SigSieve

Least-privilege SSH agent forwarding for macOS and Linux.

SigSieve is an open-source, local SSH-agent filtering proxy. It lets you forward selected SSH identities instead of your entire agent, with optional restrictions on the destination host keys those identities may authenticate to.

Your existing agent—such as Secretive or OpenSSH ssh-agent—retains the private keys and performs signing. SigSieve enforces its policy in front of that agent; it does not store or export private keys.

Free and MIT-licensed. No account, telemetry, hosted service, or mandatory cloud dependency.

[!WARNING] Experimental security software — not independently audited. The current pre-release is v0.1.0-alpha.4. Automated security tests do not establish production-grade security assurance. Real Secretive signing and destination binding were observed on an earlier alpha.2 candidate, but Secretive/Touch ID behavior has not been reverified for alpha.4. Read the security model and known limitations before using agent forwarding, and retain an ordinary SSH access path.

Why SigSieve?

SSH agent forwarding can give processes on a remote machine access to identities exposed by your local agent for the lifetime of the connection. SigSieve is designed to reduce that exposure without requiring you to move or export a private key.

• Explicit identity allowlist. Permit keys by SHA-256 public-key fingerprint. Non-allowlisted identities are not listed or authorized for signing through the proxy.
• Optional destination binding. Restrict permitted signing to compatible, hostbound SSH authentication at approved destination host keys.
• Fail-closed agent protocol. Refuse unsupported operations, including adding/removing identities, locking/unlocking, PKCS#11 operations, and unknown requests.
• Keep your agent. Work with an existing Unix-socket SSH agent; SigSieve does not become a key store.
• Operator-friendly CLI. Inspect filtering with doctor, preview SSH connections with connect --dry-run, or serve a dedicated filtered socket with run.

How it works

Remote SSH process (untrusted)
            │
            │ agent request via SSH forwarding
            ▼
    SigSieve (on your computer)
    ├─ public-key fingerprint allowlist
    ├─ optional destination/session policy
    └─ agent-protocol checks
            │ permitted requests only
            ▼
    Your existing SSH agent
    (Secretive or OpenSSH ssh-agent)
            │
            └─ private keys remain with the upstream agent

SigSieve filters requests, not the security policy of the remote machine or the upstream agent. The upstream agent remains responsible for any user-presence or approval prompts.

Install

Download the v0.1.0-alpha.4 experimental release, then follow the verified installation guide. It checks the archive checksum, a separately pinned SHA-256 digest, and GitHub build provenance before installation.

Platform	Distribution
macOS ARM64 (Apple Silicon)	Prebuilt experimental archive
Linux x86_64 (Ubuntu 24.04 / glibc 2.39 baseline)	Prebuilt experimental archive
Linux ARM64	CI-tested; build from source
Intel macOS / Windows	Not validated

Homebrew (macOS, builds from source):

brew install semihbugrasezer/sigsieve/sigsieve

The tap builds the same immutable v0.1.0-alpha.4 tag from source and checks the source archive's SHA-256. That checksum is not GitHub build provenance; use the prebuilt archives and the installation guide if you need provenance verification. Tested on macOS Apple Silicon only. Uninstall with brew uninstall sigsieve && brew untap semihbugrasezer/sigsieve.

The checkout pins Rust 1.99.1 for builds; the declared minimum supported Rust version is 1.88. OpenSSH 8.4+ is required, with additional requirements for proxy hops and destination binding. There is no crates.io package, and macOS binaries are not notarized.

For a fully isolated demonstration without your own agent or remote hosts, start with the five-minute synthetic-key quickstart.

First safe check with OpenSSH (Linux or macOS)

The following commands only inspect your local agent and preview an SSH connection. They do not initiate a remote connection or request a real-key signature.

upstream="${SSH_AUTH_SOCK:?Start or select an SSH agent first}"
SSH_AUTH_SOCK="$upstream" ssh-add -l

# Replace this placeholder with one of your agent's public fingerprints.
fp='SHA256:REPLACE_WITH_YOUR_KEY_FINGERPRINT'

sigsieve doctor --upstream "$upstream" --allow-fingerprint "$fp"
sigsieve connect build-host --upstream "$upstream" --allow-fingerprint "$fp" \
  --dry-run -- -o StrictHostKeyChecking=yes

Use an SSH alias in place of build-host. Verify the destination's host key through a trusted channel and inspect the dry-run plan before opening an actual connection. See check, preview, connect, and cleanup.

