Sanctum Runtime

Sanctum Runtime is middleware that checks actions from AI agents and other systems before they are carried out. It evaluates actions against policies and can approve them, require verification, or block them. Operators can review, approve, deny, or escalate actions through web and mobile workflows. Monitoring and audit features include behavioral signals, policy history, logs, and decision trails for incident review. The open-core runtime supports local policy checks and offline heuristics, including local Ollama risk scoring. Documented connections cover OpenAI, Claude/MCP, Gemini-style function calling, DeepSeek, Grok, Bedrock-compatible endpoints, NVIDIA NIM, custom agents, and local runtimes. Developers can use Node and Python SDKs, an agent adapter, an MCP wrapper, or a hosted OpenAI-compatible proxy. Robotics materials include ROS2-oriented policy packs and smart-home and embodied-agent templates. The repository is described as MIT-licensed and self-hostable, with a hosted console also available. Some enterprise capabilities are private. Sanctum describes itself as embedded runtime middleware, not a standalone consumer app or robot controller.

Sanctum Runtime focuses on checking and auditing actions before execution, with both local and hosted deployment paths. It is designed as embedded middleware, so teams seeking a standalone app or robot controller should look elsewhere.

It suits teams building AI agents, robotics, workflow automation, or other systems that can take real-world actions. The site presents it for agent startups, platform and AI engineers, and security or compliance teams.

Sanctum Runtime is embedded middleware that checks AI-agent actions before they reach execution, with options for local and hosted deployment. It best suits teams building agents, automation, or robotics that need policy enforcement and operator review. Its strongest case is runtime control paired with auditability; it is not a standalone app or robot controller.

Overview

Sanctum sits between an AI system’s reasoning and its actions. Policies can approve an action, require verification, or block it before execution, giving teams a point to intervene when an agent can affect real systems. Web and mobile workflows let operators approve, deny, or escalate requests.

The open-core runtime supports local policy checks and offline verification, including local Ollama risk scoring. That makes it relevant where a hosted service cannot be the only enforcement path. A hosted OpenAI-compatible proxy and cloud dashboard provide another route, but some enterprise capabilities are private.

Key features

• Policy decisions: Approve, verify, or block actions before execution. This is useful for teams that need controls in an agent workflow, rather than only reviewing behavior after an incident.
• Monitoring and audit: Behavioral monitoring covers unusual command sequences, escalation patterns, suspicious remote instructions, and policy violations. Audit trails can capture requests, decisions, policy evaluations, approval states, anomalies, and timestamps, supporting incident review.
• Human oversight: Operators can review actions through web and mobile workflows. This adds a human checkpoint, though it also means workflows can depend on timely operator decisions.
• Developer and robotics support: Node and Python SDKs, an agent adapter, an MCP wrapper, ROS2-oriented policy packs, and smart-home and embodied-agent templates support several kinds of integration. Documented verify paths also cover OpenAI, Claude/MCP, Gemini-style function calling, DeepSeek, Grok, Bedrock-compatible endpoints, NVIDIA NIM, custom agents, and local runtimes.
• Security mechanisms: Signed agent and action tokens, short-lived approvals, source-trust context, blast-radius scoring, audit-chain verification, and encrypted platform keys are part of the documented security layer.

Pricing

Sanctum uses a freemium model and offers a free plan. The product has custom pricing for plans without a published price; the free-plan quota and any paid-plan terms are not established here, so teams should confirm fit before committing to a deployment.

The MIT-licensed, self-hostable open-core runtime is the clearest fit for teams that want local control. Hosted access adds a proxy and cloud dashboard, while fleet orchestration, organization-wide policy sync, advanced analytics, compliance, and device attestation are private enterprise features. The hosted and enterprise paths therefore matter most to teams needing managed workflows or organization-wide controls.

Platforms

Sanctum supports Android, iOS, Linux, web, API, and self-hosted deployment. Its hybrid model combines local enforcement with hosted options, rather than requiring every action to pass through a cloud console.

Who it's for

Agent startups, platform and AI engineers, and security or compliance teams building systems that can take real-world actions are the natural audience. Robotics and automation teams may benefit from the Python SDK and ROS2-oriented resources. Teams looking for a consumer app, or a product that directly controls a robot, should choose another category of software.

Pros and cons

• Pro: Policies can intervene before execution, which is more useful for preventing risky actions than an audit trail alone.
• Pro: Local enforcement and offline verification give teams a path that does not rely exclusively on hosted checks.
• Pro: Multiple SDKs, protocol paths, and robotics templates broaden its fit across agent and embodied-system projects.
• Con: It is embedded middleware, so teams must integrate it into their own systems rather than install it as a standalone controller or app.
• Con: Fleet orchestration, policy sync, compliance, and other enterprise capabilities are private, which may make the hosted path necessary for organizations seeking those controls.

Alternatives

For teams comparing adjacent tools, the LLM Security Tools category is a useful starting point. Choose Amazon Bedrock Guardrails if paid web-based content filters and denied-topic controls better match the need. NVIDIA NeMo Guardrails is a free open-source library for teams seeking a Python package across API, Linux, macOS, Windows, or self-hosted environments.

Openlayer Guardrails may suit teams looking for a free Basic tier with inference logs and tests; its Basic plan caps usage at one member, five projects, one inference pipeline per project, 20,000 logs monthly, 20 tests per project, one workspace, and three months of retention. PromptGuard is another free-tier option, with 20,000 monthly scans, one API key, one project, and 24-hour log retention; its Team plan costs $19 a month.

GLACIS offers a free account with no card required and setup described as taking about a minute. LLM Guard is a free, self-hosted option, but its repository is archived and no longer actively maintained. Prompt Inspector may fit teams that want a free API, SDK, and MCP tier with 1,000 detections per month. CyberSecEval is a free open-source benchmark suite for teams seeking evaluation rather than embedded runtime middleware.

Verdict

Choose Sanctum Runtime if your team needs policy checks before an agent acts, with human review and local enforcement alongside audit trails. Its combination of runtime controls, offline operation, and integration options is the main reason to consider it. Look elsewhere if you need a standalone robot controller or app, or if the private enterprise features are essential and you need a clearer fit for your deployment and budget.