Sigmashake
A policy gate that runs before your AI coding agent's tool calls
Last verified:
What is Sigmashake?
SigmaShake is an AI agent guardrail system that makes sure AI coding agents only do what you allow. AI coding agents are non-deterministic, and SigmaShake provides deterministic, pre-execution guardrails that force the tools your agent can use, block dangerous and unsafe commands before they run, and audit everything it does. The system operates locally on your machine with sub-2ms evaluation latency, making it impossible to replicate with prompt engineering.
Key features include: deterministic native evaluation with no model inference, GPU, or token cost; an Allow·Ask·Deny guidance system that steers agents and asks humans instead of blunt blocking; a public Rule Hub with 200+ rulesets and 1,000+ rules covering TypeScript, Python, Rust, Security, Docker, and more; visual approval queue with system tray controls in the Desktop app; scriptable CLI with 8+ AI-agent adapters; signed audit logs with Ed25519 cryptography for tamper-evidence; and fleet-wide policy sync for teams. The SHAKEDOWN benchmark proves SigmaShake blocks 100% of attacks at 0% false-block rate across 324 attack tasks and 9 agent harnesses.
SigmaShake is designed for developers and engineering teams using AI coding agents like Claude Code, Cursor, Codex, VSCode Copilot, Gemini CLI, Antigravity, and Pi Coding Agent. It protects against destructive AI tool calls including recursive file deletes, database drops, secret leaks, cloud bill runaway, and unauthorized email sending. The tool is ideal for teams that want deterministic guardrails without Docker clusters, GPU requirements, or per-request token costs.
Sigmashake pricing
Pricing model: Freemium
SigmaShake offers three pricing tiers: Starter ($0/month) includes 5,000 tool evaluations per month, Community Hub access with public rulesets only, approval dashboard at localhost, and CLI locally for eval/lint/format—free forever for personal use. Pro ($20/month) includes private rulesets from your own GitHub repos or private Hub publishing, cloud audit sync with signed exportable logs for security review, unlimited tool evaluations, and priority email support; annual plan is $192/year saving $48/year with no trial. Enterprise (Custom pricing) includes everything in Pro plus extended audit retention, team policy sharing with SSO/SAML, priority support with response-time SLA, on-prem deployment support, source code access for licensed ssg and Desktop version, ISO 27001 and SOC 2 compliance artifacts on request, and custom adapter development. Monthly plans include 14-day free trial; annual bills $192 immediately with no trial.
Sigmashake pros
- Blocks 100% of attacks at 0% false-block rate per SHAKEDOWN benchmark
- Decides in ~85ms with 0.39ms p50 daemon latency over Unix socket
- Deterministic native evaluation—no LLM inference, GPU, or token cost
- Allow·Ask·Deny guidance steers agent instead of blunt block/allow
- 200+ community rulesets and 1,000+ pre-built rules ready to install
- Flat scaling to 100,000 rules with sub-2ms p99 latency
- Works with 7+ agents: Claude Code, Cursor, Codex, Gemini CLI, Copilot, Antigravity, Pi
- MCP Server Integration for Cursor, Codex, VSCode Copilot, Gemini CLI
- PreToolUse hook integration for Claude Code
- Ed25519-signed audit log with every governance event individually signed
- 30-second zero-config install via curl, npm, docker, or PowerShell
- Desktop app has visual approval queue and system tray controls
- Local-first—no mandatory cloud dependency, runs entirely on your machine
- Content-hashed and Ed25519-signed rulesets verified at load time
- Free Starter tier forever with 5,000 tool evaluations per month
- No admin/UAC/sudo required—per-user install on Windows, macOS, Linux
- Zero-dependency binary—no Docker, no cluster, no third-party packages
- Built-in Starter preset ships 20 rules covering destruction, secret-leak, supply-chain
Sigmashake cons
- Proprietary closed-source binary—source code only available to Enterprise customers
- MacOS Apple Silicon builds run via Rosetta 2 until native Apple Silicon build arrives
- Windows SmartScreen may show 'Windows protected your PC' warning on first launch
- CLI cold-start takes ~73-104ms for first call if daemon isn't running
- Not a sandbox—does not claim adversarial isolation against motivated attackers with shell access
- Product analytics opt-in has anonymous usage counter that is automatic
- Cloud audit sync and fleet policy sync require Pro+ paid tier
- Linux AppImage upgrade downloads full ~80MB redownload since delta updater disabled
Frequently asked questions about Sigmashake
Isn't this just a PreToolUse hook or MCP server with regex?
