Skip to main content

Getting Started

Try first. Install when you are ready. Subscribe only when you need Pro.

Free ways to try SigmaShake with no paid plan:

  1. Live demo — sigmashake.com/try
  2. Showcase dashboard — showcase.sigmashake.com
  3. Desktop download — sigmashake.com/desktop

A $5/month subscription unlocks governed value surfaces later (pricing). There is no paid trial and no inventing of free Pro access — try paths above are free. SigmaShake is a sole-operator individual entity (USA) — not a corporation.

An AI agent driving this itself?

Paste the single prompt in the Agent Install Guide — it installs (with -y), runs ssg init --smart / ssg_onboard, handles Desktop OS-correctly, and restarts the client.

1. Install the CLI (one command)​

macOS / Linux:

curl -fsSL https://install.sigmashake.com | sh

Same script (alias we ship):

curl -fsSL https://install.sigmashake.com/install.sh | sh

Non-interactive — records ToS consent (fail-closed without it):

curl -fsSL https://install.sigmashake.com | sh -s -- -y
iwr -useb https://install.sigmashake.com/install.ps1 | iex

Per-platform detail: macOS · Linux · Windows. Docker/GHCR: docker run --rm ghcr.io/sigmashakeinc/ssg:1.0.7 --version.

SigmaShake Desktop (same page — optional bullet, not an extra step)​

Wire your AI host once (Claude Code, Cursor, Antigravity, Codex, Gemini, …), then restart the client:

ssg init --client=claude-code   # or: cursor | antigravity | codex | gemini | …
ssg init --dry-run --client=claude-code   # preview first

Grok Bot is different — install SigmaShake Guardrails (hosted MCP at https://mcp.sigmashake.com/mcp) instead of local stdio.

ssg init prints a per-file preview of every write with revert commands. After install, .sigmashake/install-manifest.json records what changed (ssg whatchanged). See What SSG Changes on Your Machine and One Source, Many Agents.

2. One prompt​

Open your AI agent and say:

"Set up SigmaShake governance for my project"

That calls ssg_onboard, which:

  1. Detects your tech stack (TypeScript, React, Go, Python, Docker, etc.)
  2. Creates .sigmashake/config.toml and starter security rules
  3. Pulls matching rulesets from hub.sigmashake.com
  4. Runs ssg lint to verify everything
  5. Returns a health summary

When you are ready for Pro value surfaces, activate (ssg auth login, or Desktop's first-run wizard). Trying the demo/showcase/desktop download does not require a subscription.

What else can you ask?​

Say this to your agentWhat happens
"Set up SigmaShake governance for my project"Full one-shot setup (ssg_onboard)
"Check if governance is working"Health diagnostics (ssg_doctor)
"Find Docker security rules on the Hub"Ruleset search (ssg_hub_search)
"Install rules-typescript"Ruleset installation (ssg_hub_pull)
"Block any npm publish without my approval"Custom rule creation (ssg_write_rule)
"Show my current plan and active rules"Status report (ssg_status)

Manual CLI Setup​

Prefer to do it yourself? Install first, then optionally subscribe at sigmashake.com/pricing when you want Pro unlocked.

1. Authenticate (browser opens accounts.sigmashake.com):

ssg auth login

2. Initialize your project:

cd your-project
ssg init --smart

First run: accept the SigmaShake Terms of Service (https://sigmashake.com/terms) before the dashboard is available. In CI or non-TTY environments, pass --accept-terms to proceed non-interactively. Data dir defaults to ~/.sigmashake; use --home <dir> or SIGMASHAKE_HOME to relocate.

3. Or pull rulesets yourself:

ssg hub pull rules-typescript     # adjust to your stack
ssg hub pull rules-react
ssg hub pull rules-docker

Verify:

ssg lint             # check rule syntax
ssg status           # system health + active rule count
ssg doctor           # full diagnostic report

Dashboard (optional — real-time audit log + approval queue):

ssg serve            # opens http://localhost:5599

Authentication​

Authentication links your machine to your SigmaShake plan tier (Pro / Enterprise).

ssg auth login

Select Browser (recommended). Your browser opens to accounts.sigmashake.com — sign in with GitHub, Google, Microsoft, Apple, Twitch, or your company's SSO, then click Authorize ssg CLI. Token flows back to the CLI automatically. See Signing In for the full provider list and what each login shares with SigmaShake.

Enterprise SSO​

ssg auth login --sso

See Fleet SSO Setup for Okta, Azure AD, and SAML 2.0 guides.

API Key​

ssg auth login --token=YOUR_API_KEY

Write your first rule​

Rules live in .sigmashake/rules/. Create a file and write:

rule block-force-push {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "git push --force"
  OR command CONTAINS "git push -f"
  MESSAGE "Force push is blocked. Use --force-with-lease instead."
}

Then verify:

ssg lint      # ✓ 1 rule OK
ssg list      # shows all active rules

See Rule Syntax for the full language reference.

Test a rule manually​

echo '{"tool":"Bash","input":{"command":"git push --force origin main"}}' | ssg eval

Output:

{
  "decision": "block",
  "rule_id": "block-force-push",
  "reason": "Force push is blocked. Use --force-with-lease instead.",
  "duration_ns": 1840000
}

Integrate with Claude Code​

ssg init --client claude-code

This patches .claude/settings.json with:

  • Hook — ssg hook eval runs before every tool call
  • Permissions — 14 standard tools pre-approved, 18 destructive patterns pre-denied

See Claude Code Integration for the full setup guide.

Next steps​

Join the Community​

Get help, share your rulesets, and follow what's shipping:

  • 💬 Discord — the fastest way to get support and talk to other SSG users
  • 🟣 Slack — for teams who prefer Slack
  • 🐙 GitHub — report bugs, request features, or contribute