Let an AI move your crypto. It never sees your private key, and neither does EKKA.

If you are building an agent that should move money or sign for you, this is for you. The AI checks your wallet when you run the kit. In this example, it decides whether to move the extra to savings. You decide when it may sign.

• Trust. Every step is written down and signed on your computer, and your computer checks that record without asking us.
• Security. Your Enclave signs only while the agent has your permission. While that permission lasts, it may sign ANY transfer with this key, to anyone, any amount: The signing permission checks who may sign and for how long. It does not restrict the transfer's destination or amount. That is why you choose the minutes.
• Privacy. Your key is stored on this computer, encrypted. The AI cannot see it, and neither can EKKA. They can only ask your Enclave to sign with it, and only while you allow that.

Want to run it yourself? Request the kit. We email you an access key and one page that takes you from two test wallets to your first run.

What you will see

Your everyday wallet holds more than it needs. The AI follows one simple rule: when the everyday wallet holds more than 0.01 test ETH, move the extra to your savings wallet. The rule is an example, not advice. Everything runs on the Sepolia test network, where test ETH is free and has no value. No real money.

The AI decides only transfer or hold. The kit sets the amount and the savings address. The amount is everything above the 0.01 test ETH you keep, less the maximum network fee. The AI returns its decision and a short explanation. Only transfer leads to the signing step. A hold decision stops the run before signing.

The run has four steps:

1. The AI checks your wallet, decides, and tries to move the extra. It has no permission to sign yet, so EKKA stops the transfer.
2. You give it permission to sign, for as long as you choose. The same transfer is signed and sent.
3. You take the permission back.
4. The same transfer once more, as a new one. EKKA stops it.

The AI is asked once. After that, its decision is tried three times, and each time EKKA checks the permission you have given at that moment.

Nothing in the video is sped up. About 12 seconds of it is the network confirming the transfer.

The run, screen by screen

The excerpts below come from the recording. Status symbols and line breaks are omitted for readability. The figures belong to this run; yours will differ.

The AI is told very little. Your balance is read from the network on your computer. Then the kit summarizes the message to the AI. Press p in the kit to read the full message:

What the AI is sent
· Your rule: when your everyday wallet holds more than 0.01 test ETH, move the extra to savings.
· Your balance now: 0.0601 test ETH. Your savings wallet: 0xa25c…1e6f, on your list.
· The transfer the kit prepared: 0.0499 test ETH to savings, leaving at least 0.01.
Nothing else: not your private key, not your other transfers.

No permission, no signature. The AI decides to transfer, and EKKA stops it before the Enclave signs anything. You do not have to trust that. The kit points you at your wallet's public page:

The AI decides: transfer.
Its reason: The savings wallet 0xa25cf940341b9cb1019604666a737583913e1e6f is on the list. The everyday wallet holds 0.0601 test ETH, which is more than 0.01 test ETH, so there is extra to move.
EKKA stopped the transfer. Your AI agent has no permission to sign, so the Enclave did not sign and nothing was sent.
See it yourself: nothing new is on your wallet's page.

Before you give permission, the kit says what it covers. This is the most important line in the kit:

The signing permission checks who may sign and for how long. It does not restrict the transfer's destination or amount. So while it lasts, your AI agent may sign ANY transfer with this key, to anyone, any amount, not only this one.

You give permission, and the same transfer goes through. The AI is not asked again. Only your permission changed:

You are telling EKKA: your AI agent may sign with your wallet key, on this computer only, for 10 minutes. Nothing else.
Permission given, for 10 minutes.
The AI is not asked again. Its decision stands; only your permission changed.
Signed by the Enclave. The signature belongs to your wallet, 0x404d…462b.
The network took the transfer.
The network confirmed it: 0.0499 test ETH to your savings wallet, 0xa25c…1e6f.
The network charged a fee of 0.000053 test ETH to carry it. Your everyday wallet keeps at least 0.01, as your rule says.

The savings wallet's own public page shows the same 0.0499 arriving: its balance went from 0.5407 to 0.5906 test ETH.

Permission taken back, and the transfer is stopped again. Revoking permission prevents new signatures. It cannot invalidate a signature already created or undo a confirmed transfer. In this run, you take permission back after the confirmed transfer. Then your computer checks the signed record of the whole run:

Permission taken back.
EKKA stopped it. The permission is yours to give, and yours to take back.
See it yourself: the newest transfer on your wallet's page is still the one from step 2 (its hash begins 0xb3da4d66ff). Nothing new was sent.
The record checks out. Nothing in it was changed. Checked here, on your computer, without asking EKKA.

