Generative AI Agent Guardrails

Yes, the enforcement mechanism integrates natively via agent hooks or MCP servers (supporting Claude Code, Codex, Antigravity, Gemini, and more), and that's intentional. What SigmaShake adds on top of a hand-rolled hook script: a community rule library you don't have to write from scratch, an Ed25519-signed bundle so you can trust rules from the Hub, a per-row signed audit log (every governance event individually signed for tamper-evidence), fleet-wide policy sync across many machines, and a dashboard UI for approvals and profiling. If you only need one rule on one machine, a raw script is fine. SigmaShake is for teams that want the whole system.

A motivated attacker with shell access: yes. An honest agent making a mistake, a misconfigured automation, or a junior dev who accidentally wrote a destructive command: no. SigmaShake is a guardrail for the 95% case, preventing accidental harm from agents that are trying to do the right thing but might not know all your constraints. It is not a sandbox and does not claim to be. For adversarial isolation, compose it with OS-level sandboxing (Docker, seccomp, Apple Sandbox); they address different parts of the threat surface.

Those products filter LLM output. They run after the model responds, checking whether generated text is safe. SigmaShake gates agent tool calls. It runs before the action executes, checking whether the thing the agent is about to do is allowed. The threat models are complementary, not competing. An LLM output filter won't stop an agent from running rm -rf; a tool-call gate will.

Every ruleset on the Hub is content-hashed and Ed25519-signed before distribution. The bundle is verified at load time; if tampered with, it won't run. Rulesets are plain DSL text, readable before install. You can audit exactly what a ruleset does before pulling it: ssg hub inspect <ruleset-id>.

Yes for evaluation. ssg evaluates every tool call locally — the gate itself does not call home. Hub pulls, fleet sync (Pro+), and audit export (Pro+) are optional. Separately, Desktop/daemon may send a license heartbeat when licensed, and an anonymous usage heartbeat only after explicit opt-in (same model as the Desktop privacy copy). Local-only mode: install via the native installer or GHCR image, run ssg init, keep telemetry opted out, and skip Hub/fleet. Evaluation stays on-box either way.

Claude Code's built-in permission prompts are a good start, but they're binary (allow or skip) and require your attention for every action. SigmaShake adds four things you can't get from a raw hook: (1) Defaults without writing a script: the baseline preset ships 20 rules on day one covering the most common destruction, secret-leak, and supply-chain patterns; (2) Audit trail: every evaluation is signed and stored, so you can see exactly what was blocked and why; (3) Fleet-wide policy: one rule set pushed to every developer machine, enforced without each developer writing and maintaining their own hook; (4) Multi-agent coverage: the same rules enforce across Claude Code, Cursor, Codex, Gemini CLI, and any other MCP-compatible agent simultaneously.

In daemon mode (the default after ssg init), evaluation stays under 2 ms end-to-end over a Unix-socket hop — imperceptible in any interactive session. Cold-start (if the daemon isn't running) takes ~73–104 ms for the first call, then stays at socket-hop latency. The false-block rate on ordinary development work is measured by the SHAKEDOWN benchmark: the “agent-safety-baseline” preset blocks 0 out of 894 benign tasks. See the benchmark page for the full false-block report. If a rule fires on something legitimate, you can add an exception in one command: ssg rules exception add <rule-id> <value>.

A CLAUDE.md instruction is a probabilistic nudge: Claude Code usually follows it, but the model can ignore or misread it under prompt pressure, a long context window, or an adversarial injection. No enforcement sits in the path between the instruction and the tool call. ssg adds a deterministic gate that evaluates every tool call before it runs and returns ALLOW, DENY (runtime: block), ASK, FORCE, LOG, or SHADOW with no LLM involved in enforcement. FORCE refuses the original risky action and returns a safe substitute or required safer path for the agent to use next. Adding a permissions block to CLAUDE.md sets intent; guardrails enforce it. Test a rule now at showcase.sigmashake.com, or install SigmaShake Desktop for a full local GUI. It is free to download and costs $5/month to use.