SanctumAI — Credential Vault for AI Agents

A local credential vault MCP server that gives an AI assistant encrypted storage and lease-based access to secrets.

What you can do

SanctumAI is a credential vault exposed as a local MCP server. According to its registry description, it provides encrypted storage for credentials, lease-based access control, and CRP support. It runs as a local process on the user's machine over stdio, so the assistant can request credentials from the vault rather than holding them directly.

When to use it

Worth considering when an assistant needs to work with credentials or secrets and you want them kept in an encrypted local vault with time-limited, lease-based access instead of being pasted into prompts or config files. It is a desktop-only tool, so it suits individual workstations rather than shared or headless servers.

Requirements

Runs locally as an npm package (@sanctumai/mcp-server) over stdio, so Node.js is needed. The vault passphrase is supplied through the SANCTUM_PASSPHRASE environment variable for automated or headless operation; if it is not set, the vault must be unlocked interactively or through the web UI. The vault directory is set by SANCTUM_VAULT_PATH and defaults to ~/.sanctum. Desktop only.