Sample reports
What Sievant reports
Two reports, rendered from their JSON: the posture report (sievant report), written for a customer’s security review, and a client-configuration scan (sievant scan).
Posture report: Example Co, last 30d
Only 1 of the 2 MCP servers on this machine runs through Sievant; the other bypasses every control below. The server wrapped by sievant wrap runs under sievant proxy's defaults (credentials in arguments blocked, secrets redacted, prompt injection scored; no path or URL allowlists); sievant wrap --all --policy <file> applies a profile written by sievant init.
19 calls recorded; 13 blocked; 2 argument redactions and 3 result redactions.
Coverage gaps
- [high] 1 MCP server bypasses Sievant on this machine. These client servers talk to their agent directly, with no policy, redaction or audit: search (claude-desktop). Fix: sievant wrap --all routes them through Sievant (sievant unwrap restores the files).
- [medium] 1 medium finding in client configurations. sievant scan found issues such as unpinned server versions in the MCP client configurations. Fix: Run sievant scan and apply each finding's fix.
- [medium] MCP tool definitions are not pinned. Connector docs serves tools whose descriptions and schemas are not pinned, so a server could change what the model reads without review. Fix: Turn on pinning.first_use (pack description-pinning), or list each tool with its sha256 (sievant proxy --list-tools prints them).
- [medium] An agent may call every tool. The policy of ops-bot allows "*": a steered agent can reach every tool, including ones it never needs. Fix: Replace the wildcard with the tools the agent uses: sievant policy suggest --since 30d drafts that list from the audit trail.
- [info] The audit trail covers part of the period. The oldest record in the period is from 2026-10-10; the period starts 2026-09-19. Fix: Keep records for at least the reporting period (audit.local.retention), or report on a shorter --period.
Controls
| Control | Status | Detail |
|---|---|---|
| Enforcement mode (enforce or observe) | partial | Mode enforce: policy decisions stop the calls they refuse. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Agent authentication and identity | partial | API keys: 2 keys for 2 agents, stored as SHA-256 digests. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Transport security for agent connections | partial | TLS terminated by Sievant. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| MCP client servers routed through Sievant | partial | 1 of 2 MCP servers in the client configurations run through Sievant. |
| Deny-by-default policies for tools, prompts and resources, per agent | partial | 2 policies; ops-bot may call every tool (allow: "*"). Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Schema validation and argument constraints (min, max, in, matches, path_under, url_hosts) | partial | 1 argument constraint, on top of input-schema validation. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Path and URL argument rules for every tool | partial | Path arguments must be under 1 listed root; the other rule is not configured. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Credentials and personal data in tool arguments blocked or redacted | partial | Credentials in arguments: block; personal data in arguments: redact. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Credentials and personal data redacted from tool results | partial | Results are redacted before the agent sees them: email, credit_card, us_ssn, jwt, aws_access_key, pem_private_key, password. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Prompt-injection detection on arguments and results (flag, annotate, block) | partial | Arguments and results are scored; suspect results are annotated for the model and recorded, not blocked. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Tool definitions read once, pinned, and pinned on first use | partial | 1 of 2 MCP connectors pin their tools. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Upstream resources and prompts not served unchecked | partial | Upstream resources and prompts are withheld unless a connector serves them, and served ones pass the output checks. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Rate limits per agent and per tool | partial | Rate limits: 5 calls a second per agent by default (bursts of 10). Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Row, byte and response-memory budgets | partial | Results are capped at 65536 bytes and 1000 rows; row and byte budgets limit what an agent reads over time. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| SSRF guard on outbound connectors | partial | 1 network connector; private addresses are refused. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
| Client configuration audit (sievant scan) | partial | 1 client configuration file scanned; findings: 1 medium, 1 info (sievant scan lists them). |
| Audit trail of every call and security event | partial | Every call and security event is recorded in the local audit store, kept 30 days; inputs are sanitized and keyed with an HMAC, so a record can be matched to its input without storing it. Applies to the 1 of 2 MCP servers on this machine that run through Sievant. |
This report describes how Sievant is configured and what its audit trail recorded in the period. It is generated by the software from local data; it is not a certification, an audit or an attestation, and it covers only the MCP traffic that passes through Sievant.
