AI Studio

An agent action with a verifiable trail.

Hedera AI Studio is an open-source toolkit for AI agents that need to pay, settle or leave a checkable record on Hedera, with the Hedera Agent Kit at its centre. ColdAI builds these systems so that the model only ever proposes an action: a separate policy layer decides whether it is allowed, and a signing service the model cannot reach applies the key. Below: the toolkit, that split, and how an engagement runs.

Discuss your project Explore the approach

From architecture to integration to operation

The opportunity

Start with a decision
worth improving.

An agent prepares a small transaction or records a task result. The system needs to verify the action and spending boundary before granting a signature, then return a receipt that another system can check.

From possibility to a working system

Follow the flow.

Three connected decisions. One considered architecture.

Conceptual flow, not a live system or measured result.

Identify the ledger action

Choose the transaction or evidence event that benefits from network verification. Define the agent's task and which action parameters it may propose rather than directly authorize.

Agent taskIntentParametersBoundary

Enforce the signing policy

Connect tools through explicit validation and scoped authority. Keep credentials outside model context and apply approval or spending controls before submitting a transaction.

ToolPolicyApprovalSignature

Return the evidence

Capture the network result and reconcile it with the task state. Make failed, duplicate or uncertain actions visible so the agent and operator can choose the correct next step.

TransactionReceiptTask stateReview

The work, made concrete

What we can build
with your team.

We agree scope, dependencies and acceptance criteria before delivery. Your project can start with an assessment, a pilot or an integration into an existing system.

Agent-to-ledger workflow design

Clarify the system boundary, the responsible owners and the decisions the architecture needs to support.

Validated tools and signing controls

Turn the agreed design into reviewable work, evaluated against representative inputs and explicit success criteria.

Receipt and task-state integration

Make the next step operable: document responsibilities, known limitations and the path from pilot to ongoing use.

Explore the practice

Further capabilities
and implementation detail.

What AI Studio is

Hedera AI Studio is the toolkit for AI agents that transact, settle, and remember on Hedera. Built around the Hedera Agent Kit, it integrates with mainstream agent frameworks so autonomous systems can pay each other in HTS tokens, anchor their decisions and memory to HCS, and operate under verifiable identities. For enterprises, that turns AI agents from opaque chatbots into auditable economic actors.

ColdAI's AI Studio service

Agent commerce design

Design agent-to-agent and agent-to-human commerce flows — pricing, settlement, escrow, dispute, and refund — using HTS and HSCS.

Verifiable agent receipts

Anchor agent inputs, tool calls, outputs, and policy decisions to HCS so every action has a tamper-evident audit trail.

Identity-bound agents

Bind agents to decentralised identifiers (DIDs) and verifiable credentials so customers know which agent acted, on whose behalf, and under what authority.

Framework integration

Integrate Hedera Agent Kit with LangChain, MCP servers, and other agent frameworks already in your stack.

What we build with AI Studio

AI-agent commerce and machine-to-machine payments
Autonomous procurement and supplier-side agents
Verifiable AI decisions for regulated workflows
Agent-led customer operations with audit trails
AI-driven treasury and operations agents

Make your AI agents accountable on Hedera

Engage ColdAI to ship AI-agent commerce and verifiable agent telemetry using Hedera AI Studio.

Contact our Hedera team

In depth

Go deeper: authority and evidence for transacting agents

Two working references for taking an agent from demo to production: bounding what it can sign and spend, and what each action record should hold.

The parts of AI Studio a delivery team actually touches

Hedera introduced AI Studio in May 2025 as open-source components for building AI agents on its network¹. These pieces shape an architecture.

Hedera Agent Kit: A JavaScript SDK that exposes Hedera operations as tools an agent can call: HBAR transfers, topic creation and messages, token creation and airdrops, plus query tools for accounts, tokens, topics and transactions. It ships adapters for LangChain, the Vercel AI SDK, ElizaOS, the Model Context Protocol and Google's Agent Development Kit².
Execution mode: The Agent Kit setting that decides who signs. Autonomous mode signs and submits with the operator key configured on the client; return-bytes mode hands back unsigned transaction bytes for a wallet or person to sign; two custom modes pass signing or assembly to a strategy you supply, such as a KMS, an MPC service or an approval console².
Plugins: Groups of tools loaded into the kit: core plugins for accounts, consensus topics and tokens, plus query plugins that read network data². Loading only what a task needs is the cheapest limit on what an agent can attempt.
Hedera MCP server: A Model Context Protocol server through which MCP-capable clients, such as assistants and coding tools, can call Hedera tools and data¹.
OpenConvAI (HCS-10): A protocol for agents to discover one another and exchange messages over Hedera Consensus Service topics, so conversations between agents have an ordered, tamper-evident record¹.
Receipt: What the network returns once a transaction reaches consensus: its status and, for a topic message, the topic's updated sequence number and running hash³. A mirror node lets anyone look the same transaction up later.

