Turnkey has the most expressive Solana-aware policy language of any hosted signer: instruction-level conditions, SPL transfer checks, consensus rules, all evaluated inside an attested enclave. Coldstar evaluates a smaller rule set on your own machine with a root that never goes online. The question is whose infrastructure you want under your agent.
Turnkey for a fleet of consumer sub-org wallets; Coldstar as the cold treasury root that funds and bounds them.
| Coldstar | Turnkey | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Turnkey's enclaves. Keys are generated and used only inside Turnkey-operated QuorumOS enclaves; customers hold API keys and passkeys, not key material. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Turnkey's enclave stack with remote attestation. Underlying cloud hardware not named on the fetched pages. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Boolean policy language: consensus (who) and condition (when). Solana fields for account keys, program keys, instructions, SOL and SPL transfers, address-table lookups; time windows via cron spans. No cumulative or daily caps. DENY beats ALLOW; evaluated inside the enclave. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Rejected, or held for a consensus rule that requires a human approver alongside the agent key. Root users can revoke by adding DENY policies. |
| Cold / offline root | Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No. Always-online service; the customer's passkeys are the only customer-held material. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Documented "End-User Delegated Agent Signing" (sub-org + zero-permission API user + policies); solutions for LangChain, CrewAI, Vercel AI SDK, x402; agent skills repo. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes, deeply: Solana transaction fields are first-class in the policy language. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | QuorumOS enclave OS published on GitHub; SDKs open. The service is hosted; no self-hosted option. |
| Pricing | Free software plus a ~$10 drive. | Free: 25 signatures/month, up to 1,000 wallets, then $0.10 per signature. Pro: $99/month minimum, $0.05 per signature. Enterprise: custom, down to $0.0015 per signature. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; SOC 2 Type II; whitepaper published. |
If the question is "which hosted signer has the best Solana policy grammar", the answer is probably Turnkey. Coldstar's question is different: should the root of an agent's authority be a vendor's enclave at all.
Turnkey's claim is that no single engineer can access an enclave or reconstruct a secret, and that every change to your organisation's data is stamped inside an enclave. It backs that with remote attestation and a published enclave OS. You are trusting that design, Turnkey's operations, and the cloud beneath it, and paying per signature for the privilege of not running it.
Coldstar's claim is smaller and checkable at home: the root key is an AES-256-GCM ciphertext on a drive you hold; it decrypts only into memory-locked RAM on an offline machine, to sign a bounded policy envelope. The agent works from a disposable session key inside that envelope. Nothing online, and no vendor, can produce a root signature.
Turnkey is production infrastructure. Coldstar is beta; its policy engine and signing core are in scope for the planned independent audit, and its rule set is deliberately simple: blocklist, program allowlist, escalate threshold, per-transaction limit, recipient allowlist, daily cap.
Turnkey describes a model where keys exist only inside its enclaves and it cannot unilaterally sign. In practice the key material lives on Turnkey-operated infrastructure and you authenticate to it. Coldstar's root never leaves a drive you physically hold.
Not in its policy language at review time. It supports per-transaction conditions and time windows. Coldstar's policy includes a daily cap.
Yes. Solana Agent Kit ships a Turnkey example, and Coldstar's ColdstarWallet implements the same BaseWallet interface, so either plugs in.
Coldstar is free software. Turnkey's free tier covers 25 signatures a month, then $0.10 each on pay-as-you-go.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.