For developers using AI coding agents

Stop your AI agent from running rm -rf on the wrong directory.

Claude Code, Cursor and other agents have deleted production databases, home directories, and whole filesystems. Built-in sandboxes are opt-in, not on by default. SigmaShake is the deterministic gate that catches the catastrophic command before it runs.

Get startedTry it live. No installRead the docs

A smarter model isn’t the fix

The model is what decided to run the command, so you can’t rely on the model to stop it. You need a gate outside the model: something that inspects every shell command the agent makes and refuses the dangerous ones every time, regardless of what the agent “decided.” That is SigmaShake (SSG).

How it works

  • Local & deterministic. Runs on your machine with rules, not a second AI you have to trust. The same input always gets the same verdict.
  • Before execution. It intercepts the tool call and returns ALLOW (safe), DENY (catastrophic), ASK (you approve), or FORCE (safe substitute) before the command touches your disk.
  • Every agent. One set of guardrails covers Claude Code, Cursor, Codex, and MCP-compatible assistants.
  • Audited. Every decision is written to a signed audit log you can review.

30 seconds to protected

1. Install

curl -fsSL install.sigmashake.com | sh -s -- -y

2. Wire it in

ssg init # wires the guardrails into your agents

Running -y accepts the Terms of Service. Windows CLI: winget install SigmaShake.SSG. Desktop: winget install SigmaShake.Desktop or Microsoft Store. See all install options.

Does it actually catch them?

SSG ships SHAKEDOWN, a published policy-eval corpus (corpus v1.6.0: 436 malicious + 171 benign task shapes). In a 2026-06-10 overlay-model run on an earlier corpus revision (3,396/3,396 contained, 0/1,510 benign false blocks) SigmaShake scored 100 (self-authored); the real-engine on-box run scored 98.5. Competitor bars are estimated from public docs. Don’t trust the chart. Reproduce it. Honest-agent / integration-dependent. Not a sandbox.

FAQ

Isn’t this just a PreToolUse hook?

The hook is only the trigger. Behind it is a deterministic policy engine: a real rule language, priority-sorted first-match evaluation, a signed audit trail, a dashboard, and one rule set across every agent. The hook without the engine is a lone regex; this is the engine.

Will it slow my agent down?

In daemon mode (the default after ssg init) the daemon socket round trip measured p50 0.39 ms and p99 1.91 ms (ssg 0.29.156, 2026-06-10). You won’t feel it.

Can the agent just bypass it?

It evaluates the actual tool call on every call, regardless of what the model decided, so the model can’t talk its way past a rule. It is a guardrail for honest agents, not an adversarial sandbox: for genuinely untrusted code, compose it with OS-level sandboxing.

Which agents does it work with?

Claude Code, Cursor, Codex, and MCP-compatible assistants.

Get startedSee pricing

SigmaShake is a deterministic guardrail layer between your AI coding agents and your machine.