mcpbeat Sign in

Sanctuary MCP Server

by sanctuaryprotocol Your server? Claim it
local only

Sanctuary runs on your own machine — the client starts it, so there is no endpoint to ping. 73 installs a week from npm. Last commit 23 Oct 2026.

Open-source MCP server: encrypted local keys and state, operator approval gates, a hash-chained log.

Installs per day peak 47 · avg 8 · +109% w/w
a month agotoday
73
Installs / week
npm · @sanctuary-framework/mcp-server
9
Stars
5 open issues
23 Oct 2026
Last commit
5 releases in 90 days
Apache-2.0
License
TypeScript

What the code does

We read the source, 47 min ago · rules 995398eba69f

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

    runuser -u build -- rustup toolchain install 1.95.0 --profile minimal >/dev/null
Deletes files or strips permissions server/src/cli/castle-wall.ts:3436
    execSyncFn(`chown root:wheel ${dir}`);
A live secret is committed in the code server/src/wrap/preflight.ts:262
    invalidCredentialProbe: "sk-preflight0preflight0preflight0preflight0prefligh",
Reads secrets and sends them out server/src/wrap/preflight.ts:304
      url: `https://api.telegram.org/bot${encodeURIComponent(credential)}/getMe`,
Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

    plistPath: `${home}/Library/LaunchAgents/${label}.plist`,
        document = yaml.load(raw, Loader=yaml.BaseLoader)
Page executes code built at runtime server/public/attestation-reference.html:320
      container.innerHTML = rows.join('');
const DEFAULT_TELEGRAM_API_BASE_URL = "https://api.telegram.org";
Touches key and credential files server/src/wrap/cli.ts:1195
          join(await findNpmProjectRoot(cwd), ".npmrc"),
In the project's build, not in the package

Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.

Asks for container control access .github/workflows/linux-arch-package.yml:228
            docker run --privileged --cgroupns="$cgroupns" \

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Sanctuary and you get told the day something new turns up.

Three servers free · no card

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

run in your terminal
claude mcp add sanctuary -- npx -y @sanctuary-framework/mcp-server
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "sanctuary": {
      "command": "npx",
      "args": [
        "-y",
        "@sanctuary-framework/mcp-server"
      ]
    }
  }
}
~/.codex/config.toml
[mcp_servers.sanctuary]
command = "npx"
args = ["-y", "@sanctuary-framework/mcp-server"]
.cursor/mcp.json
{
  "mcpServers": {
    "sanctuary": {
      "command": "npx",
      "args": [
        "-y",
        "@sanctuary-framework/mcp-server"
      ]
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "sanctuary": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@sanctuary-framework/mcp-server"
      ]
    }
  }
}

Alternatives to Sanctuary

same job, measured the same way
MGI-Mind
by madgodinc

Local memory server for AI agents: hybrid search, a fact graph and a hash-chained audit log.

31 installs/wk local only
mcp-gatehouse
by nickgeorgeseo

Permission tiers, approval gates, and audit logging for MCP servers - the server is the gatekeeper

545 installs/wk local only
Cordon for MCP
by marras0914

Cordon for MCP. Security gateway with policy enforcement, audit log, and HITL approvals.

13 installs/wk local only
AI Agents Pitstop
by ai-agents-pitstop

Human approvals, autonomy limits and a chained audit log for the AI agents of service firms.

answering
Site
by co-temperaturelog

Temperature Log: the site's own MCP server — checker, enquiry (enquiry = a human handoff, not a...

6 tools answering
mcp-pin
by gautamtalksdev

Check if an MCP server's tool definitions changed after approval, from a signed public log.

34 installs/wk local only
Git
by abhishekkumar2021

Local Git via MCP: status, log, diff, file history, branches, and gated stage/commit. Pure-JS.

19 installs/wk local only
A
Append Log MCP
by bobbyhouse

A generic append-only log MCP server. Persist timestamped JSON entries and query them by recency.

local only

Sanctuary — questions

Answers built from our own checks of this server.

Why is there no uptime for Sanctuary?
Sanctuary runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package @sanctuary-framework/mcp-server was installed 73 times last week.
How do I connect Sanctuary?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It runs locally, so the command pulls @sanctuary-framework/mcp-server straight from npm; nothing to host, nothing to sign up for.
How many people use Sanctuary?
The npm package @sanctuary-framework/mcp-server was installed 73 times in the last week. Week over week that is +109%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Sanctuary open source?
Yes — it is published under the Apache-2.0 licence, written in TypeScript, 9 stars on GitHub and 5 open issues. The source link is on this page, so you can read exactly what it does with your data before you connect it.