Sigil

sigil

Claude can sign, but never see.

sigil is a local signing tool and Claude Code integration that lets agentic coding tools use private keys without ever putting key material in the model's context window.

Status: pre-alpha. The MCP server, CLI, unlock flow, ward hooks, policy engine (static checks), out-of-band confirmation via ntfy, Solana signing, and the JSON-RPC signing proxy (Foundry/Hardhat) all work end-to-end. Rolling-window value caps and EIP-712 domain allowlists landed in the policy engine, but have not been through a release yet. Until v0.1.0 ships — with the supply-chain attestations promised for it — do not use this with real funds yet. Build plan lives in the tracking issue.

What it is

One MCP server process, four bins (plus a legacy sigild alias), six runtime deps (all pinned, zero transitive):

1. `sigil-mcp` — the only thing that runs. Claude Code spawns it per session via your mcpServers config; it dies when Claude exits. Holds unlocked keys in process memory (zeroized on shutdown, sigil lock, or unlock-failure; mlock against swap is planned). Keys at rest are encrypted with XChaCha20-Poly1305 and an Argon2id-derived key. Signs over stdio using a DIY MCP wire protocol (~200 lines, no SDK dep). Claude never sees key material — only opaque handles like evm:executor.
2. `sigil` — control CLI. init, status, portal new/add/list/qr/remove, policy show/init, unlock, lock.
3. `sigil-hook-pre` / `sigil-hook-post` — Claude Code hook binaries that block reads of common key paths and redact key-shaped strings from tool output.

sigil-mcp boots locked: empty in-memory handle table, no keys loaded. Sign methods return DAEMON_LOCKED (-32003) with a "run sigil unlock" message until you push the passphrase in from a separate terminal via sigil unlock. That CLI connects to a per-session Unix socket at ~/.sigil/control/ .sock (0600) that sigil-mcp opens at startup — and fans out to every such socket so one sigil unlock reaches all open windows. After unlock, signs work for the rest of the session; sigil lock zeroizes the table without killing the process.

Sign methods exposed today: EIP-191 personal_sign, EIP-1559 + legacy transactions, EIP-712 typed data, plus Solana (ed25519) message + transaction signing — see Solana support below.

What it isn't

• Not a hardware wallet replacement. If you can use a Ledger or YubiKey, do that.
• Not a custody solution. It runs on your laptop or VPS and protects you from one specific class of failure: leaking key material through an LLM agent.
• A first cut of *bounding signing authority* via the policy engine — but not the full thing. Shipped: static checks (chain ID, destination allowlist, per-tx value cap, function-selector allowlist, contract-creation gating, on/off toggles for personal_sign and EIP-712) plus out-of-band human confirmation via ntfy. Rolling-window caps and EIP-712 domain allowlists are tracked in #3 and will land incrementally.

Install

npm install -g sigild

This drops four binaries on your $PATH: sigil, sigil-mcp, sigil-hook-pre, sigil-hook-post (plus sigild, a legacy alias for sigil-mcp). (The package name on npm is sigild for legacy reasons; the bins do not include a daemon any more.)

Requires Node 22+, macOS or Linux. (The CLI ↔ session control channel uses Unix domain sockets; Windows is untested and currently unsupported.)

Quick start

# 1. Wire sigil into Claude Code (project-scoped). Pass --user to do it globally.

sigil init

2a. Generate a fresh key inside sigil (no plaintext ever hits disk):

sigil portal new evm:bot

→ prompts for a passphrase, mints a fresh secp256k1 key, prints the

address, writes ~/.sigil/keys/evm:bot.sigil + permissive policy.

#

2b. OR import an existing private key from a file:

Accepts either 32 raw bytes or 64 hex chars (with optional 0x prefix).

sigil portal add evm:bot --key-file ./private.hex

→ same as above but seeded from the file. Source file is deleted by

default (pass --no-remove-source to keep it).

#

Either form: pass --strict to start with a locked-down policy template

you fill in before any sign succeeds.

3. Open Claude Code. It spawns sigil-mcp automatically via your MCP config.

sigil-mcp boots locked — the first sign attempt will return DAEMON_LOCKED.

4. In a separate terminal, push the passphrase to every running sigil-mcp.

sigil unlock

→ prompts once, decrypts every keyfile in ~/.sigil/keys/ into each open window

5. Use Claude Code. The sigil_* tools (EVM + Solana) will work for the rest of the session.

Optional: re-lock without restarting Claude.

sigil lock

If you close Claude Code, sigil-mcp exits and its memory is wiped. Open a new session and sigil unlock again — the encrypted keyfiles on disk persist.

