Sanction MCP server

Sanction

The independent authorization plane for AI agents.

Before an agent spends money, invokes a tool, touches a credential, or provisions a resource, it asks Sanction. Sanction approves, escalates to a human, or denies. Every decision is logged and auditable. Sanction belongs to no platform: one policy engine answers across model providers, payment rails, identities, and agent ecosystems.

Who runs Sanction

departments become wallets in a tree; budgets, tool rules, and approval bands are enforced — not dashboarded — with chargeback-ready reporting underneath. Alerts tell you what happened; a decision happens first.

• Organizations governing their own AI — the primary case. Teams and

for clients carry a wallet wherever they execute: MCP hosts, Bedrock, your own stack via SDK or REST.

• Platforms and agencies embedding governance — agents you ship or run

• Individuals — free, no card, personal and production use.

What it does

One policy decision engine governs every kind of agent action:

What a decision looks like in practice — one POST /authorize with an amount, three possible outcomes, all of them terminal or resumable:

same transaction the decision persists (an advisory lock makes sibling agents queue, not race).

• Approved → { "status": "approved" }; budget counters debit in the

sees it in the approval inbox, and approving mints a one-use grant the agent redeems by retrying with grant_id. Policy decides what a timeout means (approve or deny) — nothing hangs forever.

• Escalated → { "status": "escalated", "request_id": "…" }; a human

"remediation": "Amount exceeds the per-transaction limit. Split into smaller charges or ask the owner to raise the limit." }. Codes are stable machine strings (DAILYBUDGETEXCEEDED, CATEGORYBLOCKED, WALLETFROZEN, …) so agents branch and replan instead of parsing prose. Replays of the same request return the same code.

• Denied → { "status": "denied", "decisioncode": "PERTXN_LIMIT",

Around the engine:

Shortened. The full README is on GitHub.