100
Rule sets
5
Plugins
1249
Rules enforced
346
Ruleset downloads
0
Plugin installs
Rule sets
100 rule sets
TypeScript
Official
TypeScript is a strongly typed programming language that builds on JavaScript. These rules govern type safety, vulnerability prevention, and idiomatic coding patterns for AI agents.
VerifiedtsCertified
Github-actions
Official
GitHub Actions is a CI/CD platform that allows you to automate your build, test, and deployment pipeline. These rules govern workflow security, secret management, and action configuration for AI agents.
VerifiedghaCertified
React
Official
React is a JavaScript library for building user interfaces based on components. These rules govern hook usage, state management, and component lifecycle best practices for AI agents.
VerifiedreactCertified
Docker
Official
Docker is a platform for developing and running applications in containers. These rules guide AI agents in containerizing applications, managing Dockerfiles, and optimizing multi-stage builds and Docker Compose configurations.
VerifieddockerCertified
Zig
Official
Zig is a general-purpose programming language and toolchain for maintaining robust, optimal and reusable software. These rules govern memory management safety and coding best practices for AI agents.
Verifiedzig-alloc-missing-deferzig-extern-ffi-no-boundszig-intcast-uncheckedzig-inttoptr-bannedzig-ptrcast-unjustifiedzig-unreachable-in-libzigCertified
Windows
Official
Windows is a major family of operating systems developed by Microsoft. These rules govern system security, administrative safety, and configuration best practices for AI agents.
VerifiedwindowsCertified
Rust
Official
Rust is a systems programming language focused on safety, speed, and concurrency. These rules govern memory management, ownership patterns, and idiomatic Rust development for AI agents — including filesystem-safety lessons learned from the Canonical/Zellic audit of rust-coreutils (CVE-2026-35338..35381).
VerifiedrustCertified
Bash
Official
Bash is a Unix shell and command language. These rules govern script structure, error handling, and security best practices for AI-assisted Bash scripting.
VerifiedbashCertified
Next.js
Official
Next.js is a React framework for building full-stack web applications. These rules govern Next.js development, focusing on secure Server Side Rendering (SSR), proper API route implementation, and efficient static site generation patterns.
VerifiednextjsCertified
Python
Official
Python is an interpreted, high-level, general-purpose programming language known for its readability. These rules govern idiomatic coding practices, environment management, and core library usage.
VerifiedpythonCertified
Secrets
Official
These rules govern the management, protection, and handling of sensitive information such as API keys and credentials. They ensure AI agents maintain high security standards and prevent accidental exposure of secrets.
VerifiedfsCertified
Ubuntu
Official
Ubuntu is a popular Linux distribution based on Debian. These rules govern system security, administrative safety, and configuration best practices for AI agents.
VerifiedubuntuCertified
Agent
Official
AI agent efficiency and cost-reduction rules. These rules prevent context-bloat and redirect shell commands to native agent tools to reduce token costs by 30-50%.
VerifiedagentCertified
Go
Official
Go is an open-source programming language that makes it easy to build simple, reliable, and efficient software. These rules govern Go development, concurrency patterns, and idiomatic code structure for AI agents.
VerifiedgoCertified
Elixir
Official
Elixir is a functional language for building scalable applications on the Erlang VM (BEAM). These rules govern high-concurrency, fault-tolerant systems development using OTP and Phoenix.
VerifiedelixirCertified
Macos
Official
Comprehensive macOS security & safety governance for AI coding agents — 44 rules spanning all 11 SSG tool-use categories: destructive operations, privilege escalation, untrusted code execution, credential & secret access, network egress, supply chain, process & system control, version-control integrity, source & config integrity, sensitive data handling, and agent hygiene. Blocks SIP/Gatekeeper bypass, keychain & credential theft, reverse shells & data exfiltration, untrusted .pkg / Homebrew installs, LaunchDaemon/Agent persistence, entitlement weakening, PII collection (Messages/Photos/Contacts), and irreversible disk / Time Machine destruction. Each rule is mapped to MITRE ATT&CK.
