# sanctuary

Guards agent keys with local encryption, records tool calls in a hash-chained log, and blocks unauthorized outbound network traffic.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 9
- Author: eriknewton
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/eriknewton/sanctuary-framework
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/sanctuary

## What it does

Sanctuary controls outbound traffic at the operating system layer rather than relying on the model to govern itself. It secures local secrets using Argon2id key derivation along with Ed25519 identity keys. Passphrases stay inside the native macOS Keychain or Linux Secret Service daemon. Incoming tool executions must pass signed policy checkpoints organized into three operator approval tiers.

Runtime requirements start at Node.js 22.0.0 and npm 10.0.0. The package does not provide a process or filesystem sandbox, leaving that layer to the harness runner. Network enforcement does not work on Windows yet, while Linux support is verified exclusively on x86-64 Ubuntu 24.04 via the external Castle Wall package.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add sanctuary -- npx -y @sanctuary-framework/mcp-server
```

### Codex

**Platform CLI**
```bash
codex mcp add sanctuary -- npx -y @sanctuary-framework/mcp-server
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "sanctuary": {
            "command": "npx",
            "args": [
                "-y",
                "@sanctuary-framework/mcp-server"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "sanctuary": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@sanctuary-framework/mcp-server"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add sanctuary npx -y @sanctuary-framework/mcp-server
```

## When to use it
- Block unauthorized outbound agent traffic beneath the runtime
- Store identity credentials locally using Argon2id encryption
- Record agent tool executions in an append-only audit chain
- Require manual operator sign-off on sensitive operations

## Example prompts
- Verify the integrity of the audit log chain through sanctuary.
- Ask the operator for approval before triggering tier-three actions.
- Export the local encrypted state and identity archive.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md