or another agent's message can instruct it to send everything to an attacker, and the key in its process will oblige. Logs, crash dumps, and container layers can leak the key without any injection at all. Solana's own cookbook tells developers not to ship this to production.
Coldstar turns the agent into a proposer. It builds transactions and hands them to the signer; the signer evaluates a fixed rule list, first match wins: blocklist, program allowlist, escalate threshold, per-transaction limit, recipient allowlist, daily cap. Allowed transactions are signed by a disposable session key that the cold root authorised offline. Rejected transactions never get a signature. Over-threshold transactions wait for a human.
Coldstar is beta and pre-audit. It is still categorically safer than a root key in an environment variable, because the failure mode changes from "lose everything" to "lose at most the policy".
Every major Solana agent framework has a wallet abstraction. Coldstar ships one for Solana Agent Kit (ColdstarWallet, MIT); implement the same five methods for any other framework and the rest of your agent code does not change.
Trusted sources get compromised, dependencies get hijacked, and logs get shipped to third parties. Policy is cheap insurance against the day your assumption fails.
Routine transactions are signed by the session key on the same host, so latency is a local policy check. Only over-threshold transactions wait for a human.
Solana Agent Kit (SOLANA_PRIVATE_KEY into KeypairWallet), ElizaOS's Solana plugin (SOLANA_PRIVATE_KEY, with a fallback that generates and stores a key if none is set), and GOAT SDK's examples (SOLANA_PRIVATE_KEY). All three also let you plug in an external signer.
The recipient is not on the allowlist, or the amount exceeds the limit, or the daily cap is hit. The policy returns REJECT or ESCALATE. No signature exists for a rejected transaction.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.