{"slug": "doberman-stops-your-ai-before-it-goes-rogue", "title": "Doberman: Stops your AI before it goes rogue", "summary": "A developer created Doberman, an open-source tool that intercepts coding agents' tool calls to prevent rogue actions like deleting databases or exfiltrating secrets. It sits on the execution path, issuing PASS, AUTH, or BLOCK verdicts before any command runs, and supports Claude Code, Codex CLI, and MCP clients.", "body_md": "I built Doberman because a Claude code made me lose a hackathon. It got stuck on a bug and decided the best fix was just deleting the entire database, 5 minutes before demo time, and there was nothing standing between \"the agent decided\" and \"the agent did it.\" I didn't win that hackathon.\n\nDoberman is local-first, open-source (Apache-2.0), and it sits on the execution path between your coding agent and its tools. Every shell command, every file write, every MCP call gets exactly one verdict before it's allowed to run: PASS, AUTH, or BLOCK. Here's the whole setup, in two commands, and what it actually looks like when it works.\n\n```\npip install doberman-core\n```\n\nThat's the package. Python 3.11+, and it ships as `doberman-core`\n\non PyPI (the bare `doberman`\n\nname belongs to an unrelated, abandoned project; the CLI command is still `doberman`\n\n).\n\n```\ndoberman setup\n```\n\nThis is the wizard. It detects which agents you have installed (Claude Code via hooks, Codex CLI experimentally, Claude Desktop/Cursor/any MCP client via a transparent proxy, and OpenClaw natively), asks which ones you want guarded, picks a strictness mode, tunes the guardrails, wires the hooks, and then asks about telemetry. It finishes with a health-check pass and, if you wired a hooks-based host, offers to run a scripted attack right there so you can watch it work.\n\nFor Claude Code specifically, this is the recommended path: it wires a `PreToolUse`\n\nhook that gates every built-in and MCP tool call before it runs.\n\nEvery action out of your agent resolves to one of three verdicts:\n\nThat last part is the whole point. This isn't a prompt filter reading what the model said it would do: it's on the execution path, so a blocked call literally never runs, no matter how the model was talked into requesting it.\n\n```\ndoberman demo\n```\n\nThis replays a scripted rogue-agent sequence through the real decision engine: a secret exfiltration, an `rm -rf`\n\n, a force push to a protected branch, a smuggled-token egress, and a `.env`\n\nread, all blocked. Then it hands you a pending approval for a high-risk SSH-trust-file write and waits for a human to deny it. Nothing here touches a real tool or downstream server: it's the same engine your actual traffic runs through, just fed a script. `--fast`\n\nskips the pacing, `--mode <name>`\n\nruns it under a different strictness setting, `--quiet`\n\n/`-q`\n\nkeeps the summary but drops the narration.\n\nIf you've also got the dashboard installed (`pip install 'doberman-core[dash]'`\n\n, then `doberman dash`\n\n), run the demo next to it and watch the same five blocks land in a live feed as they happen.\n\n```\ndoberman log --why\n```\n\nThe decision log is local SQLite, redacted: verdicts, reason codes, and HMAC-SHA256 fingerprints, never raw secrets or full payloads. `--why`\n\nturns the reason codes into a plain-language explanation. If you'd rather browse interactively, `pip install \"doberman-core[tui]\"`\n\nthen `doberman tui`\n\ngives you the same rows with a keyboard-driven why panel.\n\nAnonymous usage counts (command names and daily totals, never paths, prompts, or secrets) are on by default. Turn them off with:\n\n```\ndoberman telemetry off\n```\n\nor set `DO_NOT_TRACK=1`\n\nin your environment before you ever run a command, if you'd rather it never mint an id in the first place.\n\nIt's alpha software with a real test suite behind it (2,000+ tests in CI as of v0.18.5), so if you hit a rough edge, submit an issue and I'll get to it within a week. I'd genuinely like to know what breaks it.\n\nGitHub: [https://github.com/DobermanCore/Doberman-Core](https://github.com/DobermanCore/Doberman-Core)\n\nDocs: [https://docs.trydoberman.dev](https://docs.trydoberman.dev)", "url": "https://wpnews.pro/news/doberman-stops-your-ai-before-it-goes-rogue", "canonical_source": "https://dev.to/doberman/doberman-stops-your-ai-when-it-goes-rogue-2c69", "published_at": "2026-09-03 06:09:56+00:00", "updated_at": "2026-09-03 06:22:46.296503+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools", "ai-tools"], "entities": ["Doberman", "Claude Code", "Codex CLI", "OpenClaw", "MCP", "PyPI", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/doberman-stops-your-ai-before-it-goes-rogue", "markdown": "https://wpnews.pro/news/doberman-stops-your-ai-before-it-goes-rogue.md", "text": "https://wpnews.pro/news/doberman-stops-your-ai-before-it-goes-rogue.txt", "jsonld": "https://wpnews.pro/news/doberman-stops-your-ai-before-it-goes-rogue.jsonld"}}