Borrowing it
Nothing to install: this file belongs to SieveAI-dev/sieve. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SieveAI-dev/sieve/main/CLAUDE.mdgit clone --depth 1 https://github.com/SieveAI-dev/sieveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/sieveai-dev/sieve/claude-md)<a href="https://agentmods.dev/instructions/sieveai-dev/sieve/claude-md"><img src="https://agentmods.dev/badge/instructions/sieveai-dev/sieve/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/sieveai-dev/sieve/claude-md"><img src="https://agentmods.dev/badge/instructions/sieveai-dev/sieve/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.04001 | $0.04001 |
| Opus 5.5 | $0.01600 | $0.01600 |
| Sonnet 5.5 | $0.00800 | $0.00800 |
| Haiku 4.5 | $0.00400 | $0.00400 |
Grade A, and why
sieve CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
项目一句话
Sieve 是一个完全本地运行的 LLM 流量代理（Rust 单二进制），夹在 AI 编码 agent（Claude Code / OpenClaw / Hermes / Codex CLI）和上游模型 API（Anthropic / OpenAI / 中转站）之间，对 crypto 开发者做双向安全检测，在不可逆动作（签名 / 转账 / 部署）前强制插入认知摩擦。
项目状态
早期预览（0.1.0-alpha）。
能力面：双向检测（出站脱敏自动改写不弹窗 + 入站 fail-closed 拦截 Critical 工具调用）、四路由内容类型对等覆盖（Anthropic/OpenAI × SSE/JSON）、出站 exfil 链与 canary 诱饵检测、WIF/xprv 私钥格式检测、配置化路由表 [[upstream.routes]]、ProviderCodec 协议分层、四家 agent 接入。Cargo workspace 8 个 crate；sigstore + 可复现构建 CI 在跑。daemon ↔ client 走 IPC（JSON-RPC over Unix socket，协议版本白名单仅 v2，权威源 SPEC-005）。源码在 crates/ 下。
Source of Truth 层级
文档冲突时按以下优先级裁决（高 → 低）：
- IPC 协议规格 — docs/specs/SPEC-005-ipc-protocol.md（IPC wire schema 唯一权威源）+ 其余 docs/specs/ 功能规格
- 架构 / 数据模型 — docs/design/architecture.md + docs/design/data-model.md
- API / 部署 / 开发指南 —
docs/api/+docs/guides/ - README + .cursorrules — 项目入口与代码规范
约束：
- 改 IPC 字段先改 SPEC-005，再落代码
- 术语首次出现先去 docs/glossary.md 加条目，再在 SPEC 引用
不可放宽的硬约束（十六条 / .cursorrules §二）
任何 PR / 设计变更触碰以下任一条，默认拒绝，必须先和用户显式确认才能放宽：
- Rust 栈非选项 —— Go regexp 慢 1000 倍；hot loop 不允许引入非 Rust 二进制依赖
- 绝不联网做 verifier —— 任何外部 token / 签名 / 规则的远端校验都摧毁产品定位。唯一允许的出站：①上游 LLM API（用户主动调）②
updates.sieveai.devmanifest（带?v=&os=&arch=&uid=&ch=5 字段,可关）③cdn.sieveai.dev规则正文（更新通道协议） - fail-closed High-Risk Tool Policy Gate —— 签名 / shell / 敏感路径的 Critical 工具调用强制人工确认，YOLO mode 不可关
- BIP39 必须做 SHA-256 checksum 验证 —— 仅词表匹配不足以定级 Critical（Sieve 差异化点）
- SSE 边界处理 fuzz test 全覆盖 —— 半行 chunk / 跨 chunk 分隔符 / C0 控制字符 / 多 event 粘包 / 提前断流，PR 不带 fuzz 不合并
- 自身供应链 sigstore + reproducible build + pinned deps —— Tier 1（macOS / Linux）Week 1 起强制；Windows 为 Tier 2
- Critical 拦截 FP < 0.5% —— 超过即用户禁用产品
- Critical 在所有版本（含降级模式）不可关闭 —— 产品安全承诺，不是用户偏好
- 适配四家 agent：Claude Code / OpenClaw / Hermes / Codex CLI —— UnifiedMessage 真实运行时支持 Anthropic Messages API + OpenAI Chat Completions 双协议；Codex CLI 走原生 PreToolUse hook（
~/.codex/hooks.json）经 IPC judge_tool_call 取裁决，OpenClaw / Hermes 两家 hook 作 UX 层、安全不变量由网关 inbound_hold 兜底 fail-closed；其他协议（Gemini / Mistral 等）推 Phase 2 - GA 一次性公开 repo + 代码 + 文档 —— sigstore CI pipeline 照常跑通
- 不在 Anthropic API 协议层撒谎 —— 不伪造 tool_use / stop_reason / id / usage / type；拦截发生时允许截 SSE 流注入
sieve_blockedevent（Sieve 自报事件，不是冒充模型）；keep-alive comment 行: keep-alive\n\n不属于伪造 - 不装本地 CA 做 MITM —— Network Extension / 本地 CA 注入 / 系统 proxy 修改推 Phase 3 选购，Phase 1/2 不做
- 出站脱敏不打断工作流 —— OUT-01~05/12 高频脱敏类必须自动脱敏 + 状态栏 5s 通知，不弹窗；每天弹几十次的产品没人用
- 用户规则系统 fail-safe（v2.0）—— 用户规则文件加载失败 / pattern 编译失败 / 安全 lint 拒绝 → daemon 必须正常启动 + 系统规则全功能；用户规则不能 override 或 suppress 系统 Critical；用户规则只能 High Ask/Warn/Mark，不能 Block / HookTerminal。详见 LayeredEngine 合并顺序
- 行为序列检测保守起步 + 默认关闭（v2.0）—— IN-SEQ-* 仅触发 StatusBar 通知，不引入新 Block 路径；默认关闭（feature flag
sequence_detection = false），用户主动 opt-in。升级为 Block 类需充分样本积累 + FP < 0.5% + 新决策记录。 - 所有入站能力必须经过 content-type 路由矩阵测试（v2.0）—— 任何新增入站功能必须有集成测试覆盖 4 类组合（Anthropic SSE / Anthropic JSON / OpenAI SSE / OpenAI stream=false JSON）；新功能只挂 SSE 不挂 JSON 视为 P0 漏洞。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 204 lines · 4,001 tokens per session scan A ca4936358c24
sieve CLAUDE.md is an instructions file published in the GitHub repository SieveAI-dev/sieve (2 stars, last pushed 8d ago), licensed Apache-2.0. It adds 4,001 tokens to every session, about $0.0160 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.