DOCUMENTATION
Run Sieve in five minutes.
Sieve is a local LLM-traffic security proxy — one Rust binary between your coding agent and the LLM API. These docs cover install, the detection engine, and how to verify every claim yourself.
Quickstart
$ cargo build --release # build from source — brew & signed .dmg coming soon
$ sieve setup
$ sieve doctor && sieve decisions watch
INSTALL
Quickstart — install & verify
Build from source today; signed .dmg releases (cosign-verified before install) are coming soon — plus how to re-verify by hand.
THREAT MODEL
Threat model
Prompt injection, secret exfiltration and malicious tool calls — what Sieve defends against, and what stays out of scope.
CONCEPT
Outbound redaction
How prompts are scanned and secrets are replaced in place before they leave 127.0.0.1.
CONCEPT
Inbound interception
How responses are held, and how Critical tool calls fail closed without a human beat.
RULES
The rule engine
Severity levels, the built-in crypto ruleset, and the format for writing your own.
CLI
Command reference
sieve setup, doctor, decisions watch, rules list, audit query, and every flag with examples.
VERIFY
Reproduce it yourself
Run the open test suite and the hermetic end-to-end harness locally — watch the engine's verdicts yourself.