Protects against: Comprehensive macOS security & safety governance for AI coding agents — 44 rules spanning all 11 SSG tool-use categor…
VerifiedmacosCertified
Privacy-macos
Official
Privacy rules for macOS address the specific security features and data protection mechanisms of Apple's operating system. These rules govern application permissions, system security settings, and hardware-level privacy controls.
Protects against: Privacy rules for macOS address the specific security features and data protection mechanisms of Apple's operating sy…
VerifiedmacosCertified
Privacy-windows
Official
Privacy rules for Windows manage telemetry, system permissions, and secure configuration for Microsoft's operating system. These rules govern data collection settings, user privacy controls, and secure OS environment management.
Protects against: Privacy rules for Windows manage telemetry, system permissions, and secure configuration for Microsoft's operating sy…
VerifiedwindowsCertified
Sqlite
Official
SQLite is a lightweight, disk-based database engine. These rules govern efficient embedded database usage and SQL optimization for AI agents.
VerifiedsqliteCertified
Tailwind CSS
Official
Tailwind CSS is a utility-first CSS framework for rapid UI development. These rules govern dynamic class construction safety, configuration best practices, and purging optimization for AI agents.
VerifiedtailwindcssCertified
Electron
Official
Electron is a framework for building cross-platform desktop applications using web technologies. These rules assist AI agents in multi-process architecture, secure IPC communication, and native API integration.
VerifiedelectronCertified
Cursor
Official
Cursor is an AI-powered code editor built on VS Code. These rules guide AI agents in leveraging Cursor's unique features, such as indexed symbols and context-aware code generation, for seamless human-AI collaboration.
VerifiedcursorCertified
Csharp
Official
C# is a multi-paradigm programming language for the .NET ecosystem. These rules govern the development of robust applications with emphasis on asynchronous programming, LINQ, and modern .NET standards.
VerifiedcsCertified
Cloudflare
Official
Cloudflare is a global cloud platform providing security, performance, and reliability for web applications. These rules govern the configuration of Workers, WAF, and global traffic routing for AI agents.
VerifiedcloudflareCertified
Claude-code
Official
Governance rules for the Claude Code CLI that protect against CVEs and security incidents. These rules block malicious hook execution, credential theft, and command injection bypasses.
Verifiedagentclaude-codeclaudecodeCertified
Catboost
Official
CatBoost is an open-source gradient boosting on decision trees library. These rules govern model training, hyperparameter tuning, and data preprocessing for AI-assisted CatBoost development.
VerifiedcatboostCertified
Bun
Official
Bun is a fast, all-in-one JavaScript runtime. These rules govern package management, script execution, and performance optimization for AI-assisted Bun development.
VerifiedbunCertified
Azure
Official
Microsoft Azure is a cloud computing service for building, testing, deploying, and managing applications. These rules govern resource management, security compliance, and best practices for AI-assisted Azure administration.
VerifiedazureCertified
AWS
Official
Amazon Web Services (AWS) is a comprehensive, evolving cloud computing platform. These rules govern IAM policies, resource provisioning, and security best practices for AI-assisted AWS infrastructure management.
VerifiedawsCertified
JavaScript
Official
JavaScript is a lightweight, interpreted, or just-in-time compiled programming language with first-class functions. These rules govern modern JavaScript development, ecosystem usage, and asynchronous patterns for AI agents.
VerifiedjsCertified
Kotlin
Official
Kotlin/Android security governance rules for AI coding agents. Blocks force non-null assertions that cause NPEs, SQL string interpolation, Java deserialization (RCE), command injection via Runtime.exec(), hardcoded credentials, unsafe unchecked casts, and cleartext HTTP in production.
VerifiedkotlinCertified
MCP
Official
Security, safety, and efficiency rules for AI agents calling SigmaShake MCP (Model Context Protocol) server tools. Blocks rule injection attacks, API key exposure in audit logs, accidental hub publishing, and token-wasting query patterns.
