About SigmaShake
SigmaShake is AI Agent Guardrails. Agents may propose actions. SigmaShake independently evaluates whether those actions should be allowed, denied, escalated, or transformed before execution. Policy at the tool-call boundary. Honest-agent / integration-dependent. Not a sandbox. See also generative AI guardrails
Our Mission
SigmaShake’s mission is to unlock the full potential of AI development through resilient, deterministic, and highly scalable security solutions.
We deliver uncompromising speed and reliability, ignoring market noise to focus entirely on engineering excellence.
What We Build
The ssg CLI and policy engine runs locally on your machine. It integrates with Claude Code, Codex, Cursor, VS Code Copilot, Antigravity, Grok, Replit, OpenCode, Aider, Pi, and any MCP-compatible agent. Rules are written in a declarative DSL with no LLM call, no regex tweak, just typed IF/THEN conditions evaluated before every tool action (design target: under 2 ms).
The Rules Hub hosts a community library of signed, auditable rule sets. The docs cover every adapter, DSL keyword, and deployment pattern. Pro and Enterprise teams get private rulesets (install from your own private GitHub repo or publish privately to the Hub for your team), fleet-wide sync, and SSO.
Security & Compliance
SigmaShake operates an ISO 27001:2022-aligned information security program. All 93 Annex A controls are catalogued: 74 applicable, 15 inherited, 4 not applicable (as of 2026-10-09). 71 of the 74 applicable controls have current evidence, from Ed25519-signed internal evidence packs. Controls are tracked via a live Statement of Applicability. This ISO 27001 program is self-assessed and not third-party certified; no external certification body has audited it. SOC 2 evidence collectors run on daily, weekly, monthly and quarterly schedules (self-assessed only). The observation window is open (2026-05-18 to 2026-11-17), no independent CPA firm has been engaged, and the earliest realistic Type II report is Q1 2027. The full compliance posture is visible at trust.sigmashake.com
Why It Exists
AI coding agents have root access to your machine. The default permission model is "Y/N" per command; which means you're either babysitting every keystroke or running in YOLO mode with no safety net. SigmaShake provides a third option: declarative governance rules enforced at the tool-call boundary, with a design target of under 2 ms, before the damage can happen.
Who Builds It
SigmaShake is bootstrapped, with no VC funding. We only claim what we can back up. Questions go to support@sigmashake.com.