Spend authorization, token budgets, and an encrypted credential vault for AI agents.
SaferSkills independently audited sanction (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The trust and governance layer for autonomous AI agents.
Sanction gives agents a wallet, a credential vault, and a clearance system — so they can act autonomously without acting without limits.
Autonomous agents need permission to spend money, access credentials, and operate in sensitive domains. Sanction is the layer that grants that permission, enforces policy, and logs everything.
| Pillar | Capability |
|---|---|
| Agent Wallet | Spend authorization with configurable policy. Auto-approve under threshold, escalate over it, deny what's blocked. Daily and monthly budgets per agent. |
| Credential Vault | AES-256-GCM encrypted secrets. Scoped execution JWTs (15-minute TTL) gate every injection. Every access is audit-logged. |
| Clearance Levels | 1–5 clearance system for domain authorization. Agents only access what they're cleared for. |
Sanction is available through three channels:
x-api-key authagentId: JXRNIJRMCX, us-east-1)Base URL: https://getsanction.com/api/v1
POST /authorize — Authorize a spend action before any transaction
POST /tokens — Log LLM token consumption for budget tracking
POST /exec — Issue a scoped execution JWT (15-min TTL)
POST /credentials/vault — Store an encrypted credential
POST /credentials/inject — Inject a decrypted credential (requires JWT)
POST /agents — Register an agent against a wallet
POST /wallets — Create a wallet with spend policy
GET /wallets/stats — Dashboard stats (today + MTD)
GET /api/openapi.json — OpenAPI 3.0 spec (Bedrock compatible)Agent API calls use x-api-key: pxy_... header. Credential injection requires a short-lived Bearer JWT issued by /exec.
{
"mcpServers": {
"sanction": {
"command": "npx",
"args": ["sanction-mcp"],
"env": {
"SANCTION_API_URL": "https://getsanction.com/api/v1",
"SANCTION_API_KEY": "pxy_...",
"SANCTION_WALLET_ID": "wallet_..."
}
}
}
}| Tier | Price | Agents | Token Budget |
|---|---|---|---|
| Free | $0 | 1 | $10/mo |
| Pro | $19/mo | 5 | $100/mo |
| Team | $49/mo | 25 | $500/mo |
| Enterprise | Custom | Unlimited | Custom |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.