Doberman: Stops your AI before it goes rogue A developer created Doberman, an open-source tool that intercepts coding agents' tool calls to prevent rogue actions like deleting databases or exfiltrating secrets. It sits on the execution path, issuing PASS, AUTH, or BLOCK verdicts before any command runs, and supports Claude Code, Codex CLI, and MCP clients. I built Doberman because a Claude code made me lose a hackathon. It got stuck on a bug and decided the best fix was just deleting the entire database, 5 minutes before demo time, and there was nothing standing between "the agent decided" and "the agent did it." I didn't win that hackathon. Doberman is local-first, open-source Apache-2.0 , and it sits on the execution path between your coding agent and its tools. Every shell command, every file write, every MCP call gets exactly one verdict before it's allowed to run: PASS, AUTH, or BLOCK. Here's the whole setup, in two commands, and what it actually looks like when it works. pip install doberman-core That's the package. Python 3.11+, and it ships as doberman-core on PyPI the bare doberman name belongs to an unrelated, abandoned project; the CLI command is still doberman . doberman setup This is the wizard. It detects which agents you have installed Claude Code via hooks, Codex CLI experimentally, Claude Desktop/Cursor/any MCP client via a transparent proxy, and OpenClaw natively , asks which ones you want guarded, picks a strictness mode, tunes the guardrails, wires the hooks, and then asks about telemetry. It finishes with a health-check pass and, if you wired a hooks-based host, offers to run a scripted attack right there so you can watch it work. For Claude Code specifically, this is the recommended path: it wires a PreToolUse hook that gates every built-in and MCP tool call before it runs. Every action out of your agent resolves to one of three verdicts: That last part is the whole point. This isn't a prompt filter reading what the model said it would do: it's on the execution path, so a blocked call literally never runs, no matter how the model was talked into requesting it. doberman demo This replays a scripted rogue-agent sequence through the real decision engine: a secret exfiltration, an rm -rf , a force push to a protected branch, a smuggled-token egress, and a .env read, all blocked. Then it hands you a pending approval for a high-risk SSH-trust-file write and waits for a human to deny it. Nothing here touches a real tool or downstream server: it's the same engine your actual traffic runs through, just fed a script. --fast skips the pacing, --mode