Who holds what

The AI chooses whether to transfer. EKKA checks whether the action is allowed. The AI gate carries the message to the model. By default, this kit uses Anthropic's Claude Sonnet 4, a third-party model. At the end, the kit reports what each part saw:

Privacy Your private key stayed in the Enclave on this computer, which signed with it.
EKKA and the AI could only ask it to sign, and only while you allowed that.
YOUR PRIVATE KEY NEVER LEFT THIS COMPUTER. To decide yes or no, EKKA's control plane was sent the message to the AI, which names the amount and the savings wallet. When your Enclave signed, EKKA saw only a fingerprint of what was signed, never your key. Then the signed transfer, which is public on the network once it is sent.
The AI gate carried the message to the model, a third party, not EKKA. It saw only your rule, your balance, your savings wallet and the amount. Never your key.

In more detail:

• The key never leaves the Enclave. The Enclave, the part of EKKA that runs on your computer, holds the key in its vault, encrypted. It signs, and returns only the signature and the public key.
• EKKA's control plane is sent the message to the AI, which names the amount and the savings wallet. The AI gate carries that message to the third-party model. When your Enclave signs, EKKA sees only a fingerprint of what is signed, never your key. EKKA is then sent the signed transfer.
• The signing permission checks who may sign and for how long. It does not restrict the transfer's destination or amount.
• The signed transfer is public once it is sent. That is how a blockchain works: anyone can see it on the network.
• The AI gate carries the message to the model. In this kit, EKKA's AI gate carries it to a hosted model, a third party, not EKKA. You write that message: the rule lives in one file, bin/prompt.
• The Sepolia connection lets your organization use this computer to read your wallet and send a transfer that is already signed. That connection cannot create or change a signature.

The kit also names another way to run it, which this run does not show: "Want your own model instead? Add its API to your catalog the same way this kit added the Sepolia network. Then the message goes to your model, not a third party's."

What this proves, and what it does not

It proves that the AI's transfer was signed only while you allowed it, and was stopped before and after. Your wallet's public page shows the transfer from step 2 and nothing from steps 1 and 4, and your savings wallet shows it arriving. The record of every step is signed and checked on your computer.

It is also narrow, on purpose:

• It is test money. The Sepolia test network, where test ETH has no value. Use wallets you made for this, never ones that hold anything you would miss.
• Sending the same signed transfer again does not make a second transfer on Sepolia. The network accepts its transfer number only once. The kit sends the same signed transfer when retrying; it does not sign a new one.
• The rule is an example, not advice.
• The AI can answer differently on another run. The kit asks the AI once and reuses that decision.
• After the demonstrated transfer, put test ETH back before another run. The kit keeps 0.01 test ETH and allows for the network fee. If there is not enough left to move, it stops before asking the AI.
• The kit runs as you. Your session can give and take back permissions, so never hand it to an AI. ./open.sh commands shows how to give an AI a session that can run plans and cannot grant.
• The record check has one gap. Checking on your computer, with no network, proves the entries were not changed. It cannot prove that entries were not cut off the end. Checking online can also show whether a signing key was revoked.

The same pattern, in your own systems

Test ETH is the example in this kit. You could build other workflows around a signature, a permission and a signed record. These are possible applications, not features demonstrated by this kit:

• Sweeping a company's operating wallet into cold storage. You could schedule a wallet check each evening and ask an AI whether to move the extra to a savings wallet. Your code would prepare the transfer, and your Enclave would sign only while the required permission lasts.
• Signing a software release. You could ask an AI to review build results, then require permission from a release manager before a release key signs. This would need its own integration and tests.

These workflows would still need checks on what may be signed. A time-limited signing permission alone does not provide those checks.

Run it yourself

1. Request the kit: ekka.ai, Request access. We reply by email with your access key and the setup page.
2. Follow the setup page: https://docs.ekka.ai/kits/wallet-agent/ (two test accounts in MetaMask, free test ETH from a faucet, install, sign in, start your Enclave, then ./open.sh).
3. Read the code first if you like: https://github.com/ekka-labs/kits/tree/main/wallet-agent

The kit is wallet-agent, version 3.0.1. You need EKKA 0.1.88 or later, a Mac, a Linux computer or a container, python3, and two test accounts. Give the everyday account a little more than 0.011 test ETH. The other account is for savings. Get test ETH from a Sepolia faucet. open.sh says what it will change and asks first.

Want to talk about the signature you would put behind this kind of permission in your own systems? Write to [email protected].