Sievant

Sievant puts a security checkpoint between AI agents and the tools they call.

It sits in front of MCP (Model Context Protocol) servers and checks every tool call: who is calling, whether they may, what goes in and what comes back.

What it blocks OWASP LLM Top 10 mapping

Two ways to run it

On a developer's machine, in front of the MCP servers that Claude Desktop, Claude Code, Cursor, VS Code and Windsurf launch: sievant scan audits their configurations, sievant wrap routes the servers through Sievant, and sievant ui shows what happened.
As a gateway for a team or a cluster: one process, or a Kubernetes sidecar, that serves databases, REST and gRPC APIs, Prometheus and Loki, and other MCP servers as tools, with identity, per-agent policies and rate limits.

It adds about 0.25 ms per call at the 99th percentile (proxy overhead, measured on a development machine). The figure is the proxy-overhead p99 from the TestProxyOverheadBudget runs recorded in the repository's BASELINE.md; the release gate is 2 ms.

On your machineFrom the README

sievant scan        # read-only: what is risky in your MCP client configurationssievant wrap --all  # route those servers through Sievant (backs up every file first)sievant ui          # calls, decisions, blocked actions and redactions (127.0.0.1, one-time link)sievant unwrap      # restore the original configurations, byte for byte

What it blocks

Real responses, recorded against the synthetic MCP server in Sievant’s tests.

A credential in a tool's arguments. The call never reaches the server.
Sievant
```
Arguments contain a credential (aws_access_key); call blocked.
```
Secrets in what a tool returns. Credentials, keys and the server's own secrets are redacted before the agent sees them.
Sievant
```
the secret is [REDACTED:mcp_secret]
```
A tool that changes its definition after you started using it (a "rug pull") is withheld until you accept it.
Sievant
```
upstream tool withheld: its definition changed since it was pinned on first use
```
Prompt injection in a tool's result. Every result is scored; the strict profile withholds the high-confidence tier.
Sievant
```
The tool's result looks like a prompt-injection attempt and was withheld.
```
Paths and URLs outside an allowlist. The agent learns only that the value is not permitted.
Sievant
```
Argument 'path': value not permitted by policy
```

Risky client configurations, before anything runs. Secrets are masked in every output.

Sievant

CRITICAL SEC001 github env.GITHUB_PERSONAL_ACCESS_TOKEN: Hard-coded GitHub tokenHIGH PERM001 files args[2]: Access to the whole filesystemHIGH SUP002 installer args: Server launched by a script downloaded at start

Is your MCP setup leaking?

sievant scan reads the MCP server configuration of Claude Desktop, Claude Code, Cursor, VS Code and Windsurf, plus the project files in the current directory. It never changes them.

What the scan checks

What stays on your machine

Sievant sends no telemetry. It contacts only the servers and backends you configure.

The audit trail is a SQLite file on your machine. It never holds raw arguments, only a keyed hash of them, and it never holds results. Exports (OTLP, syslog or a webhook) are off unless you configure them.

See a sample posture report · How findings are rated · FAQ

Want a review of your setup?

The Agent Security Review delivers a threat model, Sievant deployed (observe first, then enforce) and a posture report for your customer’s security review.

From $7,500, 1–2 weeks.

Book a call Pricing

Paying for inference too?

Tokvera measures what your LLM endpoint costs and how it behaves under load. Halotrcer runs both and writes one report.

Launching soon

Sievant isn’t released yet

Install commands will appear here on release day. Until then, book a call to talk through your setup, or email us.

Book a call Email satyajit.rajaraman@halotrcer.com