elizaos--eliza/plugins/plugin-tee

@elizaos/plugin-tee

Trusted Execution Environment (TEE) integration plugin for elizaOS. Adds secure key derivation and remote attestation to Eliza agents running inside a TEE.

What it does

• Remote attestation — a phala-remote-attestation provider that generates a TDX quote over the current message payload (Phala Network / dstack). This is a context provider, not an action; the plugin registers no actions (PhalaVendor.getActions() returns []).
• Key derivation — a phala-derive-key provider plus the TEEService: deterministically derives Ed25519 (Solana) and ECDSA (EVM) keypairs from a secret salt, with per-derivation attestation.
• TEEService — a runtime service (ServiceType.TEE) that other plugins can call to derive keys without going through providers.

This plugin exposes providers + a service only — no actions. An earlier revision of this README implied a REMOTE_ATTESTATION action; there is no such action. The attestation surface is the phala-remote-attestation provider above. The provider-neutral evidence/policy/key-release trust contract used by the agent boot path lives separately in packages/agent/src/services/tee-* (tee-evidence.ts + evaluateTeeEvidencePolicy), not in this plugin.

Quick start

import { teePlugin, TEEService } from "@elizaos/plugin-tee";

const runtime = new AgentRuntime({
  plugins: [teePlugin],
  // TEE_MODE defaults to LOCAL; set WALLET_SECRET_SALT for key derivation
});

// Access via service
const svc = runtime.getService<TEEService>(TEEService.serviceType);
const { keypair, attestation } = await svc.deriveEd25519Keypair("salt", "solana", agentId);
const { keypair: evmKeypair } = await svc.deriveEcdsaKeypair("salt", "evm", agentId);

Configuration

Variable	Required	Default	Description
TEE_MODE	no	LOCAL	Operation mode: LOCAL, DOCKER, or PRODUCTION. init defaults to LOCAL when unset and throws only on a present-but-invalid value.
WALLET_SECRET_SALT	yes	—	Secret salt used as the derivation path for all keypairs. Sensitive — treat as a private key.
TEE_VENDOR	no	PHALA	TEE vendor. Only PHALA is supported.

TEE modes

Mode	dstack endpoint	Use
LOCAL	http://localhost:8090	Local simulator
DOCKER	http://host.docker.internal:8090	Docker simulator
PRODUCTION	(TappdClient default)	Real TEE hardware

Run the Phala dstack simulator for LOCAL/DOCKER development: see Phala dstack docs.

Providers registered

Provider	Description
phala-derive-key	Derives Solana public key and EVM address from WALLET_SECRET_SALT; injects solana_public_key and evm_address into agent context.
phala-remote-attestation	Generates a TDX quote over the current message payload; injects quote and timestamp.

Both providers are dynamic and gated to secrets / agent_internal contexts.

TEEService API

class TEEService {
  static serviceType: ServiceType.TEE;

  // Derive Ed25519 keypair (Solana)
  deriveEd25519Keypair(path: string, subject: string, agentId: UUID):
    Promise<{ keypair: Keypair; attestation: RemoteAttestationQuote }>;

  // Derive ECDSA keypair (EVM)
  deriveEcdsaKeypair(path: string, subject: string, agentId: UUID):
    Promise<{ keypair: PrivateKeyAccount; attestation: RemoteAttestationQuote }>;

  // Derive raw key bytes
  rawDeriveKey(path: string, subject: string): Promise<DeriveKeyResponse>;
}

Enabling the plugin

Add @elizaos/plugin-tee to your agent character's plugins array and set the required environment variables. The plugin is opt-in and not auto-loaded.

Development

bun run --cwd plugins/plugin-tee build          # compile
bun run --cwd plugins/plugin-tee test           # run tests
bun run --cwd plugins/plugin-tee format:check   # lint