Sanction

Name: Sanction
Author: ericlovold

by ericlovoldversion 0.10.0i★ –iComputer or cloud

Registry nameio.github.ericlovold/sanction

Install

Overview

Description from the maker (original English)

Approval and budget checks before agent spending or tool use. Cooperative MCP; host must ask.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Computer or cloud
Transport: stdio, Streamable HTTP
Category: Other
You need to fill in: SANCTION_API_KEY, x-api-key

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
You fill in yourself: SANCTION_API_KEY, SANCTION_WALLET_ID, SANCTION_API_URL, x-api-key

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

Runs in the cloudNothing to install; it connects over the internet
npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "sanction": {
      "command": "npx",
      "args": [
        "-y",
        "sanction-mcp"
      ],
      "env": {
        "SANCTION_API_KEY": "your-value",
        "SANCTION_WALLET_ID": "your-value",
        "SANCTION_API_URL": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add --transport http sanction https://getsanction.com/mcp --header 'x-api-key: your-value'

Or run it on your computer

claude mcp add sanction --env SANCTION_API_KEY=your-value --env SANCTION_WALLET_ID=your-value --env SANCTION_API_URL=your-value -- npx -y sanction-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "sanction": {
      "url": "https://getsanction.com/mcp",
      "headers": {
        "x-api-key": "your-value"
      }
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "sanction": {
      "command": "npx",
      "args": [
        "-y",
        "sanction-mcp"
      ],
      "env": {
        "SANCTION_API_KEY": "your-value",
        "SANCTION_WALLET_ID": "your-value",
        "SANCTION_API_URL": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "sanction": {
      "type": "http",
      "url": "https://getsanction.com/mcp",
      "headers": {
        "x-api-key": "your-value"
      }
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "sanction": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "sanction-mcp"
      ],
      "env": {
        "SANCTION_API_KEY": "your-value",
        "SANCTION_WALLET_ID": "your-value",
        "SANCTION_API_URL": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This address needs a key in a request header, which the add-connector menu cannot set. Use Claude Code, Cursor or VS Code instead.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

SANCTION_API_KEY secret required env
Agent API key (pxy_...). Create one at https://getsanction.com or via POST /api/v1/wallets then POST /api/v1/agents.
SANCTION_WALLET_ID env
Optional override for sanction_wallet_status; by default the wallet derives from the agent key.
SANCTION_API_URL env
Sanction API base URL.
x-api-key secret required HTTP header
Sanction agent key (pxy_...). Store in the host secret configuration, never in chat.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account ericlovold, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Otheri

More stars than 0% of the other 32568 servers in this category
Published to the registry more recently than 53% of the other 32568 servers in this category
Basic checks equal to or better than 100% of the other 32568 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Sanction safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: SANCTION_API_KEY, x-api-key

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.10.0) reached the registry 35 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, FlyDocs

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday

Install

FlyDocs

by flydocs.ai

Spec-driven development workflow: your agent works issues, sessions and the status lifecycle.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Sanction

The independent authorization plane for AI agents.

Before an agent spends money, invokes a tool, touches a credential, or provisions a resource, it asks Sanction. Sanction approves, escalates to a human, or denies. Every decision is logged and auditable. Sanction belongs to no platform: one policy engine answers across model providers, payment rails, identities, and agent ecosystems.

Need one human approval?

Connect Sanction to your agent, then ask it to call sanction_authorize_tool with require_approval: true and the exact proposed action. Approve or deny through the existing approval link or configured Slack channel. Approval gives that request an expiring, single-use grant; the agent must redeem it before acting. No policy edit is required, and blocked actions stay blocked.

Individuals can use Sanction free, without a card. The host must ask and honor the decision; connection alone does not enforce its other tools. Choose your host and try one approval.

Who runs Sanction

Organizations governing their own AI — the primary case. Teams and departments become wallets in a tree; budgets, tool rules, and approval bands are enforced — not dashboarded — with chargeback-ready reporting underneath. Alerts tell you what happened; a decision happens first.
Platforms and agencies embedding governance — agents you ship or run for clients carry a wallet wherever they execute: MCP hosts, Bedrock, your own stack via SDK or REST.
Individuals — free, no card, personal and production use.

