Sigil

What sigil MCP server does

The sigil MCP server gives Claude Code access to signing operations without placing private keys in the model's context window. It supports EVM personal messages, legacy and EIP-1559 transactions, EIP-712 typed data, and Solana message and transaction signing. The model receives opaque handles such as evm:executor rather than key material.

The project includes an MCP process, a control CLI, and Claude Code hook binaries. The hooks block reads from common key paths and redact strings that resemble keys from tool output. Policy files can apply static checks including chain IDs, destination allowlists, transaction value caps, function-selector allowlists, contract-creation controls, and toggles for personal signing and EIP-712. Optional out-of-band confirmation uses ntfy.

How it works

Each Claude Code window starts its own sigil-mcp process. It begins locked with no keys loaded, so signing requests fail until sigil unlock supplies the passphrase from another terminal. The CLI sends the passphrase through per-process Unix sockets under the sigil control directory, and one command can unlock or lock all active sessions.

Encrypted keyfiles remain on disk under the sigil home directory. When unlocked, the process decrypts them into memory; sigil lock, an unlock failure, or process shutdown clears the in-memory handle table. Closing Claude Code ends the process, so a later session requires another unlock. Open windows have separate in-memory keys but share the encrypted keyfiles and audit log.

The sigil MCP server uses a small stdio MCP wire implementation rather than an SDK. It requires Node 22 or newer and supports macOS and Linux; Windows is currently unsupported.

Setup and configuration

Install the npm package globally with npm install -g sigild. Run sigil init to register the MCP process and Claude Code hooks for a project, or use sigil init --user for user-wide configuration. Create a new EVM key with sigil portal new <handle>, or import a 32-byte or 64-character hexadecimal private key with sigil portal add. Imported source files are removed by default, and both commands create a policy file.

Start Claude Code, then run sigil unlock in a separate terminal. Use sigil lock to clear loaded keys without restarting the MCP process. SIGIL_HOME changes the default ~/.sigil location, while SIGIL_CONTROL_DIR changes the Unix-socket directory.

Tools and capabilities

• Sign EVM personal messages, legacy transactions, EIP-1559 transactions, and EIP-712 typed data.
• Sign Solana ed25519 messages and transactions.
• Create or import encrypted key portals and list their derived addresses.
• Initialize, inspect, and apply per-portal policy files.
• Lock and unlock all active Claude Code sessions from the CLI.
• Enable a JSON-RPC signing proxy for a portal for Foundry or Hardhat workflows.

Limitations and notes

sigil is pre-alpha. Rolling-window value caps and EIP-712 domain allowlists are described as not yet released, and supply-chain attestations are planned for version 0.1.0. The project explicitly advises against using it with real funds before that release.

It is not a hardware-wallet replacement or a custody service. The key protection is specifically aimed at preventing an LLM agent from receiving private key material. The implementation uses Unix domain sockets, so Windows is not supported.