Agent Custody

Every AI agent handling real capital needs three things.

Split-key custody so no single party holds the full key. On-chain policy so the rules can't be bypassed. Verifiable history so every action is provable after the fact. We ship all three.

The three layers

Split-Key Custody

FROST 2-of-3 threshold + 2PC-MPC via Ika

One secp256k1 dWallet. Agent holds one key share. Ika network holds the other. The full private key never exists in any single location. Compromise one side and you get nothing.

FROST 2-of-3secp256k1P2TR Taproot

On-Chain Policy

Sui Move contract

Per-transaction limits. Daily caps. Recipient whitelist. Emergency freeze. Enforced by the Sui validator set, not by client code. The agent cannot bypass the rules even if compromised.

SpendPolicyMove

Verifiable History

ZAP1 attestation protocol

Every operation committed to a BLAKE2b Merkle tree. Roots anchored on Zcash mainnet. Same root verifiable on Ethereum, Arbitrum, Base, Hyperliquid, and NEAR. 39 leaves, 4 mainnet anchors.

BLAKE2b7 chains

How we compare

Feature	Frontier Compute	Coinbase AgentKit	Lit Protocol	Fireblocks
Split-key MPC	Yes (Ika dWallet)	No (custodial)	Yes (TSS)	Yes (MPC-CMP)
On-chain policy	Yes (Sui Move)	No	Partial (PKPs)	Off-chain only
Zcash support	Yes (transparent + ZIP 246)	No	No	Limited
Bitcoin P2TR	Yes (Taproot sighash)	No	Yes	Yes
Attestation proofs	Yes (BLAKE2b, 7 chains)	No	No	No
Open source	Yes (MIT, 27 repos)	Yes	Partial	No
Self-hostable	Yes	No	No	No

Flow

createWallet()

DKG generates a split-key dWallet on the Ika network. You save the encryption seed.

setPolicy()

Deploy spend rules as a Sui Move contract. Limits, whitelist, freeze controls.

sign()

2PC-MPC signing. Presign + approve. Neither party sees the full key at any point.

broadcastTx()

Transaction hits the target chain. Zcash, Bitcoin, or Ethereum mainnet.

attest()

Operation recorded in ZAP1 Merkle tree. Anchored on Zcash. Verifiable on 7 chains.

Supported chains

Zcash transparent (ZIP 244 + ZIP 246 v6 sighash)

Bitcoin (P2TR Taproot)

Ethereum/EVM (KECCAK256)

Same dWallet signs for all three. One DKG, one key share, three chain families. Zcash shielded (Orchard) uses RedPallas on the Pallas curve, which Ika does not currently support. Transparent ZEC works today. ZcashRelay.sol provides a Zcash light client on Ethereum for header verification.

Install

# 54 exports.  2,300 downloads/week.
npm install @frontiercompute/zcash-ika

import { createWallet, sign, setPolicy } from '@frontiercompute/zcash-ika';

const wallet = await createWallet(config, 'zcash-transparent');
await setPolicy(config, wallet.id, { maxPerTx: 100000, maxDaily: 500000 });
const sig = await sign(config, {
  messageHash, walletId: wallet.id,
  chain: 'zcash-transparent',
  encryptionSeed: wallet.encryptionSeed
});