VerifiedmcpCertified
MongoDB
Official
MongoDB is a source-available, cross-platform, document-oriented database program. These rules govern MongoDB operations to prevent insecure queries, misconfigured authentication, and accidental data exposure in NoSQL environments.
VerifiedmongodbCertified
Node.js
Official
Node.js is an open-source, cross-platform, JavaScript runtime environment. These rules govern Node.js application development, preventing common vulnerabilities like command injection, insecure file system access, and improper error handling.
VerifiednodejsCertified
Openai-codex
Official
OpenAI Codex is an artificial intelligence model that parses natural language and generates code in response. These rules govern prompt engineering, code generation quality, and secure API integration.
VerifiedcodexCertified
Playwright
Official
Playwright is a framework for Web testing and automation that allows testing across all modern rendering engines. These rules govern browser automation, end-to-end testing, and cross-browser compatibility.
VerifiedplaywrightCertified
Scala
Official
Scala is a high-level language that combines object-oriented and functional programming. These rules govern type-safe development and functional programming patterns for AI-assisted Scala engineering.
VerifiedscalaCertified
Swift
Official
Swift is a powerful and intuitive programming language for Apple platforms. These rules govern idiomatic Swift patterns and app architecture best practices for AI agents.
VerifiedswiftCertified
Tauri
Official
Tauri is a framework for building small, fast, and secure desktop applications with web technologies and Rust. These rules govern security isolation, IPC communication, and system capability management for AI agents.
VerifiedtauriCertified
tRPC
Official
tRPC is a framework for building end-to-end typesafe APIs without code generation. These rules govern procedure definition safety, input validation, and API best practices for AI agents.
VerifiedtrpcCertified
Vue.js
Official
Vue.js is a progressive JavaScript framework for building user interfaces. These rules govern component structure, reactivity safety, and security best practices for AI agents.
VerifiedvueCertified
Webassembly
Official
WebAssembly is a binary instruction format for a stack-based virtual machine. These rules govern module loading safety and security boundary enforcement for AI agents.
VerifiedwebassemblyCertified
Git
Official
Git is a distributed version control system for tracking changes in source code during software development. These rules govern repository management, commit standards, and branching strategies for AI agents.
VerifiedgitCertified
Gemini-3.1
Official
Gemini 3.1 is a high-performance multimodal model from Google optimized for tool execution and long-context reasoning. These rules govern tool hijacking mitigation and prompt injection prevention for Gemini 3.1 agents.
Verifiedgemini-3.1Certified
GCP
Official
Google Cloud Platform (GCP) is a suite of cloud computing services that runs on the same infrastructure that Google uses internally. These rules govern resource management, authentication, and service deployment on GCP for AI agents.
VerifiedgcpCertified
Firebase
Official
Firebase is a comprehensive application development platform by Google. These rules assist AI agents in real-time data synchronization, cloud functions, and security rule enforcement for mobile and web apps.
VerifiedfirebaseCertified
Esbuild
Official
esbuild is an extremely fast JavaScript bundler and minifier written in Go. These rules govern the configuration of high-performance build pipelines, code splitting, and optimization for modern web development.
VerifiedesbuildCertified
Erlang
Official
Erlang is a functional language used for massively scalable systems with high availability. These rules guide AI agents in process isolation, message passing, and hot code reloading within the OTP framework.
VerifiederlangCertified
ELK Stack
Official
The ELK Stack (Elasticsearch, Logstash, Kibana) is a toolset for log searching and visualization. These rules govern log aggregation, index management, and dashboard creation for observability and security analytics.
VerifiedelkCertified
Dynamodb
Official
AWS DynamoDB is a fully managed NoSQL database service providing fast and predictable performance. These rules guide AI agents in schema design, partition key selection, and efficient querying for serverless applications.
