sieve-mcp

MCP server for Sieve — a macOS app that scans local AI coding tool history for secrets leaked into prompts.

sieve-mcp is bundled inside the Sieve Mac app. No separate install. No network calls. All operations run on-device.

Install

1. Download Sieve for Mac from the App Store.
2. Open Sieve → Settings → MCP → toggle Enable MCP server on.

Configure Claude Code

Add to ~/.claude/claude_desktop_config.json:

{
  "mcpServers": {
    "sieve": {
      "command": "/Applications/Sieve.app/Contents/MacOS/sieve-mcp"
    }
  }
}

Restart Claude Code and run /mcp to verify sieve appears.

Configure Claude Desktop

Add the same block to ~/Library/Application Support/Claude/claude_desktop_config.json and restart.

Tools

All tools are safe by design — no tool ever returns a plaintext secret value.

sieve_health_status

Returns service health and finding counts.

Response:

{
  "status": "ok",
  "findings_count": 12,
  "scan_jobs": 3
}

---

sieve_self_test

Verifies scanner rules and transcript source coverage are healthy.

Response:

{
  "fingerprintHealthy": true,
  "ruleCount": "<n>",
  "transcriptSourceCount": "<n>",
  "healthy": true,
  "issues": []
}

---

sieve_findings_list

Lists findings from the most recent scan.

Input: { "limit": 50 } (optional)

Response:

[
  {
    "findingId": "abc123",
    "ruleId": "github-pat",
    "severity": "critical",
    "sourcePath": "~/.claude/projects/myapp/transcript.jsonl",
    "sourceType": "ClaudeCode",
    "secretFingerprint": "<fingerprint>",
    "previewRedacted": "ghp_[REDACTED]",
    "providerExposureAssumed": true,
    "rotationStatus": "pending",
    "redactionPlaceholder": "sieve://myapp/github-pat"
  }
]

providerExposureAssumed: true — secret found in an AI tool transcript. Assume the provider (Anthropic, OpenAI, etc.) can associate the prompt with your account identity.

---

sieve_issue_list

Lists scanner health issues — unreadable sources, permission errors, parse failures.

Response:

[
  {
    "issueId": "iss1",
    "code": "SCAN_TARGET_UNREADABLE",
    "severity": "warning",
    "component": "ClaudeDesktop",
    "message": "Could not read chat DB — Full Disk Access may be required",
    "suggestion": "Grant Full Disk Access in System Settings → Privacy & Security"
  }
]

---

sieve_scan_history

Returns past scan job summaries.

Input: { "limit": 10 } (optional)

Response:

[
  {
    "jobId": "job1",
    "startedAt": "2026-05-22T10:00:00Z",
    "finishedAt": "2026-05-22T10:00:12Z",
    "sourcesCount": 4,
    "findingsCount": 3,
    "issuesCount": 0
  }
]

---

sieve_scan_status

Returns status of the current or most recent scan.

Response:

{ "status": "idle" }

Values: "idle" · "running" · "completed" · "failed: <reason>"

---

sieve_check_text

Checks whether text contains secrets. Returns boolean only — never echoes input or detected values.

Input: { "text": "<content to check>" }

Response:

{ "has_secrets": true }

Use this to gate operations before sending content to an external API.

---

sieve_redact_text

Redacts secrets from text, replacing values with sieve:// placeholders.

Input: { "text": "<content>", "project_key": "myapp" }

Response:

{
  "redacted": "export STRIPE_KEY=sieve://myapp/stripe-secret-key",
  "hadSecrets": true,
  "placeholders": [
    {
      "ruleId": "stripe-secret-key",
      "placeholder": "sieve://myapp/stripe-secret-key",
      "fingerprint": "<fingerprint>"
    }
  ]
}

Raw values are never included in the response.

---

sieve_vault_run

Executes a command with macOS Keychain-resolved secrets injected as env vars. Secrets never transit the MCP channel.

Input: { "command": "npm run deploy", "fingerprints": ["<fingerprint>"] }

Response:

{
  "exit_code": 0,
  "succeeded": true,
  "timed_out": false,
  "stdout_line_count": 14,
  "stderr_line_count": 0
}

stdout/stderr content is never returned — only line counts.

---

Supported AI tool sources

Tool	Source
Claude Code	JSONL project transcripts
Claude Desktop	SQLite chat database
Cursor	SQLite state database
VS Code / Copilot Chat	JSON history files
Windsurf	JSON history files
Cline	JSON session files
Codex CLI	JSONL/JSON session files
Gemini CLI	JSON history files
.env files	Selected project roots
Custom sources	User-added folders

Sieve correlates findings across source types — if the same secret appears in both a transcript and a .env file, it is flagged as a multi-source exposure.

Security posture

• Local-only. stdio transport, no network calls, no cloud sync.
• No plaintext secrets in responses. Hard invariant in the dispatcher — not configurable.
• Fingerprint-only persistence. Findings DB stores HMAC fingerprints + redacted previews only.
• Keychain-backed vault. Secret values live in macOS Keychain with biometric access control.
• Explicit opt-in. MCP is off by default; requires toggle in Sieve Settings.
• Unreadable sources reported. SCAN_TARGET_UNREADABLE surfaces in sieve_issue_list — no silent skipping.

Transport

stdio. The sieve-mcp binary reads JSON-RPC 2.0 from stdin and writes to stdout. MCP clients (Claude Code, Claude Desktop) manage the process lifecycle.

Platform

macOS only. Requires Sieve app installed from the Mac App Store.

Links

• Mac App Store: https://apps.apple.com/app/sieve-ai-secret-scanner/id6747506504
• Product site: https://sieve.app