Skip to content

Let an AI move your crypto. It never sees your private key, and neither does EKKA.

An AI decides whether to move the extra in your wallet to savings. It can sign only while you allow it, and every yes and every no is signed on your computer.

Your everyday wallet holds more than it needs. An AI checks it against your rule and decides to move the extra to your savings wallet. It tries, and EKKA stops the signature, because you have not given it permission. You give it permission to sign, for as long as you choose, and the Enclave on your computer signs the same transfer with your test wallet's key. You take the permission back, and the next transfer is stopped.
Trust Every step is written down and signed on your computer. At the end, your computer checks that record without asking EKKA.
Security The AI can do only what you allowed, and only for as long as you allowed it. The AI decides only transfer or hold. The kit sets the amount and the savings address. Both are set before the AI is asked. While a sign permission lasts, the agent may sign ANY transfer with this key, to anyone, any amount: the signing permission checks who may sign and for how long. It does not restrict the transfer's destination or amount. That is why you choose the minutes.
Privacy Your wallet's private key stays in the Enclave on your computer, which signs with it. Your key is stored on this computer, encrypted. The AI cannot see it, and neither can EKKA. They can only ask your Enclave to sign with it, and only while you allow that. To decide yes or no, EKKA's control plane is sent the message to the AI, which names the amount and the savings wallet. The AI gate carries it to the model, a third party, not EKKA. When your Enclave signs, EKKA sees only a fingerprint of what is signed, never your key. Then the signed transfer, which is public once it is sent. Want your own model instead of a third party's? Connect its API the same way the kit connects the Sepolia network (connect your own API). Then the message goes to your model, not a third party's.

The Sepolia test network only: test ETH has no value, and a faucet hands it out. The transfer rule is an example, not advice.

The kit is a folder in github.com/ekka-labs/kits, version wallet-agent/3.0.1. Read open.sh before you run it.

What you need

  • A Mac, a Linux box, or a container, with python3.
  • A test wallet you made for this: in MetaMask, a new account. Never a wallet that holds anything you would miss. This is your everyday wallet.
  • A second account in MetaMask for savings: the address the extra moves to. No second account? Press Enter when the kit asks, and the extra goes back to the same wallet.
  • A little test ETH in the everyday wallet, from a faucet (see below). The walk needs a little more than 0.011; a faucet gives 0.05.
  • The everyday account's private key. You paste it once, at a prompt that hides it.

Your test wallets and test ETH

  1. In MetaMask, add a new account for the kit. Copy its address (0x and 40 characters).
  2. Add one more account, for savings, and copy its address too.
  3. Open Google's Sepolia faucet, sign in, paste the first address, and click Receive 0.05 Sepolia ETH. If Google says no (a daily limit), use Alchemy's faucet.
  4. The private key of the first account: the account's three dots, Account details, Show private key.

If the everyday wallet holds no extra above the 0.01 it keeps, the kit stops before the AI is asked and shows how to put some back. A second walk meets exactly that, because the first one moved the extra to savings: send some back from savings in MetaMask, then run ./open.sh steps again.

Install and start

The installer checks that the binary was signed by EKKA's release workflow before it installs it, so the machine needs cosign first:

# macOS
brew install cosign
# Linux, x86_64 (on arm64, use cosign-linux-arm64)
sudo curl -fsSLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
sudo chmod +x /usr/local/bin/cosign

The machine must reach Sigstore

cosign checks the signature against Sigstore's public log, so the machine needs to reach rekor.sigstore.dev and tuf-repo-cdn.sigstore.dev. Without cosign, or without that access, the installer stops and says which one it is.

curl -fsSL https://get.ekka.ai/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
ekka login --email [email protected]
ekka org create <a short name for your organization, letters and dashes>
ekka enclave create --name "wallet agent"
ekka enclave start <the id it printed>

Leave that window running: it is the Enclave, the part of EKKA that runs on your computer. In a second window:

git clone https://github.com/ekka-labs/kits
cd kits/wallet-agent
./open.sh

The kit says what it will set up and asks first. Each step shows what it runs, waits for you to press Enter, runs it, and says what happened in plain words. q stops at any point.

If your organization runs more than one Enclave, add ENCLAVE=<the 8-character id> in front of ./open.sh so the kit knows which one is yours.

What the kit changes

It says this on screen and asks before each change. Each one is a file or a row you can read:

Change Check it yourself
Your test wallet's private key, in the Enclave's vault. Your key is stored on this computer, encrypted. The AI cannot see it, and neither can EKKA. They can only ask your Enclave to sign with it, and only while you allow that. ekka secret list. No command prints it back.
Your organization can reach the Sepolia test network through Blockscout, from your computer only: read your wallet, and send a transfer that is already signed catalog/ekka-eth-sepolia.json in the kit folder
An agent named wallet-agent exists ekka gate grant list --agent wallet-agent
Its plans exist as files: read your balance, your transfers and the fees, decide whether to move the extra, sign, send cat wallet.*.json in the kit folder
It may read the network, send an already-signed transfer, and ask the AI. It may not sign until you allow that in step 2 ekka gate grant list --agent wallet-agent

The four steps

  1. The AI checks your wallet, decides, and tries to move the extra. The kit has already worked out the amount (everything above the 0.01 you keep, less the most the network fee can be) and the savings address. The AI decides only transfer or hold. It has no permission to sign, so EKKA stops the signature. Your wallet's page on Blockscout shows nothing new.
  2. You give permission to sign, for as long as you choose. The same transfer goes to EKKA again, and the Enclave signs it. The kit checks the signature belongs to your wallet, sends it, and waits until the network confirms it. It shows the network fee in test ETH. The AI is not asked again.
  3. Take the permission back. A confirmed transfer is final, so there is nothing to cancel.
  4. The same transfer once more, as a new one. EKKA stops it.

Then the kit checks the signed record on your computer, with no call to EKKA, and sums up what happened under Trust, Security and Privacy.

Good to know

  • The AI decides only transfer or hold. The kit sets the amount and the savings address. EKKA lets only the words transfer or hold through, and only transfer leads to the signing step. The amount and the address are inside the transfer before the AI is asked, so no answer can send more, or send it elsewhere.
  • While a sign permission lasts, the agent may sign ANY transfer with this key, to anyone, any amount, not only this one. The signing permission checks who may sign, with which key, on which computer, and for how long. It does not restrict the transfer's destination or amount. EKKA's control plane does see both, in the message to the AI; the permission does not limit them. The kit sets the address and the amount. That is why you choose the minutes, and why step 3 takes the permission back.
  • Revoking permission prevents new signatures. It cannot invalidate a signature already created or undo a confirmed transfer.
  • A signed transfer carries its transfer number, so the network takes it once. Sending the same signed transfer again can never move it twice, and the kit never signs again to retry a send.
  • The public Blockscout service takes only a few sends every few minutes. When it is busy the kit says so, and sends the same signed transfer again when you press Enter.
  • ./open.sh why answers the questions people ask, and how to check each answer yourself. ./open.sh commands lists every command the kit ran.

The ideas the kit uses are explained here: how governance works, what leaves your machine, grant conditions and the signed record.