Ju571nK/sigil

Ju571nK

Rust14updated 24d ago

Fleet AI Security Posture Management (AI-SPM): client agents on each developer machine score their AI coding agents' guard surfaces (Claude Code, Cursor, Codex, Gemini CLI — permissions, hooks, sandboxes, mcp.json) and ship hash-anchored events to a central server + your SIEM. Fleet-wide posture; measures, doesn't block. Rust.

ClaudeCodexCursorMCP

ai-agentai-coding-agentai-securityai-spmclaude-codecodexcursorcybersecuritydetection-engineeringdeveloper-securityendpoint-securitygemini-cli

View on GitHub

README

Sigil — fleet AI security posture management for AI coding agents

Sigil gives security teams a fleet-wide view of what their AI coding agents are allowed to do. A lightweight client agent on every developer machine scores the guard surfaces of Claude Code, Cursor, Codex, and Gemini CLI — permissions, hooks, sandbox boundaries, and mcp.json servers — and ships hash-anchored events over mTLS to a central sigil-server, which feeds your SIEM and the optional sigil-manager fleet dashboard and pushes signed policy back down. It measures posture across the fleet; it does not block. Host-side AI Security Posture Management (AI-SPM), in Rust.

EDR sees the command that ran. Sigil sees the permission that let it run — the config that decided what your AI coding agent was allowed to do in the first place. Sigil measures that surface; it does not block.

See it

A security team's view first: sigil-manager renders the fleet's posture as a triage console — every AI Guard risk event across every host and agent, with severity, status, and assignee, the way a SOC already works. (The dashboard is a separate project: sigil-manager.)