Web3Auth, now MetaMask Embedded Wallets, is the social-login-to-Solana-key onboarding layer. Shares are split between the user's device and an auth network, then reconstructed on login into an Ed25519 key the app can use. That is good for onboarding humans. For an agent it means the agent ends up holding the root.
Web3Auth for your users; Coldstar for your agents. They do not overlap.
| Coldstar | Web3Auth | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Reconstructed on the client at login from a device share and an auth-network share; neither MetaMask nor the login provider can use one share alone. Full private-key export is supported and toggleable in the dashboard. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Shamir shares across device and auth network; the reconstructed key is exposed to the client app. |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold. Evaluated locally, first match wins, before any signature exists. | None found. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. | Not applicable. |
| Cold / offline root | Yes — the root key never touches a networked machine. | No. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. CLI signer today; MCP server in progress. | None found. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: users receive an Ed25519 key suitable for Solana. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | SDKs on GitHub; licences not confirmed. Hosted auth network. |
| Pricing | Free software plus a ~$10 drive. | Free to 1,000 monthly active wallets plus $0.05 per extra; Growth $69/month for 3,000; Scale $399/month for 10,000; Enterprise custom. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; now part of MetaMask. |
Web3Auth is not trying to be an agent signer, and this page is here because people search for it as one. The reconstructed key on the client is the opposite of what an agent needs.
Web3Auth's MPC protects the key from the provider and the login service, which is the right threat model for a consumer who might lose a password. Once reconstructed on the client, though, the key is a normal secret in a normal process, and it can be exported. An agent using it is an agent with a raw key.
Coldstar never reconstructs the root anywhere online. The agent works from a disposable session key under a local policy; the root is decrypted only in locked RAM on an offline machine, to sign the policy envelope.
Web3Auth is production. Coldstar is beta, pre-audit.
Technically yes; the Node SDK returns a signer after login. It would hold the full reconstructed key, with no policy, which is the situation Coldstar exists to prevent.
By its description, yes: no single party can use a single share. The full key exists on the client after login and can be exported.
None found in its docs at review time.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.