What it does

One policy decision engine governs every kind of agent action:

Governed action	What Sanction enforces
Spend (`/authorize`)	Auto-approve floor, human-escalation band, per-transaction hard cap, daily and monthly budgets — checked and debited atomically.
Tools (`/authorize/tool`)	Block/allow/escalate lists for any MCP tool or external action. Escalations reach the approval inbox like spend does.
Credentials (`/exec` + `/mandate/verify` + `/credentials/inject`)	AES-256-GCM envelope-encrypted vault (KMS-wrapped, rotating keys). Injection requires a scoped 15-minute mandate JWT and clearance ≥ the credential's bar. Counterparties verify the mandate with no API key. Every access audit-logged.
Provisioning (`/authorize/provision`)	Seats, licenses, infrastructure — resource, line item, quantity, and dollars authorized in one call.
Capability (`/authorize/capability`)	Skills, plugins, new APIs — acquiring capability is governed like spending money. One ordered rule list (block / allow / escalate, prefix-glob patterns) gates new power before it lands in an agent.

What a decision looks like in practice — one POST /authorize with an amount, three possible outcomes, all of them terminal or resumable:

Approved → { "status": "approved" }; budget counters debit in the same transaction the decision persists (an advisory lock makes sibling agents queue, not race).
Escalated → { "status": "escalated", "request_id": "…" }; a human sees it in the approval inbox, and approving mints a one-use grant the agent redeems by retrying with grant_id. Policy decides what a timeout means (approve or deny) — nothing hangs forever.
Denied → { "status": "denied", "decision_code": "PER_TXN_LIMIT", "remediation": "Amount exceeds the per-transaction limit. Split into smaller charges or ask the owner to raise the limit." }. Codes are stable machine strings (DAILY_BUDGET_EXCEEDED, CATEGORY_BLOCKED, WALLET_FROZEN, …) so agents branch and replan instead of parsing prose. Replays of the same request return the same code.

Around the engine:

Human approvals → one-use grants. Escalations land in an approval inbox (dashboard PWA, email, Slack). Approving mints a single-use, expiring grant the agent redeems on retry. Policy timeouts guarantee a terminal outcome.
Seats. An agent is a seat you can hand to whoever holds it: named holders, contractor auto-expiry (the key fails closed past the date), key rotation that keeps history, and batch creation from one template.
Budgets that cascade. Wallets nest into trees; subtree caps are enforced atomically so sibling agents can't race past a parent's limit. The console's spend view draws the month's runway — cumulative burn against the cap, pace, and the projected exhaust date — from wallet down to seat.
Notifications that find you. Email by default; signed JSON webhooks for machines; and Slack two ways — a pasted incoming-webhook URL that deep-links to the decision, or Add to Slack, which installs per workspace over OAuth and posts interactive Approve / Deny buttons that run the same resolveApproval path as the dashboard, actor recorded. Each route subscribes to its own events. Guide
Evidence you can replay. Every policy edit becomes an immutable revision; every decision stores the revision in force and the exact context the engine evaluated. GET /authorize/{id}/evidence re-runs the pure rules over the stored context and proves the outcome reproduces.
What-if over real history. POST /policy/simulate replays stored decisions under a candidate policy — which calls flip, what spend wouldn't clear — before you change anything.
The audit plane. GET /audit-events merges every decision, token log, and secret access into one feed (CSV export included); GET /reporting/summary spans any period with day buckets and per-seat rollups; wallet stats project burn pace and exhaustion ETAs; a weekly digest lands in Slack every Monday.
Tamper-evident exports. GET /audit/export hands you a signed, hash-chained snapshot of your governed decisions: altering, dropping, or reordering any row breaks the chain, and the head is HMAC-signed by Sanction. A regulator or the governed customer runs POST /audit/verify — self-contained, no database — to prove nothing changed after signing, down to the first broken link.
A console that opens on the roster. The dashboard home is the wallet tree as groups with agents as cards, each carrying a mandate stamp (live / paused / blocked). A wallet holds people, not just keys: team membership with roles (owner / admin / viewer), a switcher across every membership, and a viewer who can read everything and change nothing.
Observe before enforcing a wallet's policy. Observe mode records what the engine *would* have done while relaxing that wallet's own policy and caps. Ancestor subtree caps remain enforced and count observed spend; freeze and authentication checks still apply. Review would-be denials and their cost, then flip each pool to enforce in one confirm-gated click.
Spend answerable to outcomes. Report outcomes (POST /outcomes) and a wallet over its cost-per-outcome ceiling throttles to human-gated spend. Wallets can be frozen outright, and budget reallocated across the tree.
LLM gateway. Point your model SDK's base URL at https://getsanction.com/api/gateway/ with x-sanction-key — usage is metered and budget-capped with zero per-call instrumentation.

