Nukez

§ docs · nukezagent

Nukez Agent

zero keys held

§ signing bridge · architecture

The hosted agent never holds your key.

Envelopes are constructed by NukezAgent on your behalf, but signed by your hardware / passkey / wallet client. The flat $500/mo hosted service never touches a private key.

  ┌──────────────┐    1. intent     ┌──────────────┐
  │ Your client  │  ──────────────▶ │ NukezAgent   │
  │  (app/CLI)   │                  │  (Sonnet +   │
  └──────▲───────┘                  │   Monty)     │
         │ 3. sign envelope         └──────┬───────┘
         │                                  │
         │ 2. envelope-to-sign              │ 4. submit signed envelope
         │◀─────────────────────────────────┘
         │                                  │
         │ 5. receipt + bundle              │
  ┌──────┴───────┐                  ┌──────▼───────┐
  │ Passkey /    │                  │ Nukez        │
  │ wallet       │                  │ gateway      │
  └──────────────┘                  └──────────────┘

  Algorithms: ed25519 OR secp256k1 — equal. Your key, your choice.

The hosted agent serialises the envelope, returns it to your client for signing, and then submits the signed envelope back to the gateway. The agent never sees a key, and a customer revoking access requires no service-side coordination.