Sanctuary is the open source standard for secure, private AI: operating-system enforcement is live on macOS today; Linux and Windows are not live enforcement yet, and your data stays under your own keys with current portability bounds called out in the Assurance Matrix. Any agent, local or cloud, solo or fleet. One command to get started. One dashboard to secure them all.
$ npx @sanctuary-framework/mcp-server
Sanctuary runs on your hardware with your keys. Policy-gated calls route through local approval surfaces, and Castle Wall enforcement follows the platform bounds in the Assurance Matrix. Point any MCP-compatible agent at it and the cooperative substrate is live.
On macOS today, the Castle Wall blocks unauthorized outbound calls at the operating system. A prompt-injected agent cannot route around that path within the proven scope because the kernel itself enforces. Live on macOS: the wall enforces a signed operator policy, with a clean per-account allow/deny demonstration and 5/5 attended reboot survival behind the claim. On Linux the nftables, cgroup, and NFQUEUE modules are tested against a real kernel, DNS, DoH, DoT and raw sockets included, and the shipped daemon does not install that path yet, so Linux is source coverage today rather than live enforcement.
Ed25519 identity generated locally. AES-256-GCM on every write. Keys never leave the box and never appear in any MCP response, log, or error.
Dark-theme web UI on 127.0.0.1:3501. Approve and deny
buttons, audit viewer. Optional TLS and webhook channels for
headless setups.
Five layers, each with a distinct contract. Operating-system enforcement is live on macOS today; Linux and Windows are not live enforcement yet, observation inside, an encrypted state surface for compliant agents, receipts and reputation across vendors, and an install-time substrate that binds it all to the operator. The layers compose. None of them substitute for another.
Operating-system-level egress filtering. Network Extension on macOS, where Phase 1 is proven on a signed and notarized build. On Linux the nftables, cgroup v2, and NFQUEUE modules carry plain-DNS, DoH, DoT, and raw-socket bypass coverage against real kernel bindings, and the shipped daemon does not install that path yet.
Internal behavioral observation. Cross-platform auditd-tail, plus an eBPF watcher scaffold on Linux that currently falls back to stub mode because the real probe loader is not implemented. Seven sentinels watching for prompt-injection signatures, anomalous tool sequences, and policy drift. The sentinels surface; the operator decides.
Encrypted state, hash-chained audit, mandate primitives, canonical policy slots, and substrate selector. Production audit checkpoints are currently unsigned until IC-05 closes. Compliant agents that voluntarily route through Sanctuary get the full surface. On macOS with the wall installed and armed, non-compliant agents still hit the wall and the Sentinels.
Cryptographic receipts on cross-castle transactions, portable reputation that survives vendor churn. Concordia structures negotiation and commitments; Verascore prices the reputation. Operators carry the trust record across vendors.
Install-time substrate-binding to the operator. The Mantle gives the rest of the castle a verifiable anchor on the operator's machine before the agent runs. Template init rejects orphan agent identifiers that are not bound to a wrapped harness.
Sanctuary speaks standard MCP. No forks, no adapters, no special case for your stack. Point your harness at the server and every tool in the custody stack becomes available to your agent immediately.
// .mcp.json
"mcpServers": {
"sanctuary": {
"command": "npx",
"args": ["-y", "@sanctuary-framework/mcp-server"]
}
}# ~/.openclaw/mcp.yaml
servers:
sanctuary:
type: stdio
command: npx
args: ["-y", "-p", "@sanctuary-framework/mcp-server",
"sanctuary-mcp-server"]# crewai native mcps field
agent = Agent(
role="analyst",
mcps=["sanctuary"],
tools=[],
)# langchain-mcp-adapters
from langchain_mcp import MCPTool
sanctuary = MCPTool.from_stdio(
"npx", ["-y", "@sanctuary-framework/mcp-server"],
)Three commands. A local vault, a self-custodied identity, and a running approval dashboard before your coffee cools.
One npx command. No global install, no build step, no config file required.
$ npx @sanctuary-framework/mcp-serverAdd Sanctuary as an MCP server in your harness config. No agent code changes.
$ claude mcp add sanctuary -- npx -y @sanctuary-framework/mcp-serverApprove sensitive operations at the local dashboard URL.
$ open http://127.0.0.1:3501Design decisions, security write-ups, and the reasoning behind the architecture.
Microsoft's CEO says data location was never the point. He's right. The test for AI security is custody: who holds the keys, what enforces the deny, and who can edit the record. Three questions, and the drill evidence behind ours.
Read the postWhy I left a startup four years ago, why I waited, and why one morning in February I leapt out of bed and started coding. The Castle Architecture is the iteration that finally got the framing right.
Read the postCooperative gates do not stop a prompt-injected agent. Kernel-level enforcement does on macOS within the proven scope. Current correction: Linux Phase 1 source modules are tested against a real kernel binding, and the shipped daemon does not assemble live enforcement.
Read the postOpen source and local-first. Castle Wall enforcement is proven on macOS; Linux is not_implemented in the Assurance Matrix. Telemetry-free and blockchain-free.