@usenami/plugin-signer

ElizaOS plugin: place / cancel CEX & DEX perp orders, read account state, and verify the running Nitro Enclave attestation — the venue API key never enters the agent process.

This is the public source mirror of @usenami/plugin-signer, the ElizaOS plugin for the Usenami Signer. It's a thin client over the public Signer gateway — the same HTTP contract as the @usenami/signer-mcp MCP server, so a token issued for one works with the other.

Why

If your ElizaOS agent trades on a CEX today, the API key sits in agent memory or a .env the agent process can read. Compromise the agent — prompt injection, a poisoned dependency, a stray log line — and the key leaks.

Usenami Signer keeps the key inside an AWS Nitro Enclave. HMAC and EIP-712 signatures are computed inside attested code; the plugin asks the gateway for a signed venue request, submits it, and reads the response. The key is never on disk, never in agent-addressable memory, and the running code is provable via the enclave's PCR0 measurement.

Install

npm install @usenami/plugin-signer

Quickstart

Access is invite-based during the pilot — there is no self-serve signup; request access via usenami.io/signer and your token is provisioned at onboarding. No token yet? LIST_SIGNER_VENUES and GET_SIGNER_ATTESTATION work without one.

Add the plugin to your character and point it at the Signer:

import signerPlugin from "@usenami/plugin-signer";

export const character = {
  // ...existing config
  plugins: [signerPlugin],
  settings: {
    secrets: {
      SIGNER_GATEWAY_URL: "https://signer-demo.usenami.io:8443",
      SIGNER_API_TOKEN: "your-token-provisioned-at-onboarding",
    },
  },
};

SIGNER_GATEWAY_URL defaults to https://signer-demo.usenami.io:8443 (the hosted attested demo enclave) — override it only for self-hosted deployments. For local dev you can also put the same vars in .env.

Actions the agent gets

Name	Auth	Purpose
GET_SIGNER_ATTESTATION	none	Fetch the running enclave's PCR0 + registered_onchain flag — the trust receipt.
LIST_SIGNER_VENUES	none	Static manifest of supported venues (7 entries with live/denied status) + auth schemes.
GET_SIGNER_ACCOUNT	token	Equity / free margin / positions for a venue (read-only signed request).
PLACE_SIGNER_ORDER	token	Single market or limit order. Enclave enforces per-asset signature caps.
CANCEL_SIGNER_ORDER	token	Cancel by order_id (+ symbol for binance / okx routes).

A provider, SIGNER_ATTESTATION_PROVIDER, surfaces a one-line [signer] PCR0=… on-chain=… snippet to the agent's context every turn (60-second cache), so the agent can always answer "what code is signing my orders?".

Supported venues (7)

LIST_SIGNER_VENUES returns these — read-only, no gateway call. Every entry carries a status: live (the enclave will sign, given a provisioned key) or denied (the enclave refuses by policy — credentials will not change it).

venue id	status	asset class	auth scheme	symbol example
binance	live	perp	hmac_sha256	BTCUSDT — ⚠️ mainnet, real funds in the hosted deployment
okx	live	perp	hmac_sha256	BTC-USDT-SWAP — signs only where an OKX key is provisioned (hosted deployment: none today)
asterdex	live	perp	eip712 (bsc)	BTC-USD
kucoin	live	perp	hmac_sha256	XBTUSDTM
bybit	live	perp	hmac_sha256	BTCUSDT
hyperliquid_testnet	live	perp	eip712 (hyperliquid)	BTC — the Hyperliquid path that actually signs
hyperliquid_main	denied	perp	eip712 (hyperliquid)	BTC — denied inside the enclave

Which venues a given token may trade is bound server-side to that token's policy; LIST_SIGNER_VENUES reports the full set the gateway can sign.

Security model

• Keys never leave the enclave. Generated and used inside an AWS Nitro Enclave; there is no exportable form.
• Attestation. GET_SIGNER_ATTESTATION returns the enclave's PCR0 (the AWS-signed measurement of the running code) plus an on-chain registration flag. Verify PCR0 against the published build at usenami.io/signer/attestations and the on-chain registry at 0x38b42eED740b0fDeb211bBDf773F2238cAEec240 on Base mainnet.
• KMS envelope. The encrypted key material is bound by a KMS policy to that exact attested PCR0 — only the attested enclave can decrypt it.
• Policy caps. Every signature is bounded by a per-token policy (per-asset / per-venue caps) enforced inside the enclave before signing. A compromised agent can at worst place orders inside your policy window.

Links

• Landing: usenami.io/signer
• npm: @usenami/plugin-signer
• MCP server (Claude Desktop / Cursor): @usenami/signer-mcp

Source of truth

This repo is an allowlisted mirror of the plugin developed in the Usenami monorepo. File issues here; releases are published to npm from the monorepo CI.

License

MIT — see LICENSE.