gautam-u/sieve-mcp

MCP server for Sieve — a macOS app that scans local AI coding tool history for secrets leaked into prompts.
sieve-mcp is bundled inside the Sieve Mac app. No separate install. No network calls. All operations run on-device.
Install
1. Download **Sieve for Mac** from the App Store.
2. Open Sieve → **Settings → MCP** → toggle **Enable MCP server** on.
Configure Claude Code
Add to ~/.claude/claude_desktop_config.json:
Restart Claude Code and run /mcp to verify sieve appears.
Configure Claude Desktop
Add the same block to ~/Library/Application Support/Claude/claude_desktop_config.json and restart.
Tools
All tools are **safe by design** — no tool ever returns a plaintext secret value.
sieve_health_status
Returns service health and finding counts.
**Response:**
---
sieve_self_test
Verifies scanner rules and transcript source coverage are healthy.
**Response:**
---
sieve_findings_list
Lists findings from the most recent scan.
**Input:** { "limit": 50 } *(optional)*
**Response:**
providerExposureAssumed: true — secret found in an AI tool transcript. Assume the provider (Anthropic, OpenAI, etc.) can associate the prompt with your account identity.
---
sieve_issue_list
Lists scanner health issues — unreadable sources, permission errors, parse failures.
**Response:**
---
sieve_scan_history
Returns past scan job summaries.
**Input:** { "limit": 10 } *(optional)*
**Response:**
---
sieve_scan_status
Returns status of the current or most recent scan.
**Response:**
Values: "idle" · "running" · "completed" · "failed: "
---
sieve_check_text
Checks whether text contains secrets. **Returns boolean only — never echoes input or detected values.**
**Input:** { "text": " " }
**Response:**
Use this to gate operations before sending content to an external API.
---
sieve_redact_text
Redacts secrets from text, replacing values with sieve:// placeholders.
**Input:** { "text": " ", "project_key": "myapp" }
**Response:**
Raw values are **never** included in the response.
---
sieve_vault_run
Executes a command with macOS Keychain-resolved secrets injected as env vars. Secrets never transit the MCP channel.
**Input:** { "command": "npm run deploy", "fingerprints": [" "] }
**Response:**
stdout/stderr content is **never** returned — only line counts.
---
Supported AI tool sources
| Tool | Source |
|------|--------|
| Claude Code | JSONL project transcripts |
| Claude Desktop | SQLite chat database |
| Cursor | SQLite state database |
| VS Code / Copilot Chat | JSON history files |
| Windsurf | JSON history files |
| Cline | JSON session files |
| Codex CLI | JSONL/JSON session files |
| Gemini CLI | JSON history files |
| .env files | Selected project roots |
| Custom sources | User-added folders |
Sieve correlates findings across source types — if the same secret appears in both a transcript and a .env file, it is flagged as a multi-source exposure.