CLI reference

sigil init [--user]

Project scope: writes the ward hooks to /.claude/settings.json and the MCP server registration to /.mcp.json. --user: writes hooks to ~/.claude/settings.json and the MCP server registration to ~/.claude.json. (Claude Code CLI reads MCP configs from .mcp.json / ~/.claude.json — not from settings.json.) Idempotent — preserves your unrelated settings, and on upgrade migrates any stale mcpServers.sigil entry out of settings.json.

sigil portal new [--strict] Generate a fresh secp256k1 key inside sigil, encrypt with your passphrase, write it to ~/.sigil/keys/ .sigil (mode 0600). No plaintext key ever lands on disk. Use this when you want a clean hot wallet for a bot (vs importing an existing key from a file). Also writes ~/.sigil/policy/ .toml — permissive by default, or --strict for a locked-down template.

sigil portal add --key-file [--no-remove-source] [--strict] Import an existing private key. Encrypts it with your passphrase and stores at ~/.sigil/keys/ .sigil (mode 0600). Handle format is : where kind is "evm". The source key file is deleted by default — pass --no-remove-source to keep it. Also writes ~/.sigil/policy/ .toml — permissive by default (signs anything), or --strict for a locked-down template you fill in before signs succeed.

sigil policy show Print the current policy file for a portal. Validates schema; exits 1 if the file is missing or malformed.

sigil policy init [--strict] Provision a policy file for an existing portal whose policy is missing (e.g. a keyfile from an older sigil version, or one you manually deleted). Refuses to overwrite — edit the file directly or remove it first. Defaults to permissive; --strict writes the locked-down template.

sigil rpc init --upstream [--port ] Enable the JSON-RPC signing proxy for a portal: generates a strong auth token and appends the [rpc] block to ~/.sigil/config.toml (refuses if one exists; preserves the rest of the file). Prints the ready-to-paste authenticated endpoint and forge invocation. Restart Claude Code sessions to pick it up.

sigil portal list List the encrypted keyfiles on disk with their derived addresses (EVM + Solana). Requires the passphrase.

sigil portal qr Render a portal's address as a terminal QR code (for funding it from a phone wallet). Requires the passphrase.

sigil portal remove Delete a keyfile from disk.

sigil unlock Prompt for the passphrase and push it to every running sigil-mcp at once (one per Claude window). After unlock, sign calls succeed for the rest of each session. Idempotent — sessions already unlocked are left as-is. Fails if no sigil-mcp is running (start a Claude Code session first).

sigil lock Tell every running sigil-mcp to zeroize and clear its in-memory keys. Re-unlock with sigil unlock — the sigil-mcp processes keep running.

sigil status Report which sigil-mcp sessions are running (one entry per window, with PID, unlocked flag, and loaded portals) and how many keyfiles exist on disk. Does not require the passphrase.

Set SIGIL_HOME to override ~/.sigil. Set SIGIL_CONTROL_DIR to override the control-socket directory.

Multi-window behaviour

Each Claude Code window spawns its own sigil-mcp, and each binds its own control socket at ~/.sigil/control/ .sock. They share the on-disk keyfiles + audit log but keep separate in-memory handle tables.

sigil unlock / lock / status fan out across every socket in ~/.sigil/control/, so a single sigil unlock loads keys into all currently-open windows — no more guessing which process the CLI reaches. Sockets left behind by hard-killed sessions are detected and cleaned up automatically on the next CLI call.

Each window still holds its own decrypted keys only for its own lifetime: closing a window zeroizes that session's keys, and a window opened *after* you unlock starts locked (run sigil unlock again to include it). Keys never outlive the Claude sessions that use them — a deliberate property from #23.

OS-keychain integration (planned, v0.3) will make unlock zero-touch for users who set it up.

After upgrading sigil, restart every Claude window's `sigil-mcp` (reconnect the MCP server or reopen the window, then sigil unlock again). A running sigil-mcp never reloads code, and daemons from different versions must not share ~/.sigil/audit.log: the lock protocol and the writer's chain checks are version-specific. ps -ax | grep sigil-mcp shows stragglers.

Policy engine

Once a portal is unlocked, signing authority over its key is real. To bound the blast radius of a successful prompt injection, every portal has a policy file at ~/.sigil/policy/ .toml. Two modes:

Permissive (default for sigil portal add): no rules. Sign anything the agent asks. The key isolation guarantees still hold — your key never enters the agent's context — but the unlocked portal can be made to sign whatever an attacker can get the agent to ask for. Useful for: testnet bots, demo flows, anyone who only cares about the context-window protection.

Strict (opt in with --strict): every sign request is checked. Generated template:

mode = "strict"

chain_ids = [1] # allowed chain IDs allow_to = [] # allowed destination addresses (lowercase 0x) max_value_wei = "0" # per-tx cap, in wei, as decimal string allowed_selectors = [] # 4-byte function selectors, e.g. "0xa9059cbb"

allow_contract_creation = false # deploys (to = null); when true, every

deploy still requires a confirm tap

allow_message_signing = false # EIP-191 personal_sign (e.g. SIWE) allow_typed_data = false # EIP-712 (Permit, OpenSea — can be financial) typed_data_verifying_contracts = [] # when allowed: domain.verifyingContract allowlist typed_data_primary_types = [] # when allowed: primaryType allowlist ("Permit", …)

strict mode also requires domain.chainId ∈ chain_ids

Optional rolling-window caps on tx.value (work in permissive mode too).

max_value_per_hour_wei = "100000000000000000" # 0.1 ETH / hour max_value_per_day_wei = "1000000000000000000" # 1 ETH / day

Optional: above this value, sigil pushes a notification to your phone and

waits for an approve/deny tap before signing. See "Out-of-band confirm"

below. Must be strictly less than max_value_wei.

require_confirm_above_wei = "10000000000000000" # 0.01 ETH

A failed rule throws POLICY_DENIED (-32001) back to the agent with the human-readable reason ("tx denied — value X exceeds max_value_wei Y"), and the deny is a