Every security claim above maps to enforcing code and a regression test in docs/TRACEABILITY.md — 1,100+ tests behind a coverage gate of 90% statements/lines, 94% functions, and 83% branches, including concurrency and Postgres row-level-security suites.

Start from a pack, not a blank policy

Eleven installable policy packs cover the common shapes — Startup defaults, Coding agent seat, MCP tool governance, Compliance baseline, Client-safe launch, and No-egress (Sanction Local) among them. GET /policy/packs lists them; POST /policy/packs/{id}/preview simulates one against your last 30 days of real decisions before anything changes; apply writes it as a policy revision.

Changing policy in production

Policy edits are never a leap of faith:

Draft the change (or pick a pack).
POST /policy/simulate replays your stored decision history under the candidate — see exactly which calls flip and what spend wouldn't clear.
Apply. The edit becomes an immutable revision; every subsequent decision records the revision in force.
If a decision is ever questioned, GET /authorize/{id}/evidence re-runs the rules over the stored context and proves the outcome reproduces.

When to use the credential vault

Use Sanction's vault when credentials should flow through the same policy, approval, and audit trail as spend and tools — one clearance model, no separate secrets cluster. Keep your existing Vault or Secrets Manager when you need fleet-scale secret lifecycle management independent of agent governance; Sanction consumes upstream identity and secrets rather than replacing them. Threat model: docs/SECURITY.md.

Distribution

Platform vendors govern agents inside their own walls. Sanction authorizes agents wherever they run. Pick the shortest path to your stack:

You want to…	Use	First step
Govern any MCP host (Claude Desktop, Cursor, …)	MCP wallet	Paste `https://getsanction.com/mcp` or `npx sanction-mcp`
Intercept tools/call and filter tools/list on an MCP server	MCP broker	Register the upstream, point the host at `/mcp/broker/`
Meter model spend with zero code changes	LLM gateway	Point the SDK base URL at `/api/gateway/`
Govern agents in a TypeScript app	SDK	`npm install sanction-sdk`
Call the engine from anything else	REST API	`POST /v1/authorize` with an `x-api-key`
Plug into an AuthZEN enforcement point	PDP	Point it at `/api/access/v1/evaluation`
Orchestrate on AWS Bedrock	Action Group	docs/BEDROCK.md

The full menu:

MCP (agent wallet) — paste https://getsanction.com/mcp (Streamable HTTP, x-api-key) or npx sanction-mcp in any MCP host. The agent carries the wallet. Wallet Card · guide
AuthZEN PDP — any OpenID AuthZEN 1.0 enforcement point can use Sanction as its decision point, zero custom code (guide)
TypeScript SDK — npm install sanction-sdk (source): SanctionClient (agent plane) and SanctionAdminClient (management plane), plus framework adapters (SanctionMiddleware, sanctionTool)
REST API — direct integration, OpenAPI 3.0 spec at /api/openapi.json (Bedrock-compatible)
AWS Bedrock Action Group — enterprise agent orchestration (setup guide)
LLM gateway — cross-provider metering with no code changes

Fastest first decision: bash examples/setup.sh — wallet, agent, and a demo policy in one command, printing the env exports your agent needs (examples/ has runnable clients to point at it).

Agent wallet · Quickstart · Starter kit · LangChain · CrewAI · Vercel AI SDK · Bedrock Agents · Agent fleets · AuthZEN PDP · Multi-tenant runbook · Notifications

API

Base URL: https://getsanction.com/api/v1 — grouped by workflow. Agent endpoints take x-api-key pxy_…; management endpoints take the owner's x-mgmt-key sk_….

Ask permission — the data plane an agent calls:

POST  /authorize                — Authorize a spend action (grant_id redeems an approval)

POST /authorize/quote — Authorize an x402 payment challenge before the wallet signs POST /authorize/tool — Authorize a

Only the beginning is shown; read the rest in the repo

Sanction

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Or run it on your computer

Or run it on your computer

Or run it on your computer

Or run it on your computer

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

FlyDocs

README from the maker

Sanction

Need one human approval?

Who runs Sanction

What it does

Start from a pack, not a blank policy

Changing policy in production

When to use the credential vault

Distribution

API