AI agent guardrails
Generative AI Agent Guardrails
SigmaShake (ssg) checks every AI agent tool call against your rules before it runs — so risky actions can be blocked or rewritten in milliseconds, without a sandbox.
- Core: tool calls are checked against your rules locally (daemon-socket p50 0.39 ms, p99 1.91 ms, 2026-06-10 run).
- Ring 1, every decision: allow, ask, force or deny.
- Ring 2, your agents: Claude Code, Cursor, Codex, Copilot, Antigravity, Pi.
- Ring 3, what it guards: Shell commands, Files & repos, Secrets, Network calls, Package installs, MCP tools.
- Base, governance you can prove: 230+ public rulesets, Tamper-evident audit log, Human approvals, Team & fleet policy.
- Runs locally · not a sandbox · no model inference. It works with ten named agents (the ring shows six) plus any MCP-compatible agent, any repo, on macOS, Linux and Windows. It is not a sandbox.
- Flow, an illustration: a tool call travels from an agent inward to the core, is checked, and returns with its verdict.
Simulated demosimulated tool calls (demo, not real usage)
SHAKEDOWN benchmark (self-authored corpus, overlay model)
- 3,396 / 3,396attack eval cells contained (blocked or ask-gated)*
- 0false blocks across 1,510 benign eval cells*
Engine
- 0.39 msp50 daemon socket round trip, ssg 0.29.156, 2026-06-10 (not a benchmark score)
- 230+public rulesets
*Self-authored SHAKEDOWN corpus. Overlay-model run, 2026-06-10, on an earlier corpus revision (the record does not stamp a version; current corpus is v1.6.0). The real-engine on-box run scored 98.5, with 14 / 963 benign false blocks from operator-local rules — Methodology. Honest-agent / integration-dependent. Not a sandbox. The moving dots are an illustration with a made-up verdict mix, not measured block rates or customer traffic.
Works with the agents your team already uses
See it in action
Scored 100 on an earlier SHAKEDOWN corpus revision
Choosing what guards your agents is a critical decision, so we made it measurable. The question that matters: does policy fire at the tool-call boundary without breaking real work? Honest-agent / integration-dependent. Not a sandbox. SigmaShake scored 100 on an earlier revision of our published SHAKEDOWN corpus we wrote ourselves, using the overlay model. The real-engine on-box run scored 98.5 (2026-06-10). Competitor bars are estimated from public docs. Don't trust the chart. Reproduce it.
How SigmaShake Compares
SigmaShake vs prompt engineering vs sandboxed execution
The real difference isn’t a benchmark number; it’s where the check runs. SigmaShake is local-first and gates the tool call before it executes, on your machine. LLM output filters (Lakera, Guardrails AI, NVIDIA NeMo Guardrails) inspect the model’s response after the agent has already decided to act. Microsoft also ships a free, MIT-licensed Agent Governance Toolkit for policy enforcement worth evaluating alongside SSG. The two table columns below show the older infrastructure-level approaches (DIY prompts and sandboxed containers); those output-filter and toolkit options are distinct, complementary layers, not shown as scored columns.
.rules registry where every new rule strengthens the ecosystem. Competitors start from zero community.| Criterion | SigmaShakeNative rule engine | DIY configPrompt engineering | Sandboxed containersDocker / K8s isolation |
|---|---|---|---|
| Architecture | ✓StandaloneNative binary (installer or GHCR) · $5/mo Pro | ~Text & StaticPrompt eng. + string match | ✕HeavyDocker + K3s cluster |
| Performance | ✓0.39 ms p50 (2026-06-10)Instant evaluation | ✕SlowToken generation latency | ✕100+ msContainer startup overhead |
| Scale Limit | ✓100,000+ (design target; not yet measured)Rules evaluated locally | ✕~dozensContext window limit | ✕CPU-boundNetwork / compute bottleneck |
| Reliability | ✓100%Deterministic hooks | ✕Best effortAI forgets, easy to bypass | ~StrongHard to tune in production |
| Operating Cost | ✓$5/moLocal eval · Pro unlocks Hub sync | ✕HighPer-request token spend | ✕HighAlways-on compute |
| Device Protection | ✓ActiveGatekeeps every tool call | ✕NoneProne to prompt injection | ~IsolatedOnly inside the container |
| Rule Ecosystem | ✓Public Hubhub.sigmashake.com | ✕NoneCopy-paste, no sharing | ✕NoneManual YAML policies |
curl -fsSL install.sigmashake.com | sh (no -y; review ToS)SHAKEDOWN: the published policy-eval corpus
Corpus v1.6.0: 436 malicious + 171 benign task shapes · tap to expand
Don't trust the chart. Reproduce it. SHAKEDOWN replays a published corpus of destructive, persistence, credential-access, defense-evasion, and supply-chain tool calls through SSG on supported integrations, scoring blocks against legitimate work left alone. In a 2026-06-10 overlay-model run on an earlier corpus revision (3,396/3,396 contained, 0/1,510 benign false blocks; the record does not stamp a corpus version) SigmaShake scored 100 (self-authored; the real-engine on-box run scored 98.5). Honest-agent / integration-dependent. Not a sandbox. Fully local, no GPU, no token cost.
bun run src/cli.ts run --overlay-only --hardened --all-harnessesGenerative AI Guardrails, enforced at the tool-call boundary
SigmaShake maps to MITRE ATLAS mitigation AML.M0020 and implements its rule-based-validator form: typed IF/THEN rules and regex evaluate every proposed tool call before execution and return ALLOW, DENY, ASK, or FORCE, with every decision audited.
