Sanctuary is a firewall for your AI agent that runs on your own Mac. It enforces what the agent is allowed to reach at the operating-system level, with keys only you hold, so a prompt-injected or jailbroken agent cannot route around it or shut it off. The enforcement lives below the agent, inside the operating system itself.
Live today on macOS. Linux and Windows coming soon.
$ npx @sanctuary-framework/mcp-server
Sanctuary runs on your hardware with your keys. Policy-gated calls route through local approval surfaces, and Castle Wall enforcement follows the platform bounds in the Assurance Matrix. Point a supported MCP-compatible agent at it, and the cooperative substrate is live.
On macOS today, the Castle Wall blocks unauthorized outbound calls at the operating system. A prompt-injected agent cannot route around that path within the proven scope because the kernel itself enforces. It enforces a signed operator policy, per account, and re-establishes itself after a restart. On Linux the nftables, cgroup, and NFQUEUE modules are tested against a real kernel, DNS, DoH, DoT and raw sockets included, and the shipped daemon does not install that path yet, so Linux is source coverage today rather than live enforcement.
Ed25519 identity generated locally. AES-256-GCM on every write. Keys never leave the box and never appear in any MCP response, log, or error.
Dark-theme web UI on 127.0.0.1:3501. Approve and deny
buttons, audit viewer. Optional TLS and webhook channels for
headless setups.
Four layers, each with a distinct contract: operating-system egress enforcement (live on macOS today, with Linux and Windows coming soon), behavioral observation inside the box, an encrypted state surface for cooperative agents, and receipts and reputation that travel across vendors. Underneath them, an install-time mechanism called Mantle binds all four to your machine. The layers compose, and none of them substitutes for another.
Operating-system-level egress filtering. Network Extension on macOS, where Phase 1 is proven on a signed and notarized build. On Linux the nftables, cgroup v2, and NFQUEUE modules carry plain-DNS, DoH, DoT, and raw-socket bypass coverage against real kernel bindings, and the shipped daemon does not install that path yet.
Internal behavioral observation. Cross-platform auditd-tail, plus an eBPF watcher scaffold on Linux that currently falls back to stub mode because the real probe loader is not implemented. Seven sentinels watching for prompt-injection signatures, anomalous tool sequences, and policy drift. The sentinels surface; the operator decides.
Encrypted state, hash-chained audit, mandate primitives, canonical policy slots, and substrate selector. Production audit checkpoints are currently unsigned until IC-05 closes. Compliant agents that voluntarily route through Sanctuary get the full surface. On macOS with the wall installed and armed, non-compliant agents still hit the wall and the Sentinels.
Cryptographic receipts on cross-castle transactions, portable reputation that survives vendor churn. Concordia structures negotiation and commitments; Verascore prices the reputation. Operators carry the trust record across vendors.
Install-time substrate-binding to the operator. The Mantle gives the rest of the castle a verifiable anchor on the operator's machine before the agent runs. Template init rejects orphan agent identifiers that are not bound to a wrapped harness.
Sanctuary speaks standard MCP. No forks, no adapters, no special case for your stack. Point your harness at the server and every tool in the custody stack becomes available to your agent immediately.
// .mcp.json
"mcpServers": {
"sanctuary": {
"command": "npx",
"args": ["-y", "@sanctuary-framework/mcp-server"]
}
}# ~/.openclaw/mcp.yaml
servers:
sanctuary:
type: stdio
command: npx
args: ["-y", "-p", "@sanctuary-framework/mcp-server",
"sanctuary-mcp-server"]# crewai native mcps field
agent = Agent(
role="analyst",
mcps=["sanctuary"],
tools=[],
)# langchain-mcp-adapters
from langchain_mcp import MCPTool
sanctuary = MCPTool.from_stdio(
"npx", ["-y", "@sanctuary-framework/mcp-server"],
)Three commands. A local vault, a self-custodied identity, and a running approval dashboard before your coffee cools.
One npx command. No global install, no build step, no config file required.
$ npx @sanctuary-framework/mcp-serverAdd Sanctuary as an MCP server in your harness config. No agent code changes.
$ claude mcp add sanctuary -- npx -y @sanctuary-framework/mcp-serverApprove sensitive operations at the local dashboard URL.
$ open http://127.0.0.1:3501Design decisions, security write-ups, and the reasoning behind the architecture.
Microsoft's CEO says data location was never the point. He's right. The test for AI security is custody: who holds the keys, what enforces the deny, and who can edit the record. Three questions, and the drill evidence behind ours.
Read the postWhy I left a startup four years ago, why I waited, and why one morning in February I leapt out of bed and started coding. The Castle Architecture is the iteration that finally got the framing right.
Read the postCooperative gates do not stop a prompt-injected agent. Kernel-level enforcement does on macOS within the proven scope. Current correction: Linux Phase 1 source modules are tested against a real kernel binding, and the shipped daemon does not assemble live enforcement.
Read the postOpen source and local-first. Castle Wall enforcement is proven on macOS; Linux is not_implemented in the Assurance Matrix. Telemetry-free and blockchain-free.