MCP.Market

Sigil MCP server

by cdrn·io.github.cdrn/sigil·v0.0.6·3 stars
No reviews yet

Local keystore + MCP server. Claude can sign EVM transactions but never sees the private key.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
New

3 stars

Reviews

Write one

Nobody has reviewed Sigil yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Sigil tools (4)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • sigil_eth_sign_message

    Sign an EIP-191 personal_sign message with the named portal. The message is supplied as 0x-prefixed hex bytes (encode strings to UTF-8 first). Returns the 65-byte r||s||v signature as 0x-prefixed hex.

  • sigil_eth_sign_transaction

    Sign an Ethereum transaction (legacy or EIP-1559) with the named portal. Returns the signed transaction as 0x-prefixed hex, ready for eth_sendRawTransaction.

  • sigil_eth_sign_typed_data

    Sign an EIP-712 typed data structure with the named portal. Returns the 65-byte signature as 0x-prefixed hex.

  • sigil_list_portals

    List the signing portals currently loaded in sigil. Returns each portal handle (e.g. "eth:executor"), its kind, and the public address it controls.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan105 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 11 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Sigil compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
4
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,688 servers

What its tools let an agent do: 4 read

Install Sigil in Claude Code, Cursor or VS Code

Runs npx -y sigild on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add sigil -- npx -y sigild
Add to Cursor

What the publisher says

From the Sigil repository's README, as published. We do not edit it. Read it on GitHub

sigil

Claude can sign, but never see.

sigil is a local signing tool and Claude Code integration that lets agentic coding tools use private keys without ever putting key material in the model's context window.

Status: pre-alpha. The MCP server, CLI, unlock flow, ward hooks, policy engine (static checks), out-of-band confirmation via ntfy, Solana signing, and the JSON-RPC signing proxy (Foundry/Hardhat) all work end-to-end. Rolling-window value caps and EIP-712 domain allowlists landed in the policy engine, but have not been through a release yet. Until v0.1.0 ships — with the supply-chain attestations promised for it — do not use this with real funds yet. Build plan lives in the tracking issue.

What it is

One MCP server process, four bins (plus a legacy sigild alias), six runtime deps (all pinned, zero transitive):

  1. sigil-mcp — the only thing that runs. Claude Code spawns it per session via your mcpServers config; it dies when Claude exits. Holds unlocked keys in process memory (zeroized on shutdown, sigil lock, or unlock-failure; mlock against swap is planned). Keys at rest are encrypted with XChaCha20-Poly1305 and an Argon2id-derived key. Signs over stdio using a DIY MCP wire protocol (~200 lines, no SDK dep). Claude never sees key material — only opaque handles like evm:executor.
  2. sigil — control CLI. init, status, portal new/add/list/qr/remove, policy show/init, unlock, lock.
  3. sigil-hook-pre / sigil-hook-post — Claude Code hook binaries that block reads of common key paths and redact key-shaped strings from tool output.

sigil-mcp boots locked: empty in-memory handle table, no keys loaded. Sign methods return DAEMON_LOCKED (-32003) with a "run sigil unlock" message until you push the passphrase in from a separate terminal via sigil unlock. That CLI connects to a per-session Unix socket at ~/.sigil/control/.sock (0600) that sigil-mcp opens at startup — and fans out to every such socket so one sigil unlock reaches all open windows. After unlock, signs work for the rest of the session; sigil lock zeroizes the table without killing the process.

Sign methods exposed today: EIP-191 personal_sign, EIP-1559 + legacy transactions, EIP-712 typed data, plus Solana (ed25519) message + transaction signing — see Solana support below.

What it isn't

  • Not a hardware wallet replacement. If you can use a Ledger or YubiKey, do that.
  • Not a custody solution. It runs on your laptop or VPS and protects you from one specific class of failure: leaking key material through an LLM agent.
  • A first cut of bounding signing authority via the policy engine — but not the full thing. Shipped: static checks (chain ID, destination allowlist, per-tx value cap, function-selector allowlist, contract-creation gating, on/off toggles for personal_sign and EIP-712) plus out-of-band human confirmation via ntfy. Rolling-window caps and EIP-712 domain allowlists are tracked in #3 and will land incrementally.

Install

npm install -g sigild

This drops four binaries on your $PATH: sigil, sigil-mcp, sigil-hook-pre, sigil-hook-post (plus sigild, a legacy alias for sigil-mcp). (The package name on npm is sigild for legacy reasons; the bins do not include a daemon any more.)

Requires Node 22+, macOS or Linux. (The CLI ↔ session control channel uses Unix domain sockets; Windows is untested and currently unsupported.)

Quick start

# 1. Wire sigil into Claude Code (project-scoped). Pass --user to do it globally.
sigil init

# 2a. Generate a fresh key inside sigil (no plaintext ever hits disk):
sigil portal new evm:bot
# → prompts for a passphrase, mints a fresh secp256k1 key, prints the
#   address, writes ~/.sigil/keys/evm:bot.sigil + permissive policy.
#
# 2b. OR import an existing private key from a file:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Sigil: common questions

Is Sigil MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Sigil safety report
How do I install Sigil?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Sigil need an API key?
No secret keys are declared. It reads 2 settings from the environment.
Is Sigil maintained?
The last commit was 49 days ago (2026-09-16). The latest release is v0.0.6.
How does Sigil compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 4 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.