SigmaShake
Governance rules for AI agents — connect in 2 minutes.
SigmaShake evaluates AI agent tool calls against declarative rules at the tool-call boundary. Every Bash command, file write, network request, or agent spawn is checked before it executes. The design target is under 2 ms per evaluation; the only published measurement is the 2026-06-10 sigmashake-bench daemon-socket run (ssg 0.29.156, n=500): p50 0.39 ms, p99 1.91 ms.
The fastest path
These pages show the product. There is no free tier and no trial of the value:
- Live demo: sigmashake.com/try
- Showcase dashboard: showcase.sigmashake.com
- Desktop download: sigmashake.com/desktop
If you use Claude Code, Cursor, Codex, Copilot, or Antigravity, install on your machine and run ssg init for that client. Windsurf has no ssg init adapter: connect it through the MCP Server. For Grok Bot, use SigmaShake Guardrails instead of local ssg init:
- Install the CLI (see Getting Started for your platform).
- Run:
ssg init --client=claude-code
Restart your AI client, then say:
"Set up SigmaShake governance for my project"
Your agent detects your stack, installs matching rules from the Hub, and returns a health report. Done.
Subscribe later only when you want Pro value surfaces unlocked (ssg auth login / pricing).
On Windows? See the Windows install guide for the PowerShell installer. If you'd rather skip the terminal entirely, install SigmaShake Desktop — a tray-icon desktop app that sets everything up for you.
What SigmaShake does
When an AI agent calls a tool, SigmaShake intercepts and returns one of:
| Decision | Meaning |
|---|---|
| ALLOW | Let it through |
| DENY | Block it with an explanation |
| LOG | Allow but record for audit |
| ASK | Pause and require human approval |
| FORCE | Refuse the risky original and return a safe substitute or required safer path |
| SHADOW | Allow silently, log for monitoring |
Without governance
Agent: git push --force origin main → 💥 history rewritten
Agent: cat .env → 🔓 secrets exposed
Agent: rm -rf node_modules/.. → 🗑️ wrong directory deleted
Agent: npm publish → 📦 unreviewed release shipped
With SigmaShake
Agent: git push --force origin main → FORCE: "Use --force-with-lease"
Agent: cat .env → BLOCK: "Secret file access blocked"
Agent: rm -rf node_modules/.. → BLOCK: "Destructive command blocked"
Agent: npm publish → ASK: Waits for your approval
Key properties
| Property | Value |
|---|---|
| Evaluation latency | Design target under 2 ms; measured p50 0.39 ms, p99 1.91 ms (2026-06-10 bench run, ssg 0.29.156, n=500) |
| Dependencies | A short, pinned set of Go modules, built into one standalone binary |
| Transport | stdio (MCP), stdin/stdout (hooks) |
| Rule format | Declarative DSL, hot-reloaded |
| Audit | Local audit log (best effort: the queue can drop entries when full; rows are rotated at the row caps) |
| Hub | Community rulesets for TypeScript, React, Go, Docker, and more |
Components
| Component | Purpose | Where |
|---|---|---|
| ssg CLI | Rule evaluation, Hub, linting, dashboard | Local binary |
| MCP Server | AI agent integration (4 core tools; more via --tools flag) | ssg mcp-server |
| Dashboard | Real-time approvals, audit log | localhost:5599 |
| Rules Hub | Community rulesets (SHA-256 and Ed25519 signature checked on install; not reviewed by SigmaShake) | hub.sigmashake.com |
| Fleet | Org-wide agent governance | fleet.sigmashake.com |
| Accounts | Plans, login, license | accounts.sigmashake.com |
Next steps
- Getting Started — Install + connect your AI agent in 2 minutes
- MCP Server — MCP tools for AI agents
- Rule Syntax — Write your own governance rules
- Hub — Browse community rulesets
- Enterprise Fleet — Fleet admin onboarding via AI agent