AI agent security: stop your coding agent from doing damage
AI coding agents such as Claude Code, Cursor, and Codex can read, write, run commands, and call tools on your machine. That power is the risk: a wrong command, a poisoned input, or a compromised tool can delete data, leak secrets, or run anything. The fix isn’t a smarter model; it’s a deterministic gate that checks every action before it runs. Here are the four threats, and how SigmaShake (SSG) handles each.
1. Destructive commands
Agents have deleted production databases, home directories, and .git repos. SSG denies the catastrophic commands before they run. → Block destructive commands
2. Secret & API-key exfiltration
Agents read your .env and keys; a prompt injection can send them anywhere. SSG gates secret reads and inspects outbound traffic. → Prevent secret leaks
3. Prompt injection
A poisoned doc or web page can hijack your agent. You can’t catch every injection, but SSG refuses the dangerous action it triggers. → Stop prompt injection
4. MCP tool-call risk
A compromised MCP server can drive your agent to do damage. SSG governs every tool call before it executes. → MCP security
The common thread: gate the action
All four have the same shape: the agent is about to do something dangerous. SigmaShake is the deterministic, local gate at the tool-call boundary: ALLOW, DENY, ASK, or FORCE a safe alternative before execution, across every agent, with a signed audit log. See how it compares to LLM filters and sandboxes.
30 seconds to protected
1. Install
curl -fsSL install.sigmashake.com | sh -s -- -y2. Wire it in
ssg initRunning -y accepts the Terms of Service. See the docs.