Client-configuration scan
4 critical, 8 high, 7 medium, 1 low, 1 info.
| Severity | Rule | Finding | Where | Fix |
|---|---|---|---|---|
| critical | SEC001 | Hard-coded database URL with password | claude-desktop · db · args[2] | Move it to the environment or a secret store and reference it (for example ${SERVER_TOKEN}); then rotate it, since it has been on disk. |
| critical | SEC001 | Hard-coded GitHub token | claude-desktop · github · env.GITHUB_PERSONAL_ACCESS_TOKEN | Move it to the environment or a secret store and reference it (for example ${GITHUB_PERSONAL_ACCESS_TOKEN}); then rotate it, since it has been on disk. |
| critical | SEC001 | Hard-coded Slack token | cursor · slack · env.SLACK_BOT_TOKEN | Move it to the environment or a secret store and reference it (for example ${SLACK_BOT_TOKEN}); then rotate it, since it has been on disk. |
| critical | SEC001 | Hard-coded Anthropic API key | windsurf · remote · headers.Authorization | Reference it from the environment and rotate it. |
| high | NET001 | Remote server over plain HTTP | claude-code · plain · url | Use https://. |
| high | PERM001 | Access to the whole filesystem | claude-desktop · files · args[2] | Give the server only the directories it needs, for example the project directory. |
| high | SUP002 | Server fetched from a repository or URL at start | claude-desktop · git-source · args | Use a published release pinned to an exact version (or a commit hash). |
| high | SUP002 | Server launched by a script downloaded at start | claude-desktop · installer · args | Install a pinned release and run it directly. |
| high | SEC004 | Credential embedded in the server URL | claude-desktop · remote-bridge · args[2] | Rotate the URL with the provider if it has been shared, keep the file private, and prefer a provider option that authenticates with a header referenced from the environment. |
| high | SEC004 | Credential embedded in the server URL | cursor · cap-remote · url | Rotate the URL with the provider if it has been shared, keep the file private, and prefer a provider option that authenticates with a header referenced from the environment. |
| high | SEC004 | Credential embedded in the server URL | cursor · notes · url | Rotate the URL with the provider if it has been shared, keep the file private, and prefer a provider option that authenticates with a header referenced from the environment. |
| high | SEC002 | Literal value in secret-named field X-API-Key | vscode · api · headers.X-API-Key | Reference it from the environment (for example ${X_API_KEY}) and rotate it. |
| medium | AUTH001 | Remote server with no credential configured | claude-code · remote-noauth · url | Confirm the server requires authentication (OAuth or a header referenced from the environment). |
| medium | PERM003 | Server runs with the host network (container) | claude-desktop · docker · args[3] | Grant only the access the server needs (for Deno, --allow-net=<hosts>; for containers, a dedicated network). |
| medium | SUP001 | Unpinned server version | claude-desktop · docker · args | Pin the image by digest (image@sha256:…) or at least an exact version tag. |
| medium | SUP001 | Unpinned server version | claude-desktop · github · args | Pin an exact version, for example example/github-mcp@1.2.3 (with its scope), and update it deliberately. |
| medium | PERM002 | Access to the whole home directory | claude-desktop · home · args[2] | Give the server only the directories it needs. |
| medium | SUP001 | Server pinned to a moving tag (latest) | claude-desktop · latest · args | Pin an exact version (name==1.2.3) and update it deliberately. |
| medium | PERM003 | Server runs with all permissions (Deno) | cursor · deno · args[1] | Grant only the access the server needs (for Deno, --allow-net=<hosts>; for containers, a dedicated network). |
| low | CFG001 | Configuration file could not be read | custom · · | Fix the file so the client can read it too; until then its servers were not scanned. |
| info | SVT001 | Launched through Sievant | claude-desktop · wrapped · |