Sigil, developed by Ju571nK, is an open-source AI Security Posture Management tool that audits configuration files for agentic coding assistants. It scans .mcp.json and agent-specific settings to flag disabled sandboxes, broad tool permissions, and malicious hooks, then assigns a quantified risk score. The single Rust binary runs locally with zero telemetry, offers SIEM export, and supports Claude Code, Cursor, Codex, and Gemini CLI. It targets developers and security engineers who need visibility into configuration attack surfaces without interrupting development workflows.

Sigil focuses on the configuration attack surface for AI coding agents

As an AI-SPM utility, Sigil inspects the files that control agent behavior, including .mcp.json and agent-specific settings such as .claude/settings.json. It is tuned to the guard surface that appears when agents gain filesystem or tool access via the Model Context Protocol. The tool's primary deliverable is a configuration risk assessment designed to surface permission scope and hook patterns that expand an agent's operational reach.

Sigil detects high-risk configuration patterns and quantifies them

The scanner flags explicit risky entries, including disabled sandboxes, overly broad tool permissions, and dangerous PreToolUse hooks, and maps findings to a rubric that produces a quantified risk index (for example Critical, High, Medium). Risk scoring ties specific configuration elements to severity, which helps teams triage by permission scope, auto-approval settings, and destructive inline commands rather than by vague alerts.

It integrates with developer workflows without creating blockers

Sigil adopts a non-blocking audit model that records and scores risks while developer tooling continues to operate. The local-first Rust binary runs without external dependencies or an account and sends no telemetry by default. For fleet scenarios, teams can configure SIEM export to ship hash-anchored security events to central logging, enabling centralized review without forcing developers to stop using their agents.

Audit-only scope means it is not a replacement for enforcement or runtime detection

Because the tool analyzes configuration files, it does not perform active remediation or binary-level inspection; findings require follow-up with enforcement controls or manual review. Its detection surface is tied to MCP-oriented configuration formats, so environments that extend agents outside supported files may have blind spots. Organizations that need automated policy enforcement or runtime compromise hunting must combine the tool with enforcement layers and live monitoring to close that gap.

Practical visibility tool best used as part of a layered security program

Sigil suits teams that need measurable visibility into agent configuration risk within MCP deployments. Teams requiring automated enforcement should pair the tool's findings with policy gates and live monitoring so that high-severity items become actionable. Operationalize results by assigning owners and SLAs for Critical and High findings, feeding reports into existing security workflows, and scheduling scans into CI pipelines to detect configuration drift before production.