Mapped ATLAS techniques (tap to expand)
- AML.T0051 · LLM Prompt Injection
A hijacked agent still cannot execute a tool call a rule denies.
- AML.T0053 · AI Agent Tool Invocation
Every tool call is evaluated before it runs, not after.
- AML.T0054 · LLM Jailbreak
Policy lives outside the model, so a jailbroken model still hits the same DENY.
- AML.T0056 · Extract LLM System Prompt
Secret and prompt-file reads can be denied by rule.
- AML.T0057 · LLM Data Leakage
Outbound tool calls carrying secrets can be blocked by rule.
- AML.T0010 · AI Supply Chain Compromise
Installing or executing unvetted packages can be ASK- or DENY-gated.
- AML.T0061 · LLM Prompt Self-Replication
Write and exec patterns that self-propagate can be denied.
- AML.T0062 · Discover LLM Hallucinations
SSG constrains what a wrong answer can do; it does not fact-check content.
AI Agent Guardrails: Live, Audited, p99 1.91 ms
See SigmaShake in actionDeterministic guardrails intercept data loss, secret leaks, and privilege escalation from any AI coding agent. Watch a live block, then dig into the rule, the audit log, and the benchmarks.
One line, every platform.
curl -fsSL install.sigmashake.com | sh30 seconds. Zero config. One install command, self-contained binary. Prefer the install chooser (shows the ToS warning). The one-liner without -y prompts for consent; add -y only after you accept the Terms of Service.
Covers every agent your team uses.
Policy applies uniformly across Claude Code, Cursor, Codex, Copilot, and more.
Every decision is deterministic.
$rm -rf /DENY$sudo apt-get updateASK$curl https://api.example.com/dataFORCE
DENY blocks. ASK prompts. FORCE refuses the original risky action and returns a safe substitute or required safer path (daemon p99 1.91 ms in the 2026-06-10 run).
Pick a scenario. The terminal replays an AI agent trying it; SSG intercepts before the command runs.
For engineerssee the rule DSL, demo dashboard, benchmarks & onboarding
rule prefer-graphify-over-recursive-search {
enabled true
priority 80
severity high
FORCE execution
IF command CONTAINS "grep -r"
SUBSTITUTE "graphify query \"<what you were searching for>\""
MESSAGE "Recursive shell search is FORCED to the graphify knowledge graph for code/architecture/relationship queries (faster, scoped). Escape hatch for literal/regex/log/config/secret searches: use ripgrep (rg) or a non-recursive search."
}Determines conflict precedence and the active audit log volume.
The raw execution action dynamically enforced upon matching.
The AST condition intercepting the raw agent process payload.
Scaling: Latency vs Rule Count
Rule-count tiers are labels only. No committed record measures latency at any tier; the one daemon run on file used 2 rule files.
| Rules | Status |
|---|---|
| 10 | Not measured |
| 50 | Not measured |
| 100 | Not measured |
| 200 | Not measured |
| 500 | Not measured |
| 100,000 | Design target; not yet measured |
curl -fsSL install.sigmashake.com | shReduce AI-agent incident risk deterministically across every agent in your stack.
Free to download · $5/month to use · see /install for the chooser and ToS warning. GHCR pulls accept the Terms of Service.
Community Rules, Ready to Install
Pre-built rulesets for TypeScript, Python, Rust, Security, Docker, and more.
Signed, version-controlled, and installable with one command.
ssg hub pull rules-agentic-aiSimple, Predictable Pricing
One flat plan, billed monthly. Cancel anytime.
Free to download · $5/month to use · billed monthly
Pro
For teams that must prove what their AI agents are allowed to do.
- Private rulesets: install from your own private GitHub repos or publish privately to the Hub for your team
- Cloud audit sync: signed (tamper-evident), exportable for security review; 7-day cloud retention (Pro) / 90-day (Enterprise). Full history always in your local audit log.
- Unlimited Tool evaluations
- Priority email support
Enterprise
When procurement asks.
- Everything in Pro
- Extended audit retention
- Team policy sharing & SSO (Okta today; SAML/Entra on request)
- Priority support with response-time SLA (hours defined in your SOW)
- Supports On-Prem Deployments
- Source code access for the licensed version of
ssg& SigmaShake Desktop is available to customers who purchase or sign a binding purchase commitment. Scoped to that version only; updates are not included. - Custom adapter development
Put the brakes on before you hit the gas.
