I built Doberman because a Claude code made me lose a hackathon. It got stuck on a bug and decided the best fix was just deleting the entire database, 5 minutes before demo time, and there was nothing standing between "the agent decided" and "the agent did it." I didn't win that hackathon.
Doberman is local-first, open-source (Apache-2.0), and it sits on the execution path between your coding agent and its tools. Every shell command, every file write, every MCP call gets exactly one verdict before it's allowed to run: PASS, AUTH, or BLOCK. Here's the whole setup, in two commands, and what it actually looks like when it works.
pip install doberman-core
That's the package. Python 3.11+, and it ships as doberman-core
on PyPI (the bare doberman
name belongs to an unrelated, abandoned project; the CLI command is still doberman
).
doberman setup
This is the wizard. It detects which agents you have installed (Claude Code via hooks, Codex CLI experimentally, Claude Desktop/Cursor/any MCP client via a transparent proxy, and OpenClaw natively), asks which ones you want guarded, picks a strictness mode, tunes the guardrails, wires the hooks, and then asks about telemetry. It finishes with a health-check pass and, if you wired a hooks-based host, offers to run a scripted attack right there so you can watch it work.
For Claude Code specifically, this is the recommended path: it wires a PreToolUse
hook that gates every built-in and MCP tool call before it runs.
Every action out of your agent resolves to one of three verdicts:
That last part is the whole point. This isn't a prompt filter reading what the model said it would do: it's on the execution path, so a blocked call literally never runs, no matter how the model was talked into requesting it.
doberman demo
This replays a scripted rogue-agent sequence through the real decision engine: a secret exfiltration, an rm -rf
, a force push to a protected branch, a smuggled-token egress, and a .env
read, all blocked. Then it hands you a pending approval for a high-risk SSH-trust-file write and waits for a human to deny it. Nothing here touches a real tool or downstream server: it's the same engine your actual traffic runs through, just fed a script. --fast
skips the pacing, --mode <name>
runs it under a different strictness setting, --quiet
/-q
keeps the summary but drops the narration.
If you've also got the dashboard installed (pip install 'doberman-core[dash]'
, then doberman dash
), run the demo next to it and watch the same five blocks land in a live feed as they happen.
doberman log --why
The decision log is local SQLite, redacted: verdicts, reason codes, and HMAC-SHA256 fingerprints, never raw secrets or full payloads. --why
turns the reason codes into a plain-language explanation. If you'd rather browse interactively, pip install "doberman-core[tui]"
then doberman tui
gives you the same rows with a keyboard-driven why panel.
Anonymous usage counts (command names and daily totals, never paths, prompts, or secrets) are on by default. Turn them off with:
doberman telemetry off
or set DO_NOT_TRACK=1
in your environment before you ever run a command, if you'd rather it never mint an id in the first place.
It's alpha software with a real test suite behind it (2,000+ tests in CI as of v0.18.5), so if you hit a rough edge, submit an issue and I'll get to it within a week. I'd genuinely like to know what breaks it.
GitHub: https://github.com/DobermanCore/Doberman-Core
Docs: https://docs.trydoberman.dev