Sanction MCP server

Read from the package source without running it. The installed server may list more.

• sanction_authorize

  ALWAYS call this before any purchase, subscription, API credit top-up, or money transfer. Sanction enforces the wallet owner's spend policy: amounts under the auto-approve threshold return immediately; amounts over the escalation threshold pause for human approval; blocked categories are hard-denied. Returns authorized:true with a request_id on approval, or authorized:false with a machine-readable

• sanction_authorize_capability

  Call this BEFORE acquiring any new capability \u2014 installing a skill or plugin, enabling an integration, or calling an API you haven't used before. Sanction enforces the wallet owner's capability policy: blocked capabilities are hard-denied, capabilities off the allow-list are denied, and sensitive ones return escalated for human approval. Returns authorized:true to proceed, or authorized:false

• sanction_authorize_provision

  ALWAYS call this before provisioning any resource \u2014 user seats, software licenses, cloud infrastructure, subscriptions with unit counts. One call governs both the resource (the wallet's resource allow/block/escalate lists) and the dollars (the same spend ladder and daily budget as purchases). Amounts or resources over the line pause for human approval; approval mints a one-use grant \u2014 re

• sanction_authorize_tool

  Call this BEFORE invoking any other tool or external action (a different MCP tool, a shell command, a deploy, an email send). Sanction enforces the wallet owner's tool-governance policy: blocked tools are hard-denied, tools off the allow-list are denied, and sensitive tools return escalated for human approval. Returns authorized:true to proceed, or authorized:false with a machine-readable code (TO

• sanction_check_authorization

  Poll an authorization request that returned 'escalated', to see whether the wallet owner has approved it yet. Pass the request_id from the escalated authorize/provision/tool response. While pending, status stays 'escalated' \u2014 wait and poll again. Once the owner approves, status becomes 'approved' and a one-use grant_id is returned: retry the ORIGINAL authorize call with the identical fields p

• sanction_inject_credential

  Retrieve a decrypted credential value using a scoped execution JWT. Every injection is audit-logged with timestamp, agent ID, and credential label \u2014 raw values are never logged. Use the credential value immediately and do not store it in memory, files, or logs. Fails if the JWT is expired, revoked, or if the requested credential label was not in the original scope.

• sanction_log_outcome

  Record a business outcome (an enrollment, booking, signed engagement, conversion) against this wallet. Outcomes are what the wallet's spend answers to: Sanction computes cost-per-outcome over a rolling window and, when the wallet has a cost_per_outcome ceiling configured, throttles further spend to human-gated once the ceiling is crossed. Call this when your system confirms a real outcome \u2014 n

• sanction_log_tokens

  Call this after every LLM inference call (Claude, GPT-4, Gemini, Llama, etc.) to record token consumption. It is metered against three budget horizons \u2014 the seat's daily budget, the seat's monthly budget, and the pooled per-department daily token cap \u2014 and returns a 402 budget error naming which horizon was hit if any is exceeded; on a budget error the agent should stop making LLM calls

• sanction_request_execution

  Mint a short-lived mandate (signed JWT) for a child agent, subprocess, or counterparty: credential scope plus a hard spend cap. Pass the JWT \u2014 never the root pxy_ key. Default 15 min, wallet-bound, freeze-aware. The other party verifies it at POST /mandate/verify with no API key. Required before sanction_inject_credential.

• sanction_wallet_status

  Check the wallet's current spend and token budget consumption. Returns today's and month-to-date LLM token costs and real-money spend, plus a count of authorization requests pending human approval. Call this at the start of long agentic tasks to confirm budget headroom before initiating expensive operations, or when a prior authorize/log_tokens call returns a budget error.

• Code scan3 source files scanned20/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 1 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Sanction: common questions

Is Sanction MCP server safe?

Mostly: it is graded B (75/100). Read the Sanction safety report

How do I install Sanction?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Sanction need an API key?

Yes. The registry entry asks for SANCTION_API_KEY.

Is Sanction maintained?

The last commit was in the last day (2026-09-19). The latest release is v0.9.0.

What can I use instead of Sanction?

Servers from other publishers that do the same job: Lightning Enable MCP Server, agent-device MCP server and Agent-Native Chat MCP server. Compare all Sanction alternatives.