SigSieve
Forward only the SSH keys you choose.
SigSieve is a small local proxy for SSH agent forwarding on macOS and Linux. When you forward your agent to a remote machine, the remote side sees only the keys you allow. Your keys stay in your existing agent, such as Secretive or OpenSSH ssh-agent, and are never exported.
[!WARNING]
Not independently audited. Automated tests do not establish production-grade security, and real-device Secretive testing covers one configuration. Read the security model and limitations before forwarding an agent, and keep an ordinary SSH access path.
Why use it
- Hide the keys a server does not need. Forward one key instead of your whole agent.
- Keep your agent. Works in front of Secretive's Secure Enclave keys, which cannot be moved into another agent.
- Optionally bind signing to a destination. With
--allow-destination, an allowed key signs only SSH logins to approved host keys.
- Check before you connect.
doctor verifies the setup and connect --dry-run shows the exact SSH plan.
If your keys can be exported, OpenSSH's own ssh-add -h may be enough. See Do you need SigSieve?
Install
macOS (Apple Silicon):
brew install semihbugrasezer/sigsieve/sigsieve
Linux x86_64 (glibc 2.39+): use the verified prebuilt archive. Linux arm64 and older systems: build from source. Intel macOS and Windows are not validated. Requires OpenSSH 8.4+; no sudo, no changes to ~/.ssh.
Quick start
Nothing in steps 1 and 2 connects anywhere or signs with your key. Want to try it with a throwaway agent first? See the five-minute quickstart.
1. Choose your agent and the key to allow. List public fingerprints, then copy one.
OpenSSH agent:
src=(--upstream "${SSH_AUTH_SOCK:?start an SSH agent first}")
ssh-add -l
Secretive:
src=(--secretive)
SSH_AUTH_SOCK="$HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh" ssh-add -l
fp='SHA256:REPLACE_WITH_YOUR_KEY_FINGERPRINT'
2. Check the setup, then preview the connection (build-host is your SSH host alias):
sigsieve doctor "${src[@]}" --allow-fingerprint "$fp"
sigsieve connect build-host "${src[@]}" --allow-fingerprint "$fp" --dry-run -- -o StrictHostKeyChecking=yes
A working setup ends with:
Approved identities: 1/1 available
Hidden identities: 0 (not shown)
Filtering: verified (temporary socket exposed 1 identity, non-allowlisted sign request rejected)
Result: all checks passed
doctor also prints a denied sign request line: that is its self-test with a synthetic key, not one of your keys.
3. Connect. After verifying the host's key through a trusted channel, run the same connect command without --dry-run. On the remote host, ssh-add -l lists only the key you allowed.
More: destination binding, a stable socket for ssh_config, every option and troubleshooting are in USAGE.md.
Security at a glance
- A compromised remote host can still use an allowed key while forwarding is on. Forward only what that host needs, and disconnect when done.
- Destination binding checks the final destination's host key, not usernames or intermediate hops, and needs OpenSSH hostbound authentication.
- Replay of a recorded session is bounded, not prevented. With Secretive, a cancelled Touch ID prompt means reconnecting.
- Release files are immutable and come with SHA-256 checksums, SBOMs and build provenance. Test evidence is specific to the tested revision and is not a security certification.
Details: security model · limitations · threat model · v1.0.0 evidence · findings
Documentation
Feedback and support
Tried it? Tell us what worked and what did not: compatibility report · installation problem · bug report. Remove real fingerprints, hostnames and IP addresses first.
Security vulnerabilities: never in a public issue. Use private vulnerability reporting (SECURITY.md).
License: MIT. See third-party notices.