How one agent action travels from intent to receipt

The happy path for one value-moving action. Every arrow is a point where the request can be refused.

Task owner
The person or system that assigns work and receives the result with its evidence.
Agent and model
Plans the work and drafts a typed intent; it holds no keys.
Policy service
Deterministic code that checks payee, token, amount and frequency against agreed limits.
Signing service
Holds keys in a KMS, HSM or custodian and signs only approved requests.
Hedera network
Reaches consensus on the transaction and returns a receipt.
Task store
Keeps the task state, transaction ID and receipt together.

Task owner to Agent and modelGoal and context
Agent and model to Policy serviceTyped intent
Policy service to Signing serviceApproved parameters
Signing service to Hedera networkSigned transaction
Hedera network to Signing serviceReceipt
Signing service to Task storeReceipt and tx ID
Task store to Agent and modelUpdated task state
Task store to Task ownerResult with evidence

Conceptual sequence of one agent transaction. The model never touches the key; production systems add retries, timeouts and human approval for higher-risk actions.

Why ColdAI keeps model intent and signing authority apart

A language model's output is a suggestion shaped by everything in its context, including text an attacker may have planted in a web page, an email or another agent's message. If the process that reads that text can also sign, a successful prompt injection becomes a payment. Our designs therefore treat the model as the party that drafts an intent and never as the party that authorises it.

In practice the agent calls narrow tools that accept structured parameters, such as a payee identifier from an approved list and an amount in a stated unit, rather than free-form transaction bodies. A policy service, written as ordinary deterministic code with tests, checks those parameters against limits the business has agreed. Only then does a signing service produce a signature with a key the model cannot address. The full pattern, with account design, limits and kill switches, is set out in signing and spending controls for agents.

The split also pays off when someone later asks what happened. Every approved action passes through one policy point, which can record what was asked, what was allowed and what the network returned. Anchoring digests of those records on Hedera Consensus Service lets other parties check them; what each agent action record should contain is a design task of its own.

Agent Kit, MCP server or your own SDK tools

There is more than one way to give an agent access to Hedera. The right route depends on who builds the agent and how tightly each tool must be specified.

Criterion	Agent Kit in your agent framework	Hedera MCP server	Your own tools on the Hedera SDK
Best fit	Teams building their own agent in LangChain, the Vercel AI SDK, ElizaOS or a similar framework	Assistants and coding tools that already speak MCP and need ledger access quickly	Regulated workflows where every tool, parameter and error path must be specified in-house
Tool surface	Prebuilt tools grouped into plugins; load only those the task needs	Whatever the server exposes; restrict it through server configuration	Exactly the operations you write, with typed inputs
Signing options	Execution modes, including returning unsigned bytes or delegating to a custom strategy	Depends on how keys are configured; treat a server holding a funded operator key as high risk	Any custody design, including HSM, KMS or a third-party custodian
Typical mistake	Loading broad plugins in autonomous mode with a well-funded operator account	Exposing write tools to a general-purpose assistant with no approval step	Re-implementing behaviour the kit already handles and missing its edge cases

Many production designs combine routes: kit query tools for reading, and policy-wrapped custom tools for anything that moves value.

When an agent workflow needs a ledger at all

A ledger is worth its design cost only where it changes who has to be trusted.

If
The agent must pay, or be paid by, parties outside your organisation in HBAR or a token they already hold.
Then
Use Hedera Token Service or HBAR transfers from a dedicated agent account, with allowances or limited balances instead of treasury keys.
Settlement and its record happen in one step, without reconciling two private ledgers afterwards.
If
Several organisations need to rely on what an agent did, but none should host the others' logs.
Then
Keep full records privately and anchor their digests to a consensus topic every party can read.
Ordering and tamper evidence then come from the network rather than from one party's database.
If
Only your own team will read the records and nobody outside disputes them.
Then
Use an append-only store with access controls and independent backups instead.
A ledger earns its place when someone outside your control needs to check the record.
If
The action is large, irreversible or administrative, such as changing keys or minting supply.
Then
Have the agent return unsigned bytes, or create a scheduled transaction, so that a person adds the deciding signature.
Human approval belongs exactly where a mistake would be expensive to undo.
If
Agents run by different organisations negotiate or hand work to each other.
Then
Consider HCS-10 for discovery and messaging, with each payment referencing the message that agreed its terms.
Both sides then hold the same ordered record of what was agreed before value moved.

