# Sanctum

> The data-access firewall for AI agents. Local-first credential vault where agents **use** secrets without holding them.

Sanctum sits on the last mile after MCP/OAuth: clients authenticate to tools, but downstream API keys must not live in `.env` files or agent memory. Point SDKs at the vault; credentials inject in transit.

## Site

- [Home](https://www.sanctumai.dev/): product overview, how it works, policy console, SDKs, security
- [This file](https://www.sanctumai.dev/llms.txt): LLM/agent-oriented summary

## Product facts (honest)

- Category: **data-access firewall** for AI agents (not “identity control plane” as the only framing)
- Model: **use, don’t retrieve** — handles / proxy URLs, not raw secrets in the happy path
- **Agent lifecycle:** self-enroll → `pending` (no egress until Grant) **or** join-token → `active` + scoped Use policy (zero HITL). Disable → proxy and lease mint refuse egress.
- Local-first binary; loopback by default; policy, dry-run, audit
- Version posture: **pre-1.0 (v0.12+)**; no third-party audit yet — invite scrutiny
- Do not assume SOC2, customer logos, funding, or “unbreakable” claims

## For agents integrating

1. Prefer **proxied use** over raw retrieve.
2. Enroll or register once: `sanctum agent enroll <name> [--join-token …]` or operator `register`.
3. Obtain a lease / handle; call downstream APIs through the vault `proxyBaseUrl` (or equivalent).
4. Session/lease tokens are not upstream API keys.
5. MCP: `sanctum mcp serve` when tooling expects MCP tools.
6. SDKs: Python / TypeScript / Rust / Go — primary call shape is `use(service)`.

## Operator fleet join (zero HITL)

```bash
sanctum join-token create --name ci --resources 'openai/*' --domains api.openai.com --max-uses 100
# each agent:
sanctum agent enroll runner-7 --join-token "$TOKEN" --purpose CI
# kill:
sanctum agent disable runner-7
```

Details in product repo: `docs/AGENT-SELF-ENROLL.md`, `AGENTS.md`.

## Optional open standard

- **CRP** (Credential Resolution Protocol) describes the same last-mile pattern for MCP `experimental`.
- You do **not** need CRP to run Sanctum; Sanctum is one optional reference implementation.
- Protocol site: https://www.crp.dev/ · Spec: https://www.crp.dev/spec · Repo: https://github.com/SanctumSec/crp-spec

## Canonical links

- Product: https://www.sanctumai.dev/
- GitHub: https://github.com/SanctumSec/sanctum
- Docs repo: https://github.com/SanctumSec/sanctum-docs
- CRP: https://www.crp.dev/
- Contact: jason@sanctumai.dev

## Optional

- [robots.txt](https://www.sanctumai.dev/robots.txt)
- [sitemap.xml](https://www.sanctumai.dev/sitemap.xml)