SigSieve

Forward only the SSH keys you choose.

SigSieve is a small local proxy for SSH agent forwarding on macOS and Linux. When you forward your agent to a remote machine, the remote side sees only the keys you allow. Your keys stay in your existing agent, such as Secretive or OpenSSH ssh-agent, and are never exported.

Warning

Not independently audited. Automated tests do not establish production-grade security, and real-device Secretive testing covers one configuration. Read the security model and limitations before forwarding an agent, and keep an ordinary SSH access path.

Why use it

• Hide the keys a server does not need. Forward one key instead of your whole agent.
• Keep your agent. Works in front of Secretive's Secure Enclave keys, which cannot be moved into another agent.
• Optionally bind signing to a destination. With --allow-destination, an allowed key signs only SSH logins to approved host keys.
• Check before you connect. doctor verifies the setup and connect --dry-run shows the exact SSH plan.

If your keys can be exported, OpenSSH's own ssh-add -h may be enough. See Do you need SigSieve?

Install

macOS (Apple Silicon):

brew install semihbugrasezer/sigsieve/sigsieve

Linux x86_64 (glibc 2.39+): use the verified prebuilt archive. Linux arm64 and older systems: build from source. Intel macOS and Windows are not validated. Requires OpenSSH 8.4+; no sudo, no changes to ~/.ssh.

Quick start

Nothing in steps 1 and 2 connects anywhere or signs with your key. Want to try it with a throwaway agent first? See the five-minute quickstart.

1. Choose your agent and the key to allow. List public fingerprints, then copy one.

OpenSSH agent:

src=(--upstream "${SSH_AUTH_SOCK:?start an SSH agent first}")
ssh-add -l

Secretive:

src=(--secretive)
SSH_AUTH_SOCK="$HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh" ssh-add -l

fp='SHA256:REPLACE_WITH_YOUR_KEY_FINGERPRINT'

2. Check the setup, then preview the connection (build-host is your SSH host alias):

sigsieve doctor "${src[@]}" --allow-fingerprint "$fp"
sigsieve connect build-host "${src[@]}" --allow-fingerprint "$fp" --dry-run -- -o StrictHostKeyChecking=yes

A working setup ends with:

Approved identities: 1/1 available
Hidden identities:  0 (not shown)
Filtering:          verified (temporary socket exposed 1 identity, non-allowlisted sign request rejected)

Result: all checks passed

doctor also prints a denied sign request line: that is its self-test with a synthetic key, not one of your keys.

3. Connect. After verifying the host's key through a trusted channel, run the same connect command without --dry-run. On the remote host, ssh-add -l lists only the key you allowed.

More: destination binding, a stable socket for ssh_config, every option and troubleshooting are in USAGE.md.

Security at a glance

• A compromised remote host can still use an allowed key while forwarding is on. Forward only what that host needs, and disconnect when done.
• Destination binding checks the final destination's host key, not usernames or intermediate hops, and needs OpenSSH hostbound authentication.
• Replay of a recorded session is bounded, not prevented. With Secretive, a cancelled Touch ID prompt means reconnecting.
• Release files are immutable and come with SHA-256 checksums, SBOMs and build provenance. Test evidence is specific to the tested revision and is not a security certification.

Details: security model · limitations · threat model · v1.0.0 evidence · findings

Documentation

Use	Install · Quickstart · Usage and troubleshooting · Secretive · SSH compatibility
Security	Security model · Threat model · Limitations · Findings · Testing
Project	Architecture · Changelog · Contributing · Governance · Support

Feedback and support

Tried it? Tell us what worked and what did not: compatibility report · installation problem · bug report. Remove real fingerprints, hostnames and IP addresses first.

Security vulnerabilities: never in a public issue. Use private vulnerability reporting (SECURITY.md).

---

License: MIT. See third-party notices.