How a ColdAI AI Studio engagement is sequenced

Authority and limits are designed before any tool is connected, never retrofitted afterwards.

Choose the ledger action
Name the one transaction or evidence event that benefits from network verification, the task around it and the parameters the agent may propose.
Output
Action specification
Owner
Business owner with ColdAI
Design custody and authority
Decide where keys live, which accounts the agent may use, what limits apply and which actions need a human co-signature. Security, risk and treasury sign this off before build starts.
Output
Authority and custody design
Owner
Security, risk and treasury
Build validated tools
Wrap Agent Kit or SDK operations in tools with typed inputs and a policy check, loading only the plugins the task needs.
Output
Tool set with policy tests
Owner
Engineering
Wire receipts into task state
Store each transaction ID and receipt against its task, and surface failed, duplicate or uncertain submissions so neither the agent nor an operator retries blindly.
Output
Receipt and task-state integration
Owner
Engineering
Attack it on testnet
Run the agent on Hedera testnet against poisoned inputs, contradictory instructions and looping tasks, and confirm the policy layer refuses what it should.
Output
Adversarial test report
Owner
Engineering and security
Release with monitoring
Move to mainnet with low limits, mirror-node alerts on agent accounts and a rehearsed way to stop the agent, then raise limits only on evidence from operation.
Output
Production runbook
Owner
Operations

Frequently asked questions

How does Hedera AI Studio relate to the Hedera Agent Kit?

AI Studio is Hedera's name for its open-source AI tooling, and the Agent Kit is the part most teams build with. The announcement also lists an MCP server and the OpenConvAI (HCS-10) protocol for messaging between agents¹. Most projects start with the Agent Kit, its plugins and an execution mode; the other components matter when you work with MCP clients or with agents run by other organisations.

Which agent frameworks and models work with the Agent Kit?

The kit ships adapters for LangChain, the Vercel AI SDK, ElizaOS, the Model Context Protocol and Google's Agent Development Kit². The model is chosen in the framework, not the kit, so a hosted model or one in your own environment can work if the framework supports tool calling with it. Test tool-calling reliability early: weak tool use shows up as malformed or repeated transactions.

Does each agent need its own Hedera account and HBAR?

Every transaction has a payer account that covers network fees in HBAR, so some account must hold HBAR. We usually give each agent, or each agent role, a dedicated account with a small balance or an allowance from a treasury account, instead of letting it use a corporate operator account. Spending then stays visible per agent, and a compromised agent can move only what its own account or allowance permits.

Can AI agents from different companies transact with each other on Hedera?

Yes, provided each side controls its own accounts and keys. The payment is an ordinary token or HBAR transfer; what needs design is how the two agents agree terms first and how each side records that agreement. HCS-10 offers a shared messaging pattern for the first part, and each organisation should still anchor its own records so that neither depends on the other's logs in a dispute.

Is it safe to let an agent sign transactions with no person approving them?

It can be, for narrow, low-value actions with hard limits enforced outside the model, such as paying a known supplier for metered usage within a budget. It is not appropriate for key changes, minting, large transfers or first payments to a new counterparty. We set that line per action type with your risk team and widen autonomy only after monitored operation shows the limits hold.

What does ColdAI deliver in an AI Studio project?

Usually three things: a design for how the agent's workflow reaches the ledger, a set of validated tools with signing controls, and integration of receipts with your task state so failures and duplicates are visible. Before starting we ask for a bounded agent task, a view on custody and authorisation, and agreed transaction and budget limits. The work can sit within wider Hedera practice delivery when other Hedera services are involved.

Sources

Introducing Hedera AI Studio — Hedera
Hedera Agent Kit (JavaScript) repository and README — Hashgraph on GitHub
Submit a message to a topic — Hedera documentation

Connect the architecture

The next connection.

Explore the complementary capabilities that can turn an individual technology into a complete workflow.

Strategy & architecture Custom development Ongoing operations Technical reference

Your next move

Bring us the
real problem.

A workflow that takes too long. A system that cannot connect. An idea that needs a technical path. Start there, and we can define what to investigate, build and measure.

A bounded agent task
A custody and authorization design
Defined transaction and budget limits

See how we approach delivery