Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/sieveai-dev/sieve/agents-mdgit clone --depth 1 https://github.com/SieveAI-dev/sieveWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03562 | $0.03562 |
| Opus 5 | $0.01781 | $0.01781 |
| Sonnet 5 | $0.00712 | $0.00712 |
| Haiku 4.5 | $0.00356 | $0.00356 |
Grade A, and why
sieve AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
项目一句话
Sieve 是一个完全本地运行的 LLM 流量代理（Rust 单二进制），夹在 AI 编码 agent（Claude Code / OpenClaw / Hermes / Codex CLI）和上游模型之间，对 crypto 开发者做双向安全检测，在不可逆动作（签名 / 转账 / 部署）前强制插入认知摩擦。
项目状态
早期预览（0.1.0-alpha）。Cargo workspace 8 crate（sieve-core / sieve-rules / sieve-policy / sieve-cli / sieve-ipc / sieve-hook / sieve-updater / sieve-testing）+ fuzz crate；sigstore + 可复现构建 CI 在跑。能力面：双向检测、四路由内容类型对等覆盖、出站 exfil 链与 canary 诱饵检测、WIF/xprv 私钥格式检测、配置化路由表 [[upstream.routes]]、ProviderCodec 协议分层、四家 agent 接入。源码在 crates/ 下，文档与代码已对齐。
Source of Truth 层级
文档冲突时按以下优先级裁决（高 → 低）：
- IPC 协议规格 — docs/specs/SPEC-005-ipc-protocol.md（IPC wire schema 唯一权威源）+ 其余 docs/specs/ 功能规格
- 架构 / 数据模型 — docs/design/architecture.md + docs/design/data-model.md
- API / 部署 / 开发指南 —
docs/api/+docs/guides/ - README + .cursorrules — 项目入口与代码规范
约束：
- 改 IPC 字段先改 SPEC-005，再落代码
- 术语首次出现先去 docs/glossary.md 加条目，再在 SPEC 引用
不可放宽的硬约束（十六条 / .cursorrules §二）
任何 PR / 设计变更触碰以下任一条，默认拒绝，必须先和用户显式确认才能放宽：
- Rust 栈非选项 —— Go regexp 慢 1000 倍；hot loop 不允许引入非 Rust 二进制依赖
- 绝不联网做 verifier —— 任何外部 token / 签名 / 规则的远端校验都摧毁产品定位
- fail-closed High-Risk Tool Policy Gate —— 签名 / shell / 敏感路径的 Critical 工具调用强制人工确认，YOLO mode 不可关
- BIP39 必须做 SHA-256 checksum 验证 —— 仅词表匹配不足以定级 Critical（Sieve 差异化点）
- SSE 边界处理 fuzz test 全覆盖 —— 半行 chunk / 跨 chunk 分隔符 / C0 控制字符 / 多 event 粘包 / 提前断流，PR 不带 fuzz 不合并
- 自身供应链 sigstore + reproducible build + pinned deps —— Tier 1（macOS / Linux）Week 1 起强制；Windows 为 Tier 2
- Critical 拦截 FP < 0.5% —— 超过即用户禁用产品
- Critical 在所有版本（含降级模式）不可关闭 —— 产品安全承诺，不是用户偏好
- 适配四家 agent：Claude Code / OpenClaw / Hermes / Codex CLI —— UnifiedMessage 真实运行时支持 Anthropic Messages API + OpenAI Chat Completions 双协议；Codex CLI 走原生 PreToolUse hook（
~/.codex/hooks.json）经 IPC judge_tool_call 取裁决，OpenClaw / Hermes 两家 hook 作 UX 层、安全不变量由网关 inbound_hold 兜底 fail-closed；其他协议（Gemini / Mistral 等）推 Phase 2 - GA 一次性公开 repo + 代码 + 文档 —— sigstore CI pipeline 照常跑通
- 不在 Anthropic API 协议层撒谎 —— 不伪造 tool_use / stop_reason / id / usage / type；拦截发生时允许截 SSE 流注入
sieve_blockedevent（Sieve 自报事件，不是冒充模型）；keep-alive comment 行: keep-alive\n\n不属于伪造 - 不装本地 CA 做 MITM —— Network Extension / 本地 CA 注入 / 系统 proxy 修改推 Phase 3 选购，Phase 1/2 不做
- 出站脱敏不打断工作流 —— OUT-01~05/12 高频脱敏类必须自动脱敏 + 状态栏 5s 通知，不弹窗；每天弹几十次的产品没人用
- 用户规则系统 fail-safe（v2.0）—— 用户规则文件加载失败 / pattern 编译失败 / 安全 lint 拒绝 → daemon 必须正常启动 + 系统规则全功能；用户规则不能 override 或 suppress 系统 Critical；用户规则只能 High Ask/Warn/Mark，不能 Block / HookTerminal。详见 LayeredEngine 合并顺序
- 行为序列检测保守起步 + 默认关闭（v2.0）—— IN-SEQ-* 仅触发 StatusBar 通知，不引入新 Block 路径；默认关闭（feature flag
sequence_detection = false），用户主动 opt-in。升级为 Block 类需充分样本积累 + FP < 0.5% + 新决策记录。 - 所有入站能力必须经过 content-type 路由矩阵测试（v2.0）—— 任何新增入站功能必须有集成测试覆盖 4 类组合（Anthropic SSE / Anthropic JSON / OpenAI SSE / OpenAI stream=false JSON）；新功能只挂 SSE 不挂 JSON 视为 P0 漏洞。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 187 lines · 3,562 tokens per session scan A 6c27b9a43c18
sieve AGENTS.md is an instructions file published in the GitHub repository SieveAI-dev/sieve (2 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 3,562 tokens to every session, about $0.0178 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
pipelock AGENTS.md
Instructions for luckyPipewrench/pipelock, covering agents.md - pipelock contributor guide, quick reference, capability surface, build, test, lint and architecture.
guardana CLAUDE.md
Instructions for guardana/guardana, covering claude.md — agent guidance for this repository, what this project is, what "done" means right now, product principles — they outrank convenience, in every 0.x and architecture in brief.
pipelock CLAUDE.md
Instructions for luckyPipewrench/pipelock, a project described as: Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the…
SENTINEL CLAUDE.md
Claude Code instructions for codeit-ronit/SENTINEL, covering claude.md — sentinel, what this project is, hard rules — violating any of these is a build failure, research before implementing and working style.
jesse AGENTS.md
Instructions for jesse-ai/jesse, covering jesse repository guide for ai agents, skills, key characteristics, central framework and technology stack.
gmgn-skills CLAUDE.md
Instructions for GMGNAI/gmgn-skills, covering claude.md, critical rule — read this first, project overview, available skills and quick decision guide.