SigmaShake Desktop
AI agent guardrails for your desktop with no terminal required. Free to download · $5/month to use · Windows, macOS, and Linux.
Couldn’t auto-detect your OS. Pick a download below.
Windows
Now on the Microsoft Store: sandboxed (MSIX), with Store-managed auto-updates and no SmartScreen prompt. Or grab the signed .exe here: per-user (no admin), uninstalls via Add or remove programs.
Microsoft Store vs. direct .exe
Microsoft Store (recommended): installs the sandboxed MSIX build, updates itself through the Store, and skips the SmartScreen warning entirely.
Direct .exe: on first launch SmartScreen may show “Windows protected your PC”. Click More info → Run anyway. The installer is signed by Azure Artifact Signing. SmartScreen reputation for new signed installers builds over time, so the prompt may still appear.
macOS
Now on the Mac App Store: sandboxed, with App-Store auto-updates. Or grab the signed & notarized .dmg here: no Gatekeeper prompt, drag to Applications, Sparkle-signed in-app updates.
Prefer Homebrew (CLI only)?
The desktop app is a thin wrapper around the ssg CLI. If you only need the CLI, install it from our tap:
brew install sigmashakeinc/tap/ssg
Updates ship with brew upgrade; ssg dashboard opens the same web UI the desktop app embeds.
Linux
Single self-contained binary, extract & run · no installer or package manager · needs your system’s WebKitGTK (see Fedora note below). x86_64 only; no aarch64 build yet.
Install options & details
Manual: tar -xzf stable-linux-x64-SigmaShakeDesktop.tar.gz, then run ./SigmaShakeDesktop/SigmaShakeDesktop. This is a plain tarball, not a package. There’s nothing for a package manager to install; it needs libwebkit2gtk-4.1 + libgtk-3 already on your system (ship by default on Ubuntu, Pop!_OS, and Steam Deck’s Desktop Mode).
Fedora: Fedora Workstation doesn’t ship webkit2gtk4.1 by default. Install it first: sudo dnf install webkit2gtk4.1 gtk3. If you’d rather skip that step, use Flatpak instead (below) — it pulls in WebKitGTK through the sandboxed runtime, no dnf install required.
Flatpak (sandboxed): flatpak remote-add --if-not-exists sigmashake https://flatpak.sigmashake.com/sigmashake.flatpakrepo, then flatpak install sigmashake com.sigmashake.Desktop. Delta auto-updates via flatpak update; the Desktop bundle includes the governed ssg engine it needs at runtime.
Installing at work?
Before installing SigmaShake Desktop on a corporate workstation, review your organization’s acceptable use policy and information security policy, and get sign-off from your IT, Security, and Compliance teams. SigmaShake runs alongside your AI coding agents and inspects their tool calls, so it normally goes through your software-approval process.
To save your reviewer a round-trip, we publish a pre-filled IT / Security / Compliance review packet: vendor identity, data handling, network requirements, code signing, compliance posture (SOC 2, GDPR, CCPA, ISO 27001 mapping), vulnerability disclosure, sub-processors, install / update / uninstall, and source-code-access terms, all answered in advance. Download it, forward it to your IT and compliance teams, and most of their standard questions will already be covered.
Why Desktop over the CLI?
Same engine, same .rules, same sub-millisecond checks; the desktop app just removes the terminal. Prefer the CLI? It stays first-class; nothing here is desktop-only.
When an agent hits an ASK rule, a native toast pops up to Allow or Deny. There is no tmux pane to babysit and no shell to keep focused.
Opt in to start at login and the daemon governs every agent from boot; you don’t have to remember to run ssg daemon in a window first.
Open and review a ruleset by double-clicking it. The app registers as the handler for .rules, so sharing and installing rules is a file, not a command.
Why this download is safe
We can’t make the SmartScreen warning disappear yet, but here’s everything we do publish so you can verify what you’re running.
Source available to Enterprise
SigmaShake Desktop and the ssg CLI are proprietary, not open-source. Source-code access is granted only to Enterprise customers under a Source Code Access Addendum (terms reviewed and agreed by counsel on both sides) for security review and on-prem build verification. Release artifacts are published from a reproducible pipeline. See the Enterprise guide for terms.
SHA256 published
Every CLI build ships a checksums.sha256 manifest. Desktop bundle hashes are in the GitHub Release notes.
Per-user install
No sudo, no admin elevation, no UAC prompt. The installer writes only to your home directory and registers itself in your user-scope launch list.
Rule evaluation runs entirely on-device
All rule evaluation runs locally in sub-2 ms, with no network round-trip per evaluation. Anonymous product telemetry (hub.sigmashake.com/api/telemetry) is opt-in only — default off, recorded in ~/.sigmashake/telemetry.json. Licensed installs may send a small license heartbeat (version + daily evaluation count) every 6 hours for entitlement freshness. Optional anonymous usage heartbeats follow the same cadence only after you opt in. Cloud audit sync stays off by default.
Lightweight with no Electron
Each build wraps your OS’s native webview: WebView2 on Windows, WKWebView on macOS, and WebKitGTK on Linux. That makes it a 16–80 MB download, not a 200 MB Chromium bundle. In-app updates are signed by the SigmaShake release pipeline.
Uninstalls cleanly
Windows: Settings → Apps. macOS: drag the .app to Trash. Linux: quit the app, then delete the extracted SigmaShakeDesktop folder. No background services, no registry stragglers, no kernel extensions.
Verify your download
Run the command for your OS after downloading. Compare the SHA256 to the value published in the GitHub Release notes for your version (Windows v1.0.22 · macOS v1.0.15 · Linux v1.0.12).
Windows (PowerShell) · v1.0.22
# the file you downloaded: Get-FileHash -Algorithm SHA256 ` .\SigmaShakeDesktop-Setup.exe
macOS · v1.0.15 · Linux · v1.0.12
# macOS (.dmg): shasum -a 256 SigmaShakeDesktop*.dmg # Linux (Wails .tar.gz): sha256sum stable-linux-x64-SigmaShakeDesktop.tar.gz
After installing
From install to governed agents in under two minutes.
Launch SigmaShake Desktop. It installs per user, with no admin or sudo. On Linux: extract the .tar.gz, then click the SigmaShake Desktop entry in your app launcher.
Pick a ruleset. The welcome wizard offers Newcomer (recommended), Personal, Professional, Enterprise, Agent Dev; change it any time from Settings.
Sign in or Subscribe ($5/mo). Prefer in-app Sign in with browser or Subscribe — unlock without waiting on email. Have a welcome-email activation link already? Paste it as a backup.
Status turns green. Your AI agents are now governed. Inspect every blocked call from the tray menu.
Uninstalling
Remove SigmaShake Desktop completely with no admin required.
Windows: Settings → Apps → SigmaShake Desktop → Uninstall. Config stays in %LOCALAPPDATA%\SigmaShake\; delete that directory too for a clean remove.
macOS: Drag SigmaShake Desktop.app from /Applications to Trash. Delete ~/.sigmashake/ to remove config and audit logs.
Linux: Delete ~/.local/share/SigmaShakeDesktop/ and ~/.local/share/applications/sigmashake-desktop.desktop. Delete ~/.sigmashake/ for full cleanup. Optionally run systemctl --user disable --now sigmashake-ssg.service.
Prefer the CLI?
The desktop app is a thin wrapper around the same ssg binary you can install in one line.