Agent-safe signing · Roundup

Turnkey alternatives for AI-agent signing on Solana

Turnkey has the richest Solana policy language of the hosted signers. People look elsewhere when they want daily spending caps, a human approval step, a cheaper metered price, or a root key that is not in any vendor's enclave. Here is every credible option.

Last reviewed 2026-09-04 · Each row links to a full comparison with first-party sources

At a glance

	Who holds the root key	Policy	Cold root	Pricing
Coldstar	You; encrypted on your own drive	Limits, allowlists, daily cap, escalate to human	Yes	Free
Privy	Privy TEE, Shamir shares	Solana rules; some enforced at API layer	No	Free to 50,000 signatures/mo
Crossmint	Owner: you. Agent key: Crossmint TEE	On-chain limits and rolling caps	Owner key could be	Free to 1,000 active wallets
Coinbase CDP Wallets	Coinbase Nitro enclaves	Per-transaction Solana rules	No	$0.005 per op; 5,000 free/mo
Openfort	Openfort TEE on Google Cloud	Solana rules incl. Anchor IDL checks	No	2,000 ops free, then $0.01
Para	2-of-2 MPC: device + Para HSM	Scopes, default deny; API layer	No	Free to 1,200 MAU
Dfns	Dfns MPC nodes; threshold undisclosed	Velocity limits, quorum approvals, KYT	No	From $800/year
Cubist CubeSigner	Cubist enclave + HSM	Custom Rust/Wasm policies in TEE; MFA quorum	No	Sales
Lit Protocol	Lit TEE network; authority on Base	JavaScript Lit Actions	No	About $0.01 per signature
Fireblocks	Fireblocks MPC across SGX enclaves	Caps, velocity, designated approvers	No	From $999/month

Short cells; the linked pages carry the detail and the sources. Coldstar is beta software with an independent audit planned before its production release, and that is stated on every page.

The options

Coldstar

Self-hosted, open-source policy signer with an air-gapped root. Daily caps, allowlists, and escalation to a human over QR. Beta.

How it works · Agent signing

Privy Embedded & server wallets

Shamir-split TEE wallets with a policy engine and a 50,000-signature free tier. Now part of Stripe.

Coldstar vs Privy →

Crossmint Smart-contract agent wallets

Two-signer smart wallets: you hold the owner key, Crossmint's TEE holds a scoped agent key, and limits live on-chain.

Coldstar vs Crossmint →

Coinbase CDP Wallets Hosted enclave signer + AgentKit

Nitro-enclave server wallets with per-transaction Solana rules and the open AgentKit framework. Half a cent per operation.

Coldstar vs Coinbase CDP Wallets →

Openfort Hosted TEE signer

TEE-held backend wallets with Solana rules including Anchor IDL instruction validation. Published pricing and a self-hostable signer component.

Coldstar vs Openfort →

Para MPC embedded wallets

2-of-2 MPC built around a user's device share, with scoped permissions. Better for consumer wallets than headless agents.

Coldstar vs Para →

Dfns Institutional wallet-as-a-service

Institutional: velocity limits, KYT screening, and multi-group quorum approvals. From $800 a year.

Coldstar vs Dfns →

Cubist CubeSigner HSM + enclave signer

HSM-sealed keys with custom Rust/Wasm policies executed inside the enclave. Built for validators and bridges.

Coldstar vs Cubist CubeSigner →

Lit Protocol Decentralised key network

Decentralised TEE network with JavaScript conditions and on-chain authority; Solana via wrapped Ed25519 keys.

Coldstar vs Lit Protocol →

Fireblocks Institutional custody

The institutional incumbent, with an agentic payments suite. From $999 a month.

Coldstar vs Fireblocks →

How to choose

Need daily or rolling caps? Dfns and Fireblocks have velocity limits; Crossmint enforces rolling caps on-chain; Coldstar has a daily cap locally. Turnkey, Privy, and CDP document per-transaction rules only.
Need a human approval step? Dfns has multi-group quorums; Turnkey can require a human co-approver in a consensus rule; Coldstar escalates over air-gapped QR.
Want the root off every vendor's infrastructure? Only Coldstar. Crossmint gets halfway with a customer-held owner key.
Want the cheapest hosted path? Coinbase CDP at $0.005 per operation, or Privy's free tier.

Frequently asked questions

Does Turnkey support daily spending limits?

Not in its policy language at review time. It supports per-transaction conditions and time windows. Dfns, Fireblocks, Crossmint, and Coldstar all express some form of cumulative cap.

Which agent signers are open source?

Coldstar is fully open (MIT). Turnkey publishes its enclave OS, Coinbase publishes AgentKit and its SDK, Openfort publishes its OpenSigner component, and most vendors publish SDKs. The hosted policy engines themselves are closed everywhere except Coldstar.

Which of these lets the agent run without any vendor account?

Coldstar, which is self-hosted software. Every other option is a hosted service you authenticate to.

Can I keep Solana Agent Kit and switch signers?

Yes. Solana Agent Kit's wallet interface is pluggable and ships examples for Turnkey, Privy, Crossmint, and Para. A Coldstar-backed wallet implements the same interface.

Try Coldstar in two minutes

Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.

pip install coldstar

Download All comparisons