STRIKE — Agent Runtime Protection

STRIKE is a feature built into SSG and SigmaShake Desktop that answers one question:

Is my AI development environment safe right now?

It runs continuously in the background, observes what your AI coding agents are doing at the OS level, correlates signals across process chains, network connections, and agent artifact writes, and surfaces a single Safe / Suspicious / Compromised verdict in the SSG governance dashboard.

What STRIKE Is

Agent Runtime Protection. STRIKE watches the runtime behavior of AI coding agents (Claude Code, Cursor, Codex, and any MCP-connected tool) — not just their declared intentions — and flags chains of behavior that match known compromise patterns: a plugin install followed by a write to your MCP configuration, followed by an outbound connection to a newly-registered domain.

Personal Compromise Monitor. Unlike fleet-oriented products, STRIKE is built for a single operator. It runs on your machine, stores its findings locally, and never exfiltrates your process tree or network connection table. The verdict is yours alone.

AI Supply Chain Security. STRIKE's primary differentiator is its supply-chain observer: it intercepts install verbs (npm, pip, cargo, gem, uv, go get) and writes to AI agent configuration paths (MCP server definitions, Claude Skills directories, CLAUDE.md, AGENTS.md, .cursor/rules, Codex plugins, ~/.config/claude/) and checks them against the SigmaShake Threats cloud threat-intelligence service using a privacy-preserving k-anonymity query. Traditional security products have no model for these artifacts; STRIKE does.

What STRIKE Is Not

STRIKE is not an EDR (Endpoint Detection and Response). It has no kernel driver, no eBPF probe, no ETW kernel filter, no kext. It reads only the OS-provided process tables, connection tables, and memory region permission flags from userspace. It is deliberately designed to coexist with your existing EDR/XDR deployment — it does not attempt to replace it.

STRIKE is not an antivirus or malware scanner. It does not scan files for signatures, does not maintain a local virus definition database, and does not quarantine files autonomously. It is not AV.

STRIKE is not an endpoint agent in the fleet-management sense. It does not phone home with your process tree. It does not send telemetry to SigmaShake servers. The only outbound calls it makes are the privacy-preserving k-anonymity reputation queries described under Privacy Model below.

STRIKE is not certified by any third-party security certification body and makes no such claim.

Stack

STRIKE ships as a single Go binary (daemon + CLI) embedded inside the SSG distribution. It has no separate installer.

Layer	Technology
Go backend	One binary: strike daemon + CLI; pure-Go by default
Local Event Graph	DuckDB (internal/graphstore), recursive-CTE traversal, stored at ~/.sigmashake/strike/graph.duckdb
Verdict / findings / audit store	SQLite via modernc.org/sqlite (pure-Go, no cgo), stored at ~/.sigmashake/strike/strike.sqlite
Dashboard card	React component (StrikeVerdictCard) in the SSG governance design system, served by ssg serve at the /strike route
Desktop shells	The card renders inside the existing WebView of all three desktop shells (macOS WKWebView, Linux WebKitGTK via Wails, Windows WebView2) with no native shell code change required

The DuckDB event graph is available behind the //go:build duckdb build tag when the cgo marcboeker/go-duckdb driver is present; the default build is pure-Go.

Privacy Model

STRIKE is built around a non-negotiable privacy principle: the full identity of any suspicious target never leaves your machine.

• Bloom digest + k-anonymity prefix only. When STRIKE queries the SigmaShake Threats cloud service for a domain, IP address, or package name, it sends only a 16-bit hash prefix. The server returns all matching records for that prefix; STRIKE resolves the match locally. The full target string is never transmitted.
• No plaintext IOCs on the endpoint. STRIKE does not store blocklists, YARA rules, or raw malware samples locally. The only local persistence is a bloom-filter digest and a per-entry confidence cache in strike.sqlite.
• No telemetry. STRIKE does not send usage data, session metadata, or any form of telemetry to SigmaShake or any third party.
• No other-process memory reads. Observers read only OS-provided metadata: process tables (/proc on Linux, libproc on macOS, Toolhelp32 on Windows), connection tables (/proc/net/tcp on Linux, GetExtendedTcpTable on Windows), and memory region permission flags (not memory contents). STRIKE never reads another process's memory, never injects, and never ptrace-reads.

Enabling Enforcement

STRIKE ships in OBSERVE mode by default. In OBSERVE mode, it generates verdicts and displays them in the dashboard but takes no containment action.

To enable enforcement, open the SSG dashboard, navigate to STRIKE, and toggle Enforcement on. This is an explicit operator action; enforcement is never automatically enabled on install or upgrade.

When enforcement is enabled, the containment engine operates under a non-negotiable safety net:

1. Tier-0 never-touch allowlist (see below) — containment never acts on any tier-0 entity under any circumstances.
2. Reversible-first — the engine always prefers pause, quarantine, or disable over kill.
3. Human-confirm for irreversible actions — revoke-credentials and remove-persistence require you to click a confirm button in the dashboard. If you do not confirm within 30 seconds, the action is dropped (fail-safe).
4. Fail-safe on stale or degraded verdict — if the verdict is older than 60 seconds, if the risk engine returns an error, or if threat intelligence is unavailable, containment takes no action and logs the event.

Tier-0 Never-Touch Allowlist

The following processes, hosts, and registries are in the tier-0 never-touch allowlist. Containment will never kill, block, throttle, or quarantine any of them under any circumstances, even when enforcement is enabled and a Compromised verdict is active.

Processes: ssg daemon, the SigmaShake Desktop shell (all three platforms), your editor or IDE (VS Code, Cursor, Zed, Neovim, and equivalents), OBS Studio, your shell and terminal emulator (bash, zsh, fish, tmux, kitty, and equivalents), and all init and system-critical processes (systemd/launchd/SCM and their children).

Hosts: api.anthropic.com, github.com, and the major language package registries (npmjs.com, pypi.org, crates.io, rubygems.org, pkg.go.dev).

The tier-0 list is hard-coded in the containment engine and is not user-configurable. It exists to ensure that STRIKE can never be used — accidentally or by a compromised verdict — to disrupt the operator's own development environment.

Entitlement

STRIKE is part of the SSG feature set and is gated behind the existing $5/month SigmaShake subscription. The verdict card is not rendered for unauthenticated or unentitled sessions. There is no free tier for the verdict, card, or containment engine. SigmaShake is free to download and install; the value surfaces require an active subscription.

Legal

SigmaShake is a sole-operator individual entity (USA), not a corporation. The full legal entity name is: SigmaShake (sole-operator individual entity, USA).