sieve-mcp

sieve-mcp

MCP server for Sieve — a macOS app that scans local AI coding tool history for secrets leaked into prompts.

sieve-mcp is bundled inside the Sieve Mac app. No separate install. No network calls. All operations run on-device.

Install

1. Download Sieve for Mac from the App Store.
2. Open Sieve → Settings → MCP → toggle Enable MCP server on.

Configure Claude Code

Add to ~/.claude/claude_desktop_config.json:

{
  "mcpServers": {
    "sieve": {
      "command": "/Applications/Sieve.app/Contents/MacOS/sieve-mcp"
    }
  }
}

Restart Claude Code and run /mcp to verify sieve appears.

Configure Claude Desktop

Add the same block to ~/Library/Application Support/Claude/claude_desktop_config.json and restart.

Tools

All tools are safe by design — no tool ever returns a plaintext secret value.

sieve_health_status

Returns service health and finding counts.

Response: ``json { "status": "ok", "findings_count": 12, "scan_jobs": 3 } ``

---

sieve_self_test

Verifies scanner rules and transcript source coverage are healthy.

Response: ``json { "fingerprintHealthy": true, "ruleCount": "<n>", "transcriptSourceCount": "<n>", "healthy": true, "issues": [] } ``

---

sieve_findings_list

Lists findings from the most recent scan.

Input: { "limit": 50 } (optional)

Response: ``json [ { "findingId": "abc123", "ruleId": "github-pat", "severity": "critical", "sourcePath": "~/.claude/projects/myapp/transcript.jsonl", "sourceType": "ClaudeCode", "secretFingerprint": "<fingerprint>", "previewRedacted": "ghp_[REDACTED]", "providerExposureAssumed": true, "rotationStatus": "pending", "redactionPlaceholder": "sieve://myapp/github-pat" } ] ``

providerExposureAssumed: true — secret found in an AI tool transcript. Assume the provider (Anthropic, OpenAI, etc.) can associate the prompt with your account identity.

---

sieve_issue_list

Lists scanner health issues — unreadable sources, permission errors, parse failures.

Response: ``json [ { "issueId": "iss1", "code": "SCAN_TARGET_UNREADABLE", "severity": "warning", "component": "ClaudeDesktop", "message": "Could not read chat DB — Full Disk Access may be required", "suggestion": "Grant Full Disk Access in System Settings → Privacy & Security" } ] ``

---

sieve_scan_history

Returns past scan job summaries.

Input: { "limit": 10 } (optional)

Response: ``json [ { "jobId": "job1", "startedAt": "2026-05-22T10:00:00Z", "finishedAt": "2026-05-22T10:00:12Z", "sourcesCount": 4, "findingsCount": 3, "issuesCount": 0 } ] ``

---

sieve_scan_status

Returns status of the current or most recent scan.

Response: ``json { "status": "idle" } ``

Values: "idle" · "running" · "completed" · "failed: <reason>"

---

sieve_check_text

Checks whether text contains secrets. Returns boolean only — never echoes input or detected values.

Input: { "text": "<content to check>" }

Response: ``json { "has_secrets": true } ``

Use this to gate operations before sending content to an external API.

---

sieve_redact_text

Redacts secrets from text, replacing values with sieve:// placeholders.

Input: { "text": "<content>", "project_key": "myapp" }

Response: ``json { "redacted": "export STRIPE_KEY=sieve://myapp/stripe-secret-key", "hadSecrets": true, "placeholders": [ { "ruleId": "stripe-secret-key", "placeholder": "sieve://myapp/stripe-secret-key", "fingerprint": "<fingerprint>" } ] } ``

Raw values are never included in the response.

---

sieve_vault_run

Executes a command with macOS Keychain-resolved secrets injected as env vars. Secrets never transit the MCP channel.

Input: { "command": "npm run deploy", "fingerprints": ["<fingerprint>"] }

Response: ``json { "exit_code": 0, "succeeded": true, "timed_out": false, "stdout_line_count": 14, "stderr_line_count": 0 } ``

stdout/stderr content is never returned — only line counts.

---

Supported AI tool sources

| Tool | Source | |------|--------| | Claude Code | JSONL project transcripts | | Claude Desktop | SQLite chat database | | Cursor | SQLite state database | | VS Code / Copilot Chat | JSON history files | | Windsurf | JSON history files | | Cline | JSON session files | | Codex CLI | JSONL/JSON session files | | Gemini CLI | JSON history files | | .env files | Selected project roots | | Custom sources | User-added folders |

Sieve correlates findings across source types — if the same secret appears in both a transcript and a .env file, it is flagged as a multi-source exposure.

Security posture

• Local-only. stdio transport, no network calls, no cloud sync.
• No plaintext secrets in responses. Hard invariant in the dispatcher — not configurable.
• Fingerprint-only persistence. Findings DB stores HMAC fingerprints + redacted previews only.
• Keychain-backed vault. Secret values live in macOS Keychain with biometric access control.
• Explicit opt-in. MCP is off by default; requires toggle in Sieve Settings.
• Unreadable sources reported. SCAN_TARGET_UNREADABLE surfaces in sieve_issue_list — no silent skipping.

Transport

stdio. The sieve-mcp binary reads JSON-RPC 2.0 from stdin and writes to stdout. MCP clients (Claude Code, Claude Desktop) manage the process lifecycle.

Platform

macOS only. Requires Sieve app installed from the Mac App Store.

Links

• Mac App Store: https://apps.apple.com/app/sieve-ai-secret-scanner/id6747506504
• Product site: https://sieve.app