Sponsio
Wire Sponsio runtime contracts into an LLM agent: author, validate, observe, enforce via CLI
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 21, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 927f344
Installed sponsio 0.2.0a3 in a temp venv; every CLI verb the skill's "Public API surface" section claims (validate, patterns, packs, init, onboard, scan, check, report, doctor, plugin, prompt) exists in --help. Ran `sponsio validate` on two NL rules: rate_limit and must_precede compiled to LTL formulas, and `validate --config --json` returned exactly the {nl,ok,type,pattern,formula,agent,section} shape the skill documents. OUTPUT test: a naive baseline.yaml (agents as a list, `rules:` key) crashed with `ConfigError: 'agents' must be a mapping`, while the skill-followed sponsio.yaml (agents-as-dict, contracts:, A/G keys, backticked tool names) validated all 3 contracts green; I also directly observed the backtick trap the skill warns about (unbackticked tool names return SYNTAX-ERROR). No security smells: no curl|sh, no base64, no exfiltration; the skill instead adds self-modify guardrails.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 8/10
- Docs & honesty 5/5
What Sponsio does
Orchestrates the Sponsio CLI to add deterministic runtime guardrails to an LLM agent: generates and validates a sponsio.yaml contract file, explains what each contract enforces, tunes false positives from observe-mode logs, and flips observe to enforce. Triggers when the user wants to set up or install Sponsio, add agent guardrails, audit tool configs, or debug why a contract is or isn't firing. Requires the external `sponsio` pip package to do anything.
How to install Sponsio
git clone --depth 1 https://github.com/SponsioLabs/Sponsio.git /tmp/sponsio-src
mkdir -p ~/.claude/skills
cp -R /tmp/sponsio-src/sponsio/skills/sponsio ~/.claude/skills/sponsio
# Skill is pure CLI-orchestration — it needs the sponsio CLI to do anything:
# pip install --pre sponsio # stable pypi is 0.1.1; --pre gives 0.2.0a3 which matches the skill's documented CLI surface (sponsio init wizard, plugin append, etc.)
# Optional: OPENAI_API_KEY / ANTHROPIC_API_KEY / GEMINI_API_KEY enable `sponsio scan --llm` inference; AST extraction + validate/report/check work with zero keys.
# Plugin-marketplace alternative exists (plugins/sponsio-claude-code/), but the copy above is the canonical project-facing skill.
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Sponsio
-
/sponsioWire Sponsio runtime contracts into an LLM agent: author, validate, observe, enforce via CLI
It also activates on plain-language prompts like these:
-
Set up Sponsio guardrails for my agent -
Generate a sponsio.yaml for this project -
Check what Sponsio would have blocked recently
Frequently asked questions
- Is the Sponsio skill free?
- Yes. The skill itself is free from SponsioLabs/Sponsio. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Sponsio work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Tested · Works. Installed sponsio 0.2.0a3 in a temp venv; every CLI verb the skill's "Public API surface" section claims (validate, patterns, packs, init, onboard, scan, check, report, doctor, plugin, prompt) exists in --help. Ran `sponsio validate` on two NL rules: rate_limit and must_precede compiled to LTL formulas, and `validate --config --json` returned exactly the {nl,ok,type,pattern,formula,agent,section} shape the skill documents. OUTPUT test: a naive baseline.yaml (agents as a list, `rules:` key) crashed with `ConfigError: 'agents' must be a mapping`, while the skill-followed sponsio.yaml (agents-as-dict, contracts:, A/G keys, backticked tool names) validated all 3 contracts green; I also directly observed the backtick trap the skill warns about (unbackticked tool names return SYNTAX-ERROR). No security smells: no curl|sh, no base64, no exfiltration; the skill instead adds self-modify guardrails.
- What is the Sponsio SkillProof Score?
- 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
- How do I install Sponsio?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Sponsio with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.