VerifieddynamodbCertified
Droneci
Official
Drone CI is a container-native continuous integration platform using YAML-based configuration. These rules govern the definition of pipelines, secret management, and automated testing in ephemeral CI environments.
VerifieddroneciCertified
Drizzle
Official
Drizzle ORM is a lightweight, type-safe TypeScript ORM with SQL-like syntax. These rules govern schema definition, migrations, and efficient database querying for modern TypeScript projects.
VerifieddrizzleCertified
Diffusers
Official
Hugging Face Diffusers is a library for state-of-the-art pretrained diffusion models. These rules govern the configuration and optimization of diffusion pipelines for AI-driven creative and generative image/audio tasks.
VerifieddiffusersCertified
Deno
Official
Deno is a modern, secure runtime for JavaScript and TypeScript built in Rust. These rules assist AI agents in module management, security permissions, and building high-performance server-side applications.
VerifieddenoCertified
Datadog
Official
Datadog is a monitoring and security platform for cloud-scale applications. These rules govern the integration of Datadog's observability tools, including tracing, logging, and infrastructure monitoring for AI-driven systems.
VerifieddatadogCertified
Dart
Official
Dart is a client-optimized language for fast apps on any platform, primarily used with Flutter. These rules govern sound null safety, performance optimization, and cross-platform application development.
VerifieddartCertified
D
Official
D is a systems programming language combining performance with expressive syntax. These rules assist AI agents in memory management, template metaprogramming, and concurrency using D's unique safety and efficiency features.
VerifieddCertified
Cypress
Official
Cypress is a modern end-to-end testing framework for web applications. These rules govern the creation of robust integration and E2E tests, emphasizing best practices for assertions, network intercepting, and test isolation.
VerifiedcypressCertified
Crystal
Official
Crystal is a type-safe, compiled language with Ruby-like syntax designed for performance. These rules assist AI agents in type inference, concurrency using fibers, and high-performance systems development.
VerifiedcrystalCertified
Cpp
Official
C++ is a high-performance, systems-level programming language. These rules govern memory safety, RAII, modern standards (C++17/20/23), and performance optimization for AI-driven C++ projects.
VerifiedcppCertified
Couchdb
Official
Apache CouchDB is a document-oriented NoSQL database that uses JSON for storage and HTTP for its API. These rules guide AI agents in database replication, view creation, and conflict resolution using MVCC.
VerifiedcouchdbCertified
Cosmosdb
Official
Azure Cosmos DB is a globally distributed, multi-model NoSQL database service for high-performance applications. These rules govern database provisioning, data modeling, and consistency management for AI-driven Azure applications.
VerifiedcosmosdbCertified
Cordova
Official
Apache Cordova is a mobile development framework for building cross-platform apps using web technologies. These rules assist AI agents in plugin management, build configurations, and native platform integration.
VerifiedcordovaCertified
Consul
Official
HashiCorp Consul is a service networking solution for service discovery, configuration, and segmentation. These rules govern service mesh implementation, health monitoring, and dynamic configuration for distributed AI systems.
VerifiedconsulCertified
Compose Multiplatform
Official
Compose Multiplatform is a declarative UI framework for sharing Kotlin-based UI code across Android, iOS, Desktop, and Web. These rules assist AI agents in building consistent, reactive cross-platform user interfaces.
Protects against: Compose Multiplatform is a declarative UI framework for sharing Kotlin-based UI code across Android, iOS, Desktop, an…
Verifiedcompose-multiplatformCertified
Cohere
Official
Cohere provides enterprise-grade AI models for natural language processing, embeddings, and reranking. These rules govern the integration of Cohere's API for high-performance text generation and semantic search tasks.
VerifiedcohereCertified
Cloudformation
Official
AWS CloudFormation is an Infrastructure as Code (IaC) service for provisioning and managing AWS resources using templates. These rules guide AI agents in defining, deploying, and managing complex AWS stacks and resource dependencies.