Yes, the enforcement mechanism integrates natively via agent hooks or MCP servers for Claude Code, Codex, Antigravity, Gemini, and more—and that's intentional. SigmaShake adds on top of a hand-rolled hook script: a community rule library you don't have to write from scratch, an Ed25519-signed bundle so you can trust rules from the Hub, a per-row signed audit log where every governance event is individually signed for tamper-evidence, fleet-wide policy sync across many machines, and a dashboard UI for approvals and profiling. If you only need one rule on one machine, a raw script is fine. SigmaShake is for teams that want the whole system.
Can't an agent just bypass the rules with encoding or whitespace tricks?
A motivated attacker with shell access: yes. An honest agent making a mistake, a misconfigured automation, or a junior dev who accidentally wrote a destructive command: no. SigmaShake is a guardrail for the 95% case—preventing accidental harm from agents that are trying to do the right thing but might not know all your constraints. It is not a sandbox and does not claim to be. For adversarial isolation, compose it with OS-level sandboxing like Docker, seccomp, or Apple Sandbox—they address different parts of the threat surface.
How is this different from Lakera, Guardrails AI, or NeMo Guardrails?
Those products filter LLM output—they run after the model responds, checking whether generated text is safe. SigmaShake gates agent tool calls—it runs before the action executes, checking whether the thing the agent is about to do is allowed. The threat models are complementary, not competing. An LLM output filter won't stop an agent from running rm -rf; a tool-call gate will.
Is the Hub a supply-chain risk?
Every ruleset on the Hub is content-hashed and Ed25519-signed before distribution. The bundle is verified at load time—if tampered with, it won't run. Rulesets are plain DSL text, readable before install. You can audit exactly what a ruleset does before pulling it using ssg hub inspect <ruleset-id>.
Can I run this without sending anything to the cloud?
Yes. ssg is a local binary with no mandatory cloud dependency. The Hub is optional for downloading community rules, the fleet sync is optional for Pro+, and the audit export is optional for Pro+. In local-only mode: install via npm, run ssg init, and configure your agent hooks or MCP server. No network calls happen during evaluation.
Claude Code already asks before running commands—why pay for this?
Claude Code's built-in permission prompts are a good start, but they're binary (allow or skip) and require your attention for every action. SigmaShake adds four things you can't get from a raw hook: (1) Defaults without writing a script—the Starter preset ships 20 rules on day one covering the most common destruction, secret-leak, and supply-chain patterns; (2) Audit trail—every evaluation is signed and stored so you can see exactly what was blocked and why; (3) Fleet-wide policy—one rule set pushed to every developer machine, enforced without each developer writing and maintaining their own hook; (4) Multi-agent coverage—the same rules enforce across Claude Code, Cursor, Codex, Gemini CLI, and any other MCP-compatible agent simultaneously.
Will this slow down or break my agent?
In daemon mode (the default after ssg init), evaluation adds about 0.39ms p50 over a Unix-socket hop—imperceptible in any interactive session. Cold-start if the daemon isn't running takes ~73-104ms for the first call, then stays at socket-hop latency. The false-block rate on ordinary development work is measured by SHAKEDOWN: the agent-safety-baseline preset blocks 0 out of 894 benign tasks. If a rule fires on something legitimate, you can add an exception in one command: ssg rules exception add <rule-id> <value>.
What is SHAKEDOWN?
SHAKEDOWN is SigmaShake's agent-containment benchmark that proves guardrail safety. It replays a curated corpus of destructive, persistence, credential-access, defense-evasion, and supply-chain tool calls—each mapped to a MITRE ATT&CK technique—through SSG under every supported agent harness, and scores how much it blocks while leaving legitimate developer work alone. The corpus includes 324 attack tasks, 52 ATT&CK techniques across 6/14 ATT&CK tactics, 12 threat categories, and 9 harness×model combinations. It's fully local, no GPU, no token cost, with open methodology and a reproducible bun run bench:run command.
What agents does SigmaShake support?
SigmaShake works with Claude Code via PreToolUse hook integration, and supports MCP Server Integration for Cursor, Codex, VSCode Copilot, Gemini CLI, Antigravity, and Pi Coding Agent. That's 7+ AI agents across 1 surface. The same install governs them all with policy applied uniformly across all supported agents.
What is the difference between SigmaShake Desktop and ssg CLI?
Same engine, same rules. The Desktop app wraps the ssg binary in a no-terminal-required GUI with visual approval queue and system tray controls; the CLI plugs into whatever shell, CI, or hook chain you already run. Desktop is a 30-second click-to-install per-user app with no admin/UAC/sudo required—Windows uses ~96MB NSIS installer, macOS uses ~20MB .dmg, Linux uses ~12MB .tar.gz. CLI has one-liner install via curl, npm, docker, or PowerShell with 0.39ms p50 daemon latency. Both wrap the identical ssg binary with identical engine performance.