Thriving 
RS Fleet AI Security Posture Management (AI-SPM): client agents on each developer machine score their AI coding agents' guard surfaces (Claude Code, Cursor, Codex, Gemini CLI — permissions, hooks, sandboxes, mcp.json) and ship hash-anchored events to a central server + your SIEM. Fleet-wide posture; measures, doesn't block. Rust.
// readme
Your Claude Code, Codex, and Cursor can run whatever their config allows. Sigil scores what that is — in one command, before something does.
A coding agent doesn’t ask before it runs a hook, launches an MCP server, or skips its sandbox. Those decisions live in config files you never open. Sigil reads them and tells you how exposed you are.
curl --proto '=https' --tlsv1.2 -fsSL https://raw.githubusercontent.com/Ju571nK/sigil/main/install.sh | sh
sigil scan
overall CRITICAL 7.5 · 7 tools · 14 findings
TOOL SCOPE SCORE BUCKET TOP FINDINGS
claude-code user-global 7.5 critical no_sandbox · broad_matcher (.* PreToolUse) · destructive_in_inline_command
codex user-global 5.6 high no_sandbox · mcp_server_local_command
cursor application 2.5 medium mcp_server_local_command
antigravity user-global 0.0 low clean
not configured: continue-dev, gemini · run `sigil scan --json` for every finding
Your EDR sees the command that ran. Sigil sees the permission that let it run.
Runs on your machine · no account · nothing leaves the box · macOS / Linux / Windows · Rust ·…
How much a project earns versus how much attention it actually gets. Above 50 means the work is outrunning its audience. Recomputed nightly from commit velocity, contributor effort, issue resolution, fork utility, release cadence, and project maturity — divided by a logarithmic reach factor.
score = signal / reach
signal = 0.25·commit_velocity // commits in last 90 days (cap 30)
+ 0.20·contributor_work // unique authors × velocity (cap 100)
+ 0.20·issue_resolution // closed ÷ total issues
+ 0.20·fork_ratio // forks ÷ stars (proxy for real usage)
+ 0.10·release_cadence // releases in 90 days (cap 3)
+ age_bonus // +0 to +0.30 after 6 months
+ homepage_bonus // +0.05 if homepage is set
reach = log₁₀(stars + watchers + 10)█ Is the project alive and maintained right now? A 0–100 pulse recomputed nightly from commit recency, rhythm, how fast issues close, and how quickly PRs get merged.
health = 0.35·recency // days since last commit (90d decay)
+ 0.25·cadence // commit rhythm consistency
+ 0.20·issue_health // closed ÷ total issues
+ 0.20·pr_health // merged ÷ total PRs█ The colour and label on every card come straight from the health score.
Healthy 80 – 100 active, responsive, regular releases
Stable 60 – 79 maintained, steady, no alarms
Quiet 40 – 59 slowing down — watch this one
At Risk 0 – 39 going dark · candidate for rescue█ Tags are independent behavioral signals computed nightly. A project can hold multiple at once. They drive the home page sections.
solo_builder one person holds > 80% of commits (last 180d)
needs_contributors has open "help wanted" or "good first issue" labels
hidden_gem < 100 stars · active in last 3 months · documented
legacy_hero repo > 5 years old · committed this year
fork_magnet forks/stars > 0.5 · used as template or dependency
release_machine 5+ releases in the last 90 days
under_pressure > 10 open issues · ≤ 2 contributors · health ≥ 60
community_watch watchers > stars · devs tracking before the public
community_hub GitHub Discussions enabled · > 20 discussions
funded maintainer has active funding channel█ Stars are an outcome, not effort. A project with 8 stars and daily commits is doing more interesting work than one coasting on 8k. We measure the building, then divide by the attention already received — so the genuinely undervalued rise to the top.
// stars = lagging indicator
// commits = leading indicator
// we rank by the leading one█