Agents use money and take actions under policies you set, so you never have to trust the operator with the key.
Agents can reason and recommend. Spending is where the trust question starts.
The agent's code runs on their server, the wallet key sits in their config, and the only record of what happened is their logs. If they're breached or dishonest, your agent's money is theirs, and you can't prove what it did.
The NEAR MPC network issues the key into an Intel TDX enclave. The agent asks for signatures and spends under a policy stored on-chain. The operator holds nothing to steal.
The wallet is the account. Connectors are what the agent can do with it.
Wallet keys are issued by the NEAR MPC network into an Intel TDX enclave. Your agent's code asks for a signature and gets one back, never the key.
A human sets the spending policy on-chain: limits, allowed addresses, approvals. The enclave checks it before every signature.
Approved actions with fixed shapes: pay, swap, trade. The agent gets buttons, not keys.
Every completed run returns an Intel TDX attestation over the code, its input, and its output.
The NEAR MPC network issues the root secret through confidential key derivation (CKD). It exists only inside an approved enclave.
The keystore boots inside an Intel TDX enclave and produces an attestation quote: Intel's signed proof of exactly which code is running.
A NEAR contract checks Intel's signature chain, refuses out-of-date hardware, and compares the build's five measurements with the approved list. Only then may this enclave request a key.
The enclave asks the NEAR MPC network for its secret through CKD. The request is a public NEAR transaction, so every issuance is visible on-chain.
The MPC nodes compute the answer from their threshold shares and encrypt it to a one-time key generated inside the enclave. Whoever relays it, OutLayer included, sees only ciphertext.
The enclave decrypts the root secret and checks it against the MPC network's public key. It never touches disk. After a restart the enclave attests again and receives the same secret.
NEAR, EVM and Solana keys are derived from that root inside the enclave. The agent's code gets signatures, never keys.
The result: there is no key for OutLayer to hand over, seize, or lose. A build that behaves differently needs a new on-chain approval that anyone can see. Want a root of your own? A vault issues one to your own NEAR contract, every derivation shows in your account's history, and you can take over your keys and leave at any time.
You set the policy. The agent spends within your rules. Private keys live inside the TEE and are re-derived on every operation — the agent never holds them and can never lose them.
Keys are derived inside the enclave from a root secret issued by the NEAR MPC network. The same wallet ID always produces the same addresses on NEAR, every EVM chain, and Solana. Stateless and deterministic — the TEE re-derives keys on every operation.
The agent never touches private keys. It asks the enclave for a signature, and the enclave signs after evaluating policy.
// Get derived address on any chain
let near_addr = wallet::get_address("near")?;
let eth_addr = wallet::get_address("ethereum")?;
// Transfer tokens
wallet::transfer("near", "bob.near", amount)?;
// Cross-chain swap via NEAR Intents
wallet::swap(
"nep141:wrap.near",
"nep141:usdc.near",
amount, ""
)?;
// Withdraw to Ethereum
wallet::withdraw(
"ethereum", "0xBob...",
"1000000", "erc20:USDC"
)?;Per-transaction, hourly, daily, and monthly caps across all tokens. Per-transaction caps are enforced inside the enclave.
Restrict which addresses the agent can send to. Whitelist or blacklist mode — enforced in hardware, not in application code.
Transactions above a threshold require 2-of-3 human approval via NEAR wallet signatures. TEE holds the transaction until the threshold is met.
Owner calls freeze_wallet() directly on-chain. Takes effect in seconds. No API, no coordinator — works even if infrastructure is compromised.
Each connector is a fixed set of actions that runs in the same enclave as the wallet, under limits the owner sets.
Mercury business account: pays approved vendors and sends invoices, within your per-payment and monthly limits.
Gmail and GitHub: sends email from your address to people you allowed, opens issues and pull requests, never merges unless you said so.
Hyperliquid and Polymarket: opens positions and places orders within your size, leverage and daily limits.
Most agent-wallet products help agents sign transactions, and the provider's own infrastructure holds the key.
OutLayer holds no key. The NEAR MPC network issues the root secret, and only enclave builds approved on-chain can receive it.
OutLayer also provides the protected environment where the agent's code runs and acts: the wallet, the policy and the connectors in one enclave.
The enclave code is open source and reproducible. Live on NEAR mainnet. Wallets on NEAR, EVM, and Solana. First applications running in production for House of Stake governance and price oracles.
Decentralized price feeds from 7 exchanges. Scheduler monitors deviations, triggers TEE agent to fetch, aggregate, and publish. Prices readable by any agent via cross-project public storage.
Blockchain-native email for NEAR accounts. alice.near becomes [email protected]. ECIES encryption, MPC key derivation, TEE-protected server. Operators cannot read your mail.
Confidential token transfers where balances live in TEE-encrypted storage. The smart contract sees only encrypted state. Users prove ownership via wallet signatures.
Anonymous voting where individual votes are hidden but the tally is verifiable. Votes collected in TEE-encrypted storage, access-gated by DAO membership. Only the result is published.
Run OpenAI, Claude, or local models inside TEE. Return attestation-backed AI results to smart contracts or HTTPS clients. Hardware proof that the model output wasn't tampered with.
TEE-generated VRF for games, lotteries, NFT minting. Ed25519 signature proof verifiable by any NEAR smart contract. Anti-grinding by design.
https://skills.outlayer.ai/outlayer/SKILL.md
Paste it into your agent's chat: Claude, Cursor or your own agent
# Install
curl -fsSL https://raw.githubusercontent.com/out-layer/outlayer-cli/main/install.sh \
| sh
# Log in with your NEAR account
outlayer login
# Create your first agent (edit src/main.rs)
outlayer create my-agent && cd my-agent
# Build, upload the .wasm, deploy it
./build.sh
outlayer upload out/my-agent.wasm
outlayer deploy my-agent <URL printed by upload>
# Create a payment key, then run
outlayer keys create
outlayer run alice.near/my-agent '{"command": "hello"}'Open-source enclave code. Live on mainnet. Keys issued by the NEAR MPC network, policies on-chain, connectors for real actions, and a proof of every completed run.