sieve
中文
EARLY PREVIEW · ALPHA · 0.1.0-alpha

Zero Trust for the LLM
and the upstream.

A local Zero Trust gateway for LLM agents. Every upstream response, relay output, MCP result, web page, and generated tool call is untrusted by default — and every high-risk action is verified against local policy and your intent before it runs. One Rust binary on 127.0.0.1, fail-closed, every claim yours to verify.

$ get-started View on GitHub ↗
sieve — decisions watch
$ cosign verify-blob --signature sieve.sig sieve
✓ Verified OK — keyid 8F3A…D21
$ sieve decisions watch
→ outbound · redacted PRIVATE_KEY ×1 (0x4f…a9 → ●●●)
→ inbound  · BLOCKED transfer(2.4 ETH) fail-closed
→ inbound  · PASS read_balance()
→
4
content routes covered
2-way
inbound + outbound detection
<8ms
added latency · p50
1
binary · zero cloud
ZERO TRUST GATEWAY

Untrusted in. Verified out.

Sieve assumes every external input reaching your agent is hostile until proven otherwise, and gates every irreversible thing your agent can do. Between the two sits one local checkpoint — policy plus your intent — that nothing crosses unverified.

Untrusted by default 8 sources
Any input that can carry an injected instruction — not just the LLM.
LLMUpstream LLM response
RELAYRelay / proxy output
MCPMCP tool result
WEBFetched web page
REPOIssue / PR / README
MSGChat message
DOCExternal document
CALLLLM-generated tool call
untrusted · all routed to the gate
CHECKPOINT
SIEVE GATEWAY
Checked against local policy + your intent
✓matches → allow ✗violates → block · fail-closed
✓ Guarded actions 6 classes
Every high-risk thing an agent can execute — not just crypto.
⊟Read local secretsexfiltration
⊟Execute shellRCE
⊟Access networkexfil / C2
⊟Sign transactionsfund loss
⊟Install toolssupply chain
⊟Deploy codeproduction
only verified actions run
→ It stops prompt-injected instructions and unauthorized irreversible actions — at the gate, before they ever run.
ZERO TRUST

Trust nothing on the wire — not the LLM, not the upstream.

Coding agents now sign transactions, move funds, and deploy contracts on your behalf. The prompt leaves your machine with your secrets inside it; the LLM sends back tool calls that execute without a second look. Zero-trust means assuming either end can be wrong — and putting one checkpoint on the only wire you actually control.

01
Secrets leak outbound — keys, seed phrases and .env values ride along inside the context window.
02
Tool calls land inbound — transfer(), approve() and deploy() run with no human beat in between.
03
Cloud scanners can't help — they never see localhost traffic, and you can't audit what they do.
HOW IT WORKS

One checkpoint, the full round trip.

Point your agent's base URL at 127.0.0.1. Watch a single request travel out, get sanitized, return, and get inspected before anything irreversible runs.

DETECTION

Built for crypto's irreversible actions.

The gateway is general; the ruleset is not. Crypto is where Sieve goes deepest — detection no general-purpose guard reaches — tuned for the actions you can never take back, across every route the agent and the model can take.

KEY
Private keys & seed phrases
Entropy- and format-aware matching for raw keys, mnemonics and keystore blobs.
SIGN
Signing requests
eth_sign, personal_sign and typed-data prompts are flagged before they leave.
TX
Transfers & approvals
transfer() and unlimited approve() calls are held for a confirming human beat.
DEPLOY
Contract deploys
New bytecode deployments are surfaced with the target chain and gas in view.
ENV
.env & credentials
API tokens, RPC URLs and credential files are redacted in place, not blocked.
INJECT
Prompt-injected calls
Tool calls the LLM was talked into are caught on the inbound side, fail-closed.
SWAP
Address swaps
A 0x address that comes back subtly changed from the one in your prompt is flagged before you sign.
CANARY
Canary decoys
Decoy secrets are planted so any attempt to read or exfiltrate them raises an inbound alert.
TRUST MODEL

Verifiable, not trusted.

✓
Signed builds
cosign-verify every release against our published public key before you run it.
✓
Runs local
Detection happens on your machine. Nothing about your traffic is sent to us.
✓
Open engine
Read the rules and run the test suite yourself — nothing about the detection is hidden.
✓
Fail-closed
If Sieve can't reach a decision, the action does not happen. Critical rules can't be disabled.
GET STARTED

Up in one command.

Works with Claude Code, Codex CLI, OpenClaw and Hermes — any agent that speaks the Anthropic or OpenAI API.

01
$ brew install SieveAI-dev/homebrew-tap/sievecoming soon
A signed binary via Homebrew is on the way. For now, build from source or join the alpha preview — watch the repo to get notified.
02
$ sieve setup && sieve doctor
Starts the daemon on 127.0.0.1:11453, wires up your agent, and checks the install — no local cert, no MITM.
03
$ export ANTHROPIC_BASE_URL=http://127.0.0.1:11453
Point your agent's base URL at the local daemon — sieve setup writes it into your agent's settings automatically, and wires Codex CLI up through a hook. That is the whole integration.
Read the docs → ★ Watch the first release no account · your traffic goes only to your chosen upstream, never to us · update check fully disableable
NOTES
LLM — the large language model behind an agent; its output can be steered, so it is untrusted.
Zero Trust — grant nothing implicit trust; verify every request against policy.
AI agent — an LLM wired to real tools that act on your behalf, not just chat.
Prompt injection — a hostile instruction hidden in normal content to hijack the LLM.
MCP — Model Context Protocol — the standard interface agents use to call external tools.
Fail-closed — when a check is uncertain, block rather than allow.