Opened in a browser tab
- GETapi.example.com/ratessent
- POSTtracker.adnet.io/collectsent
- POST185.199.x.x/uploadsent
- CAMgetUserMedia()prompt
Every request goes out. You only find out what the tool contacted afterwards, if at all.
v0.1.0
macOS build signed and notarized
A sandbox for the HTML tools AI models write for you.
Paste in a single-file tool. Sanctum lists what it found in the source, such as camera access or the hosts it calls, and runs the tool with only the parts you turn on. The rest is blocked before the tool's first line of script runs.
Free for individuals · macOS, Windows, Linux · No account
Invoice Parser
Detected in source
- Camera + microphonegetUserMedia Blocked
- StoragelocalStorage This tool only
- Networkapi.example.com Approved
- Networktracker.adnet.io Blocked
Everything else: denied
Run sandboxed
Enforced by the runtime
- Zero capabilities by default
- Per-tool origin isolation
- SHA-256 on every launch
- No OS bridge in tool windows
- AGPL-3.0
The problem
The same file, opened two ways.
A model gives you 800 lines of HTML and JavaScript. You're unlikely to read all of
it, and one of those lines could be a fetch to a host you've never heard of.
Opened in Sanctum
- GETapi.example.com/ratesapproved
- POSTtracker.adnet.io/collectblocked · CSP
- POST185.199.x.x/uploadblocked · CSP
- CAMgetUserMedia()not granted
You approved api.example.com before the tool ran. The Content Security Policy refuses the other requests.
How it works
What happens when you add a tool
Sanctum never runs the file from where you got it. It works from its own stored copy.
Step 01
Ingest
Paste from the clipboard or pick a file. Sanctum stores a copy under its SHA-256 hash and only ever runs that copy.
Step 02
Scan
A static scan looks for capability signals like camera, USB, serial, geolocation, storage and smart cards, and records every literal hostname in the source.
Step 03
Approve
Each capability gets its own toggle. Network access is per host, so you can allow the one API a tool needs and leave the rest off.
Step 04
Run
The tool opens at its own origin under a Content Security Policy built from your approvals. Sanctum removes the app's IPC globals before the tool's HTML is parsed.
Security model
What the runtime enforces
The scan only fills in the approval screen. The controls below apply whether or not the scan caught anything.
01
Origin isolation
Each tool runs at its own origin, and the WebView scopes storage, cookies and service workers by origin. One tool can't read another tool's data.
02
CSP enforcement
Every fetch directive starts at 'none'. When the window is created, each host you approved is added as an explicit https: and wss: entry.
03
IPC removal
Every __TAURI__* global is deleted before the tool's HTML is parsed. Tool windows also have an empty capability set, so rebuilding the IPC bootstrap doesn't reach any command.
04
Integrity check
The stored file's SHA-256 is recomputed on every launch. If it doesn't match, the tool is quarantined and its window isn't created. There's no prompt to override it.
05
Static scan advisory
The scanner decides what shows up on the approval screen, and that's all it does. If it misses a capability, that capability is never granted.
New in 0.1 · Hardware
Smart card access is per applet
A tool can send commands to a FIDO2, PIV or OpenPGP card, but only to the applet you approved. That gives tools access to things WebAuthn doesn't expose to web pages, such as CTAP2 hmac-secret.
You approve a specific applet
The scan picks up literal applet IDs from the source, so the prompt asks about “FIDO2 / WebAuthn” rather than the whole card.
Other applets stay out of reach
Raw commands can't re-select, so a tool approved for FIDO2 can't reach the PIV or OpenPGP applets on the same card. The session closes when the tool's window does.
The default
Tools start with nothing.
- Network access needs an approved host
- Tool windows can't call into the app or the OS
- Tools don't share storage
- Sanctum has no account and sends no telemetry
Comparison
Why not just open it in a browser?
A browser tab runs the page straight away with normal web permissions. A virtual machine isolates it, but doesn't tell you what it tried to reach. Sanctum shows what a tool uses before it runs and enforces what you approve.
| Capability | Browser tab | Virtual machine | Sanctum |
|---|---|---|---|
| Shows what a tool wants before it runs | No | No | Yes |
| Network off until you approve it | No | All or nothing | Per host |
| Each tool isolated from the others | Partial | One VM per tool | Yes |
| Tamper check on every launch | No | No | Yes |
| Smart card access | Not available | Whole reader | One approved applet |
| Setup | None | Hypervisor + guest OS | One app |
| Price for individuals | Free | Free to licensed | Free |
Pricing
The app is free. Organizations pay for fleet controls.
The free version has the whole sandbox. The paid plan is for companies running Sanctum on many machines who need central policy and audit logs.
Individual
Free
The full app, with no limit on tools or versions.
- Every sandbox layer described above
- Static capability scanner
- Smart card access, per applet
- macOS, Windows and Linux
- Full source under AGPL-3.0
No account or telemetry
Organization
Not published
We're setting prices with our first design partners.
- Everything in Individual, for every employee
- Signed org policy that limits what users can approve in development
- Fleet deployment via Jamf, Intune and MDM in development
- Audit log of every ingest, approval and run in development
- SSO and SCIM provisioning in development
- Priority vulnerability disclosure channel
- Commercial licensing for AGPL-incompatible use
ultra@enigma.sh
FAQ
Questions
What counts as an “HTML tool”?
A single HTML file with its scripts and styles inline, like the calculators, parsers and converters a model writes when you ask for “a small tool that…”. If it works when you double-click the .html file, Sanctum can run it.
Does Sanctum send anything anywhere?
There's no account, telemetry or analytics. The only request Sanctum makes by itself is an update check against its GitHub releases. Updates are signature-checked in Rust against a public key built into the app, and only install when you click to install them.
What if a tool needs the network?
The scanner lists every literal hostname in the source. Sanctum adds the ones you approve to the tool's Content Security Policy as https: and wss: entries. Other hosts stay blocked, including any the tool builds at run time.
Can a tool hide what it does from the scanner?
It can, which is why the scanner isn't the security control. The scan decides what appears on the approval screen and the sandbox enforces your approvals, so anything the scan didn't see was never granted.
Which platforms are supported?
macOS as a universal build, signed with a Developer ID and notarized by Apple. Windows as .msi and .exe. Linux as .deb, .AppImage and .rpm for x86_64 and arm64, including Raspberry Pi OS.
Why is the individual version free?
We don't think the security model should depend on whether you pay. Organizations pay for signed policy, fleet deployment and audit logs, which an individual doesn't need.
Why AGPL-3.0?
So anyone can read the code that sits between a tool and their machine, and changes to it stay open. If AGPL doesn't work for how your company ships software, we offer a commercial license.
The source is on GitHub.
The sandbox is implemented in Rust under src-tauri/src, licensed AGPL-3.0.
Free for individuals · macOS, Windows, Linux · AGPL-3.0