First session with Secretive (macOS)

If you use Secretive, first inspect its public fingerprints locally:

SSH_AUTH_SOCK="$HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh" ssh-add -l

Select one fingerprint and check the policy without connecting:

fp='SHA256:REPLACE_WITH_YOUR_KEY_FINGERPRINT'

sigsieve doctor --secretive --allow-fingerprint "$fp"
sigsieve connect build-host --secretive --allow-fingerprint "$fp" \
  --dry-run -- -o StrictHostKeyChecking=yes

After independently verifying the host key and reviewing the SSH plan, the corresponding real connection is:

sigsieve connect build-host --secretive --allow-fingerprint "$fp" \
  -- -o StrictHostKeyChecking=yes

A remote ssh-add -l should expose only the identity you allowed. Disconnect when forwarding is no longer needed. connect disables connection sharing, port forwarding, and X11 forwarding for the session. See Secretive integration for caveats and device-test scope; a successful automated OpenSSH test does not establish Touch ID behavior.

Protection and limits

SigSieve has two modes. Identity filtering is the default; destination binding must be explicitly configured and requires compatible SSH hostbound authentication.

Capability	Identity filtering	Destination binding (--allow-destination)
Public identities visible through the proxy	Allowlisted only	Allowlisted only
Identities permitted to sign through the proxy	Allowlisted only	Allowlisted only
Permitted signing	Arbitrary agent signing requests for an allowed key	Compatible SSH user authentication bound to approved destination host keys
Unsupported or mutating agent operations	Denied	Denied

Know the boundaries:

• A compromised remote host may still use an allowed identity while forwarding is active. Filtering alone does not constrain which servers trust that key.
• Destination binding restricts final destination host keys, not remote usernames or every intermediate hop; it requires compatible OpenSSH hostbound authentication. Generic signing (for example, git commit -S) is intentionally refused in this mode.
• SigSieve cannot secure a compromised local user account or upstream agent, replace host-key verification, or guarantee a separate Touch ID prompt for each signature.
• A recorded-session replay limitation remains documented; macOS cross-user testing and independent external auditing are not complete.

For the full boundary and evidence, see the security model, threat model, SSH compatibility matrix, and known limitations.

Do you need it?

Your goal	Consider first
Access a host through a bastion without forwarding agent credentials	OpenSSH ProxyJump
Choose a key for your own local SSH login	IdentityFile, IdentityAgent, and IdentitiesOnly
Forward only a few exportable keys	A dedicated ssh-agent loaded with only those keys
Restrict keys in OpenSSH's own agent	OpenSSH ssh-add -h destination constraints
Forward one non-exportable identity from an existing agent	Evaluate SigSieve's filtering and its limitations

Verification and release integrity

The published v0.1.0-alpha.4 release is pinned to source commit 5ea37b73ce7ed5dd33f3ac405c3ae4ad4da68751, not the moving tip of main.

Evidence	What was verified
Candidate CI	Rust tests and real OpenSSH integration, including platform-specific checks
F-46 Linux cross-user run	Peer-credential restriction and its negative test; not a macOS cross-user test
Release rehearsal	Build, reproducible packaging, smoke checks, SBOM generation, artifact-binding checks
Fuzz campaign	Four targets, 3,600 seconds each; 287,516,615 executions with no reported crash
Release build	Published artifacts, SHA-256 checksums, CycloneDX SBOMs, and provenance attestations
Linux release verification	Native archive and verification checks

Evidence is specific to the tested revision and is not a security certification. Full test descriptions and historical results are in TESTING.md; remaining findings are in FINDINGS.md.

Documentation and contributions

Start here	Reference
Installation and first use	Install · Synthetic-key quickstart · Usage and troubleshooting
Security	Security model · Threat model · Limitations · Report a vulnerability
Technical details	Architecture · SSH compatibility · Testing · Protocol references
Project	Contributing · Changelog · Support · Code of conduct

Contributions, reproducible bug reports, and independent security review are welcome. Please review CONTRIBUTING.md before opening a pull request, and use the private reporting channel described in SECURITY.md for suspected vulnerabilities. Do not post real agent listings, hostnames, or private-key material in public issues.

---

License: MIT. See third-party notices for distribution and dependency information.