Sponsio

Wire Sponsio runtime contracts into an LLM agent: author, validate, observe, enforce via CLI

Tested · Works

Test report

Verdict
Tested · Works
Score
9.2/10
Tested
Jul 21, 2026
Environment
Claude Code 2.x (agent harness)
Upstream re-checked
Aug 10, 2026 · 927f344

Installed sponsio 0.2.0a3 in a temp venv; every CLI verb the skill's "Public API surface" section claims (validate, patterns, packs, init, onboard, scan, check, report, doctor, plugin, prompt) exists in --help. Ran `sponsio validate` on two NL rules: rate_limit and must_precede compiled to LTL formulas, and `validate --config --json` returned exactly the {nl,ok,type,pattern,formula,agent,section} shape the skill documents. OUTPUT test: a naive baseline.yaml (agents as a list, `rules:` key) crashed with `ConfigError: 'agents' must be a mapping`, while the skill-followed sponsio.yaml (agents-as-dict, contracts:, A/G keys, backticked tool names) validated all 3 contracts green; I also directly observed the backtick trap the skill warns about (unbackticked tool names return SYNTAX-ERROR). No security smells: no curl|sh, no base64, no exfiltration; the skill instead adds self-modify guardrails.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

  • Installs cleanly 5/5
  • Triggers reliably 5/5
  • Output vs. baseline 8/10
  • Docs & honesty 5/5

What Sponsio does

Orchestrates the Sponsio CLI to add deterministic runtime guardrails to an LLM agent: generates and validates a sponsio.yaml contract file, explains what each contract enforces, tunes false positives from observe-mode logs, and flips observe to enforce. Triggers when the user wants to set up or install Sponsio, add agent guardrails, audit tool configs, or debug why a contract is or isn't firing. Requires the external `sponsio` pip package to do anything.

How to install Sponsio

git clone --depth 1 https://github.com/SponsioLabs/Sponsio.git /tmp/sponsio-src
mkdir -p ~/.claude/skills
cp -R /tmp/sponsio-src/sponsio/skills/sponsio ~/.claude/skills/sponsio
# Skill is pure CLI-orchestration — it needs the sponsio CLI to do anything:
#   pip install --pre sponsio      # stable pypi is 0.1.1; --pre gives 0.2.0a3 which matches the skill's documented CLI surface (sponsio init wizard, plugin append, etc.)
# Optional: OPENAI_API_KEY / ANTHROPIC_API_KEY / GEMINI_API_KEY enable `sponsio scan --llm` inference; AST extraction + validate/report/check work with zero keys.
# Plugin-marketplace alternative exists (plugins/sponsio-claude-code/), but the copy above is the canonical project-facing skill.

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Sponsio

  • /sponsio Wire Sponsio runtime contracts into an LLM agent: author, validate, observe, enforce via CLI

It also activates on plain-language prompts like these:

  • Set up Sponsio guardrails for my agent
  • Generate a sponsio.yaml for this project
  • Check what Sponsio would have blocked recently

Frequently asked questions

Is the Sponsio skill free?
Yes. The skill itself is free from SponsioLabs/Sponsio. SkillProof publishes the install command and an independent test verdict at no cost.
Does Sponsio work with Claude Code?
We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Tested · Works. Installed sponsio 0.2.0a3 in a temp venv; every CLI verb the skill's "Public API surface" section claims (validate, patterns, packs, init, onboard, scan, check, report, doctor, plugin, prompt) exists in --help. Ran `sponsio validate` on two NL rules: rate_limit and must_precede compiled to LTL formulas, and `validate --config --json` returned exactly the {nl,ok,type,pattern,formula,agent,section} shape the skill documents. OUTPUT test: a naive baseline.yaml (agents as a list, `rules:` key) crashed with `ConfigError: 'agents' must be a mapping`, while the skill-followed sponsio.yaml (agents-as-dict, contracts:, A/G keys, backticked tool names) validated all 3 contracts green; I also directly observed the backtick trap the skill warns about (unbackticked tool names return SYNTAX-ERROR). No security smells: no curl|sh, no base64, no exfiltration; the skill instead adds self-modify guardrails.
What is the Sponsio SkillProof Score?
9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
How do I install Sponsio?
Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Sponsio with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.