AI agents run shell commands, edit files, and call external APIs. That means they can cause real damage before you realise what happened. SSG is the seatbelt you put on first.
Illustrative scenarios of commonly discussed agent failure modes, not reports about specific customers.
Honest Answers to Hard Questions
Direct answers to questions skeptical engineers actually ask.
Isn't this just a PreToolUse hook or MCP server with regex?
Yes, the enforcement mechanism integrates natively via agent hooks or MCP servers (supporting Claude Code, Codex, Antigravity, and more), and that's intentional. What SigmaShake adds on top of a hand-rolled hook script: a community rule library you don't have to write from scratch, an Ed25519-signed bundle so you can trust rules from the Hub, a per-row signed audit log (every governance event individually signed for tamper-evidence), fleet-wide policy sync across many machines, and a dashboard UI for approvals and profiling. If you only need one rule on one machine, a raw script is fine. SigmaShake is for teams that want the whole system.
Can't an agent just bypass the rules with encoding or whitespace tricks?
A motivated attacker with shell access: yes. An honest agent making a mistake, a misconfigured automation, or a junior dev who accidentally wrote a destructive command: no. SigmaShake is a guardrail for the 95% case, preventing accidental harm from agents that are trying to do the right thing but might not know all your constraints. It is not a sandbox and does not claim to be. For adversarial isolation, compose it with OS-level sandboxing (Docker, seccomp, Apple Sandbox); they address different parts of the threat surface.
How is this different from Lakera, Guardrails AI, or NeMo Guardrails?
Those products filter LLM output. They run after the model responds, checking whether generated text is safe. SigmaShake gates agent tool calls. It runs before the action executes, checking whether the thing the agent is about to do is allowed. The threat models are complementary, not competing. An LLM output filter won't stop an agent from running rm -rf; a tool-call gate will.
Is the Hub a supply-chain risk?
Every ruleset on the Hub is content-hashed and Ed25519-signed before distribution. The bundle is verified at load time; if tampered with, it won't run. Rulesets are plain DSL text, readable before install. You can audit exactly what a ruleset does before pulling it: ssg hub inspect <ruleset-id>.
Can I run this without sending anything to the cloud?
Yes for evaluation. ssg evaluates every tool call locally — the gate itself does not call home. Hub pulls, fleet sync (Pro+), and audit export (Pro+) are optional. Separately, Desktop/daemon may send a license heartbeat when licensed, and an anonymous usage heartbeat only after explicit opt-in (same model as the Desktop privacy copy). Local-only mode: install via the native installer or GHCR image, run ssg init, keep telemetry opted out, and skip Hub/fleet. Evaluation stays on-box either way.
Claude Code already asks before running commands. Why pay for this?
Claude Code's built-in permission prompts are a good start, but they're binary (allow or skip) and require your attention for every action. SigmaShake adds four things you can't get from a raw hook: (1) Defaults without writing a script: the agent-safety-baseline preset ships on day one with rules covering the most common destruction, secret-leak, and supply-chain patterns; (2) Audit trail: every evaluation is signed and stored, so you can see exactly what was blocked and why; (3) Fleet-wide policy: one rule set pushed to every developer machine, enforced without each developer writing and maintaining their own hook; (4) Multi-agent coverage: the same rules enforce across Claude Code, Cursor, Codex, and any other MCP-compatible agent simultaneously.
Will this slow down or break my agent?
In daemon mode (the default after ssg init), evaluation over a Unix-socket hop measured p50 0.39 ms and p99 1.91 ms in the 2026-06-10 daemon run (ssg 0.29.156, n=500) — imperceptible in any interactive session. Start-up time of a hook process is a separate path and is not in that record. The false-block rate on ordinary development work is measured by the SHAKEDOWN benchmark: the “agent-safety-baseline” preset blocks 0 out of 1,510 benign eval cells in the overlay-model run (2026-06-10). See the benchmark page for the full false-block report. If a rule fires on something legitimate, you can add an exception in one command: ssg rules exception add <rule-id> <value>.
Does writing it in CLAUDE.md stop a destructive AI coding agent?
A CLAUDE.md instruction is a probabilistic nudge: Claude Code usually follows it, but the model can ignore or misread it under prompt pressure, a long context window, or an adversarial injection. No enforcement sits in the path between the instruction and the tool call. ssg adds a deterministic gate that evaluates every tool call before it runs and returns ALLOW, DENY (runtime: block), ASK, FORCE, LOG, or SHADOW with no LLM involved in enforcement. FORCE refuses the original risky action and returns a safe substitute or required safer path for the agent to use next. Adding a permissions block to CLAUDE.md sets intent; guardrails enforce it. Try a simulated rule check (mock data) at showcase.sigmashake.com, or install SigmaShake Desktop for a full local GUI. It is free to download and costs $5/month to use.
Talk to other engineers using SSG
Share your rules, get help, and follow what's shaking next.