Protects against: AWS CloudFormation is an Infrastructure as Code (IaC) service for provisioning and managing AWS resources using templ…
VerifiedcloudformationCertified
Clojure
Official
Clojure is a dynamic, general-purpose functional programming language. These rules govern functional patterns, concurrency, and REPL-driven development for AI-assisted Clojure.
VerifiedclojureCertified
Claude-mythos
Official
Advanced security hardening rules for sophisticated AI agent capabilities. These rules defend against memory exploitation, network egress threats, and Living off the Land abuse.
Verified00-sensitive-paths01-anti-concealment02-network-egress03-destructive-ops-hitl04-custom-exploit-compilation05-lotl-abuse06-kernel-and-injection07-advanced-memory-threats08-advanced-network-threatsCertified
Claude-code-fixes
Official
Guardrails that resolve common Claude Code pain points like infinite loops and accidental code deletion. These rules save API costs and protect codebases from autonomous mistakes.
Verifiedclaude-codeCertified
Claude-4.6
Official
Governance rules designed to protect against agentic vulnerabilities in Claude 4.6 workflows. These rules prevent approval fatigue, context pollution loops, and common AI-driven security risks.
Verifiedclaude-4.6Certified
Circleci
Official
CircleCI is a modern continuous integration and delivery platform. These rules govern config.yml structure, job definitions, and security for AI-assisted CircleCI automation.
VerifiedcircleciCertified
Chroma
Official
Chroma is an open-source embedding database. These rules govern collection management, embedding storage, and retrieval optimization for AI-assisted ChromaDB development.
VerifiedchromaCertified
Chef
Official
Chef is an infrastructure automation platform. These rules govern cookbook structure, recipe definitions, and security best practices for AI-assisted Chef automation.
VerifiedchefCertified
Chakra UI
Official
Chakra UI is a simple, modular, and accessible component library for React. These rules govern theme customization, component usage, and accessibility for AI-assisted Chakra UI development.
Verifiedchakra-uiCertified
Cassandra
Official
Apache Cassandra is a free and open-source, distributed, wide-column store, NoSQL database management system. These rules govern data modeling, query optimization, and cluster configuration for AI-assisted Cassandra management.
VerifiedcassandraCertified
Capacitor
Official
Capacitor is an open-source native runtime for building Web Native apps. These rules govern plugin usage, native platform integration, and build processes for AI-assisted Capacitor development.
VerifiedcapacitorCertified
C
Official
C is a general-purpose, procedural computer programming language. These rules govern memory management, pointer usage, and security best practices for AI-assisted C development.
VerifiedcCertified
Boundary
Official
HashiCorp Boundary provides identity-aware, least-privileged access to infrastructure. These rules govern target definitions, session management, and security policies for AI-assisted Boundary administration.
VerifiedboundaryCertified
Bootstrap
Official
Bootstrap is a powerful, feature-packed frontend toolkit. These rules govern grid layout, component usage, and responsive design best practices for AI-assisted Bootstrap development.
VerifiedbootstrapCertified
Bitbucket-actions
Official
Bitbucket Pipelines/Actions is a CI/CD service built into Bitbucket. These rules govern pipeline configurations, step definitions, and security for AI-assisted Bitbucket automation.
Verifiedbitbucket-actionsCertified
Astro
Official
Astro is a modern web framework for building fast, content-focused websites. These rules govern component islands, static site generation, and performance optimization for AI-assisted Astro development.
VerifiedastroCertified
ArgoCD
Official
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. These rules govern application manifests, sync policies, and security best practices for AI-assisted Argo CD management.
VerifiedargocdCertified
Apache
Official
The Apache HTTP Server is a widely-used web server software. These rules govern configuration best practices, security hardening, and module management for AI-assisted Apache server administration.
VerifiedapacheCertified
Anthropic
Official
Strict safety and best-practice governance for AI agents working with Anthropic models and APIs. These rules block destructive operations and enforce modern security standards.
