# SigmaShake Rules Hub
> Public registry of governance rules for AI agents

## What is SigmaShake?
SigmaShake is a governance engine that evaluates AI agent tool calls against declarative rules before execution. It can allow, deny, ask, force safe alternatives, log, or shadow-audit at the tool-call boundary with zero-token enforcement.

## This Service: Hub
The Hub at hub.sigmashake.com hosts two distinct surfaces:
- Rule sets — declarative .rules files that enforce policy on agent tool calls. Browse at /
- Plugins — signed tarballs that extend the SSG dashboard UI. Browse at /plugins

Both share the same Ed25519 signing root; rule sets carry per-author content signatures, plugins carry per-author artifact signatures.

## JSON API Endpoints
- GET /api/rulesets?page=0&limit=20&tech=ts&q=keyword — Paginated rulesets listing
- GET /api/rulesets/:id — Single ruleset with all rules and raw .rules syntax
- GET /api/plugins?page=0&limit=20&category=tools&q=keyword — Paginated plugin marketplace listing
- GET /api/plugins/:id — Plugin detail (manifest URL, SHA-256, Ed25519 signing fingerprint)
- GET /api/plugins/categories — Per-category plugin counts
- GET /api/search?q=keyword&tech=ts&format=json — Search rulesets (JSON)
- GET /api/technologies — List all available technologies
- POST /api/downloads/:id — Register a download (rate limited: 1/min/IP/ruleset)
- POST /api/eval — Evaluate a tool call against a ruleset (no install required, rate limited: 10/min/IP/ruleset)
- GET /api/health — Service health check

## Publishing Rules (AI Agent / Programmatic)
POST /api/submit — Submit a ruleset without browser OAuth
Headers: Authorization: Bearer <github_personal_access_token>
Body: {"repo": "https://github.com/owner/repo", "path": ".sigmashake/rules"}
Response: {"ok": true, "ruleset_id": "uuid", "hub_url": "https://hub.sigmashake.com/ruleset/uuid", "rule_count": 13, "technologies": ["ts"]}
Token scope required: public_repo (read public repos)

## Quick Publish (ssg CLI)
Install: pnpm add -g ssg
Publish: ssg publish  (creates GitHub repo + pushes rules + opens hub pre-filled)
One command. Requires: GitHub CLI (gh) authenticated.

## MCP Server
For AI agents using Model Context Protocol, connect to: https://mcp.sigmashake.com/sse
Tools: sigmashake_eval, sigmashake_rules_list, sigmashake_rules_get, sigmashake_audit, sigmashake_status, sigmashake_hub_submit

## Documentation
- Full docs: https://docs.sigmashake.com
- Rule syntax: https://docs.sigmashake.com/rule-syntax
- Getting started: https://docs.sigmashake.com/getting-started
- Architecture: https://docs.sigmashake.com/architecture

## Rule Syntax (Quick Reference)
```
rule block-dangerous-commands {
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "rm -rf"
  OR command CONTAINS "git push --force"
  MESSAGE "Destructive command blocked."
}
```

Fields: command, path, content, tool, input.<key>
Operators: CONTAINS, EQUALS, STARTS_WITH, ENDS_WITH, GLOB, REGEX, WORD, LINE_CONTAINS, LINE_REGEX
Decisions: ALLOW (permit), DENY (runtime: block), ASK (human approval), FORCE (refuses the original risky action and returns a safe substitute or required safer path), LOG (allow+audit), SHADOW (silent audit)
Targets: execution, read, write, edit, search, agent, network, any

## Contributing
Submit rulesets via GitHub OAuth at /submit. Rules must be in a public GitHub repository.
Source: https://github.com/sigmashakeinc/sigmashake-mono