Sieve MCP

What gautam-u/sieve-mcp MCP server does

gautam-u/sieve-mcp MCP server exposes Sieve’s local secret-scanning functions to MCP clients. Sieve examines histories from Claude Code, Claude Desktop, Cursor, VS Code/Copilot Chat, Windsurf, Cline, Codex CLI, and Gemini CLI. It can also inspect selected .env files and user-added folders, then correlate the same secret across multiple source types.

The server is designed so tool responses do not disclose plaintext credentials. Findings contain metadata such as a rule identifier, severity, source path, fingerprint, redacted preview, assumed provider exposure, rotation status, and a sieve:// replacement reference.

How it works

The Sieve application bundles the sieve-mcp executable. MCP clients start that executable and communicate with it through JSON-RPC over standard input and output. The application performs scanning on the Mac; the server does not make network calls or use cloud synchronization.

Sieve stores HMAC fingerprints and redacted previews for findings. Secret values used for command execution remain in the macOS Keychain. The vault command tool resolves selected secrets into environment variables for a process, while returning only exit status and output line counts. It does not return command stdout or stderr content.

Setup and configuration

Install Sieve from the Mac App Store, open its settings, and enable the MCP server under Settings → MCP. No separate sieve-mcp package installation is described.

For Claude Code, add a server entry that points to /Applications/Sieve.app/Contents/MacOS/sieve-mcp in ~/.claude/claude_desktop_config.json, then restart the client and verify the server with /mcp. Claude Desktop uses the same command block in ~/Library/Application Support/Claude/claude_desktop_config.json.

MCP is disabled by default and must be explicitly enabled in Sieve. macOS Full Disk Access may be required for some chat databases; unreadable sources and permission or parsing failures are reported through the issue list rather than silently ignored.

Tools and capabilities

• sieve_health_status reports service health, finding totals, and scan-job totals.
• sieve_self_test checks scanner rules and transcript-source coverage.
• sieve_findings_list returns findings from the latest scan, with an optional limit.
• sieve_issue_list reports unreadable sources, permission problems, and parse failures.
• sieve_scan_history lists previous scan summaries, including source, finding, and issue counts.
• sieve_scan_status reports whether a scan is idle, running, completed, or failed.
• sieve_redact_text replaces detected values with project-scoped sieve:// placeholders and returns fingerprints for the replacements.
• sieve_vault_run runs a command with macOS Keychain-resolved secrets injected as environment variables.

Limitations and notes

The gautam-u/sieve-mcp MCP server is macOS-only and requires the Sieve application. Its transport is local stdio, so it is not a network service. No tool response includes a plaintext secret; this also means agents cannot use the server to retrieve secret values directly.

A finding in an AI transcript indicates that the provider may be able to associate the prompt with the account identity. The scanner reports this assumed exposure but does not rotate credentials. Source coverage depends on readable local files and databases, and custom source folders must be added by the user.