Privy powers embedded wallets for consumer apps and, since its acquisition by Stripe, is the obvious pick if you already run on Stripe rails. Its server wallets and policy engine cover agents too. Coldstar is the option when you don't want an agent's authority to originate in anyone's cloud.
Privy for end-user wallets in your product; Coldstar for the operator treasury and any agent that spends your money rather than a user's.
| Coldstar | Privy | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Privy's infrastructure. Keys are split with Shamir's Secret Sharing and reassembled only inside a TEE; Privy states it cannot sign alone. Developers control server wallets with authorization keys; export and policy changes can be gated by a key quorum. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Hardware-backed TEEs operated by Privy; vendor not named on the security page. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold. Evaluated locally, first match wins, before any signature exists. | Rules over 24+ methods and 15 field sources including Solana program, system, and token instructions; operators such as eq, lt, in, contains; transfer-size limits, time-bound signers, recipient and program allow and deny lists. Default deny. Some policies are enforced at the API layer, not in the enclave. No daily caps documented. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. | Denied. Key quorum protects critical actions such as export and policy updates; no per-transaction human approval workflow documented. |
| Cold / offline root | Yes — the root key never touches a networked machine. | No. Online TEE service. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. CLI signer today; MCP server in progress. | Agentic-wallet recipes (developer-owned vs user-owned agents, x402, Hyperliquid); AgentKit has a Privy wallet provider. Dedicated MCP server not confirmed. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: Solana instruction fields in policies and a send-Solana-transaction recipe. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs open; enclave and sharding code closed. Hosted only. |
| Pricing | Free software plus a ~$10 drive. | Free: 50,000 signatures and $1M transaction volume per month. Scale from $299/month. Enterprise down to $0.001 per signature. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II; audits by Cure53, Zellic, SwordBytes, Doyensec; HackerOne bounty. |
Privy's free tier is large enough that cost is not the argument here. The argument is about where authority lives and how much of the policy is enforced inside the trusted boundary.
Privy's design splits the key so that neither its servers nor your app hold the whole thing, and recombines it inside a TEE. That is a sound consumer-wallet architecture. Its policy documentation is candid that some checks, such as transfer-size limits that require simulation, run at the API level. Those rules are only as strong as the API boundary.
Coldstar has one boundary: the offline machine that holds the encrypted root and evaluates the policy. Amount limits, allowlists, and the daily cap are checked there, first match wins, and only then does a signature exist. An agent never has anything to exfiltrate but a bounded session key.
Privy is production, audited, and now part of Stripe. Coldstar is beta and pre-audit. Weigh maturity against where you want the root.
Privy describes itself as non-custodial: key shares are split and only recombined inside its TEE, and it says it cannot sign alone. The key material still lives on Privy-run infrastructure. Coldstar's root lives on your drive.
Its docs say the TEE enforces policies but that some, such as transfer-size limits, are enforced at the API level. Coldstar enforces everything locally on the signing machine.
Not documented at review time. Coldstar's policy includes one.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.