Turnkey has the most expressive Solana-aware policy language of any hosted signer: instruction-level conditions, SPL transfer checks, consensus rules, all evaluated inside an attested enclave. Coldstar evaluates a smaller rule set on your own machine with a root that never goes online. The question is whose infrastructure you want under your agent.
Turnkey for a fleet of consumer sub-org wallets; Coldstar as the cold treasury root that funds and bounds them.
| Coldstar | Turnkey | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Turnkey's enclaves. Keys are generated and used only inside Turnkey-operated QuorumOS enclaves; customers hold API keys and passkeys, not key material. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Turnkey's enclave stack with remote attestation. Underlying cloud hardware not named on the fetched pages. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold. Evaluated locally, first match wins, before any signature exists. | Boolean policy language: consensus (who) and condition (when). Solana fields for account keys, program keys, instructions, SOL and SPL transfers, address-table lookups; time windows via cron spans. No cumulative or daily caps. DENY beats ALLOW; evaluated inside the enclave. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. | Rejected, or held for a consensus rule that requires a human approver alongside the agent key. Root users can revoke by adding DENY policies. |
| Cold / offline root | Yes — the root key never touches a networked machine. | No. Always-online service; the customer's passkeys are the only customer-held material. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. CLI signer today; MCP server in progress. | Documented "End-User Delegated Agent Signing" (sub-org + zero-permission API user + policies); solutions for LangChain, CrewAI, Vercel AI SDK, x402; agent skills repo. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes, deeply: Solana transaction fields are first-class in the policy language. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | QuorumOS enclave OS published on GitHub; SDKs open. The service is hosted; no self-hosted option. |
| Pricing | Free software plus a ~$10 drive. | Free: 25 signatures/month, up to 1,000 wallets, then $0.10 per signature. Pro: $99/month minimum, $0.05 per signature. Enterprise: custom, down to $0.0015 per signature. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II; whitepaper published. |
If the question is "which hosted signer has the best Solana policy grammar", the answer is probably Turnkey. Coldstar's question is different: should the root of an agent's authority be a vendor's enclave at all.
Turnkey's claim is that no single engineer can access an enclave or reconstruct a secret, and that every change to your organisation's data is stamped inside an enclave. It backs that with remote attestation and a published enclave OS. You are trusting that design, Turnkey's operations, and the cloud beneath it, and paying per signature for the privilege of not running it.
Coldstar's claim is smaller and checkable at home: the root key is an AES-256-GCM ciphertext on a drive you hold; it decrypts only into memory-locked RAM on an offline machine, to sign a bounded policy envelope. The agent works from a disposable session key inside that envelope. Nothing online, and no vendor, can produce a root signature.
Turnkey is production infrastructure. Coldstar is beta; its policy engine and signing core are in scope for the planned independent audit, and its rule set is deliberately simple: blocklist, program allowlist, escalate threshold, per-transaction limit, recipient allowlist, daily cap.
Turnkey describes a model where keys exist only inside its enclaves and it cannot unilaterally sign. In practice the key material lives on Turnkey-operated infrastructure and you authenticate to it. Coldstar's root never leaves a drive you physically hold.
Not in its policy language at review time. It supports per-transaction conditions and time windows. Coldstar's policy includes a daily cap.
Yes. Solana Agent Kit ships a Turnkey example, and any signer implementing its wallet interface, Coldstar included, can be plugged in.
Coldstar is free software. Turnkey's free tier covers 25 signatures a month, then $0.10 each on pay-as-you-go.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.