VerifiedanthropicCertified
Ant Design
Official
Ant Design is a React UI framework that contains a set of high-quality components and demos for building rich, interactive user interfaces. These rules govern component usage, design system alignment, and accessibility for AI-assisted development.
Protects against: Ant Design is a React UI framework that contains a set of high-quality components and demos for building rich, intera…
Verifiedant-designCertified
Ansible
Official
Ansible is an IT automation tool that automates configuration management, application deployment, and intra-service orchestration. These rules govern playbook structure, module usage, and security for AI-assisted Ansible automation.
Protects against: Ansible is an IT automation tool that automates configuration management, application deployment, and intra-service o…
VerifiedansibleCertified
Angular
Official
Angular is a web development framework for building single-page applications. These rules govern component structure, dependency injection, and best practices for AI-assisted Angular development.
VerifiedangularCertified
Alpine.js
Official
Alpine.js is a rugged, minimal tool for composing behavior directly in your markup. These rules govern reactive patterns, directive usage, and security best practices for AI-assisted Alpine.js development.
VerifiedalpinejsCertified
Yarn
Official
Yarn is a package manager that doubles as a project manager. These rules govern dependency version pinning and lockfile integrity for AI agents.
VerifiedyarnCertified
Xgboost
Official
XGBoost is an optimized distributed gradient boosting library designed to be highly efficient, flexible and portable. These rules govern model parameter safety and data handling for AI agents.
VerifiedxgboostCertified
Xamarin
Official
Xamarin is an open-source platform for building modern and performant applications for iOS, Android, and Windows with .NET. These rules govern native interop and application security for AI agents.
VerifiedxamarinCertified
Webrtc
Official
WebRTC is an open-source project that enables real-time communication in web browsers and mobile applications. These rules govern peer connection safety and media handling for AI agents.
VerifiedwebrtcCertified
webpack
Official
webpack is a static module bundler for modern JavaScript applications. These rules govern plugin safety, security configurations, and build performance for AI agents.
VerifiedwebpackCertified
Webgl
Official
WebGL is a JavaScript API for rendering high-performance interactive 3D and 2D graphics. These rules govern shader safety and resource management for AI agents.
VerifiedwebglCertified
Weaviate
Official
Weaviate is an open-source vector database that allows you to store data objects and vector embeddings. These rules govern schema definitions, query efficiency, and indexing best practices for AI agents.
VerifiedweaviateCertified
Waypoint
Official
HashiCorp Waypoint is a tool to build, deploy, and manage applications across any platform. These rules govern deployment configuration safety and application management for AI agents.
VerifiedwaypointCertified
Vlang
Official
V is a statically typed compiled programming language designed for building maintainable software. These rules govern memory safety, syntax idioms, and compiler safety for AI agents.
VerifiedvlangCertified
Vitest
Official
Vitest is a Vite-native unit test framework. These rules govern test suite reliability, hook usage, and best practices for AI agents.
VerifiedvitestCertified
Vite
Official
Vite is a frontend build tool that provides a fast and modern development experience. These rules govern dev server security and build optimization best practices for AI agents.
VerifiedviteCertified
Plugins
Browse all plugins
5 plugins
SigmaShake STRIKE
VerifiedUserspace AI-agent compromise monitor — live Safe/Suspicious/Compromised verdict per agent session, with behavioral signal classification and session-level risk scoring.
Slack Approvals
VerifiedApprove or deny SSG tool-call prompts from Slack — Block Kit buttons over Socket Mode (no public URL), with an approver allowlist that verifies the human.
Voice Dictation
CommunityLocal Whisper voice-to-text (whisper.cpp WASM) with a settable hotkey — dictate in the SSG dashboard or Desktop and turn speech into a .rules file.
Workspace
VerifiedMonorepo manager for SigmaShake — projects, health, run scripts, edit, distribution, platform parity, and QA status.
Hello Plugin
VerifiedMinimal first plugin proving the SSG marketplace install flow.