Yes, the enforcement mechanism integrates natively via agent hooks or MCP servers (supporting Claude Code, Codex, Antigravity, Gemini, and more) — and that's intentional. What SigmaShake adds on top of a hand-rolled hook script: a community rule library you don't have to write from scratch, an Ed25519-signed bundle so you can trust rules from the Hub, a per-row signed audit log (every governance event individually signed for tamper-evidence), fleet-wide policy sync across many machines, and a dashboard UI for approvals and profiling. If you only need one rule on one machine, a raw script is fine. SigmaShake is for teams that want the whole system.

A motivated attacker with shell access: yes. An honest agent making a mistake, a misconfigured automation, or a junior dev who accidentally wrote a destructive command: no. SigmaShake is a guardrail for the 95% case — preventing accidental harm from agents that are trying to do the right thing but might not know all your constraints. It is not a sandbox and does not claim to be. For adversarial isolation, compose it with OS-level sandboxing (Docker, seccomp, Apple Sandbox) — they address different parts of the threat surface.

Those products filter LLM output — they run after the model responds, checking whether generated text is safe. SigmaShake gates agent tool calls — it runs before the action executes, checking whether the thing the agent is about to do is allowed. The threat models are complementary, not competing. An LLM output filter won't stop an agent from running rm -rf; a tool-call gate will.

Every ruleset on the Hub is content-hashed and Ed25519-signed before distribution. The bundle is verified at load time — if tampered with, it won't run. Rulesets are plain DSL text, readable before install. You can audit exactly what a ruleset does before pulling it: ssg hub inspect <ruleset-id>.

Yes. ssg is a local binary with no mandatory cloud dependency. The Hub is optional (for downloading community rules), the fleet sync is optional (Pro+), and the audit export is optional (Pro+). Local-only mode: install via npm, run ssg init, and configure your agent hooks or MCP server. No network calls during evaluation.

Claude Code's built-in permission prompts are a good start, but they're binary (allow or skip) and require your attention for every action. SigmaShake adds four things you can't get from a raw hook: (1) Defaults without writing a script — the Starter preset ships 20 rules on day one covering the most common destruction, secret-leak, and supply-chain patterns; (2) Audit trail — every evaluation is signed and stored, so you can see exactly what was blocked and why; (3) Fleet-wide policy — one rule set pushed to every developer machine, enforced without each developer writing and maintaining their own hook; (4) Multi-agent coverage — the same rules enforce across Claude Code, Cursor, Codex, Gemini CLI, and any other MCP-compatible agent simultaneously.

In daemon mode (the default after ssg init), evaluation adds about 0.39 ms p50 over a Unix-socket hop (measured: ssg 0.29.156, n=500) — imperceptible in any interactive session. Cold-start (if the daemon isn't running) takes ~73–104 ms for the first call, then stays at socket-hop latency. The false-block rate on ordinary development work is measured by the SHAKEDOWN benchmark: the “agent-safety-baseline” preset blocks 0 out of 894 benign tasks. See the benchmark page for the full false-block report. If a rule fires on something legitimate, you can add an exception in one command: ssg rules exception add <rule-id> <value>.