I built Doberman because a coding agent deleted my project ten minutes before a hackathon demo. It misread a prompt, ran the wrong command, and there was nothing standing between "the agent decided" and "the agent did it." I didn't win that hackathon. I built a guard dog instead.

Doberman is local-first, open-source (Apache-2.0), and it sits on the execution path between your coding agent and its tools. Every shell command, every file write, every MCP call gets exactly one verdict before it's allowed to run: PASS, AUTH, or BLOCK. Here's the whole setup, in two commands, and what it actually looks like when it works.

Install

pip install doberman-core

That's the package. Python 3.11+, and it ships as doberman-core on PyPI (the bare doberman name belongs to an unrelated, abandoned project; the CLI command is still doberman).

Wire it up

doberman setup

This is the wizard. It detects which agents you have installed (Claude Code via hooks, Codex CLI experimentally, Claude Desktop/Cursor/any MCP client via a transparent proxy, and OpenClaw natively), asks which ones you want guarded, picks a strictness mode, tunes the guardrails, wires the hooks, and then asks about telemetry. It finishes with a health-check pass and, if you wired a hooks-based host, offers to run a scripted attack right there so you can watch it work.

For Claude Code specifically, this is the recommended path: it wires a PreToolUse hook that gates every built-in and MCP tool call before it runs.

What PASS / AUTH / BLOCK actually mean

Every action out of your agent resolves to one of three verdicts:

• PASS - routine work, straight through, no friction.

• AUTH - sensitive enough to pause and ask you. Repeat the exact same action within five minutes and it re-prompts with a one-click confirm instead of the full challenge (never for anything destructive).

• BLOCK - dangerous, stopped cold before it reaches the tool.

That last part is the whole point. This isn't a prompt filter reading what the model said it would do: it's on the execution path, so a blocked call literally never runs, no matter how the model was talked into requesting it.

Watch it happen

doberman demo

This replays a scripted rogue-agent sequence through the real decision engine: a secret exfiltration, an rm -rf, a force push to a protected branch, a smuggled-token egress, and a .env read, all blocked. Then it hands you a pending approval for a high-risk SSH-trust-file write and waits for a human to deny it. Nothing here touches a real tool or downstream server: it's the same engine your actual traffic runs through, just fed a script. --fast skips the pacing, --mode <name> runs it under a different strictness setting, --quiet/-q keeps the summary but drops the narration.

If you've also got the dashboard installed (pip install 'doberman-core[dash]', then doberman dash), run the demo next to it and watch the same five blocks land in a live feed as they happen.

When something gets blocked and you want to know why

doberman log --why

The decision log is local SQLite, redacted: verdicts, reason codes, and HMAC-SHA256 fingerprints, never raw secrets or full payloads. --why turns the reason codes into a plain-language explanation. If you'd rather browse interactively, pip install "doberman-core[tui]" then doberman tui gives you the same rows with a keyboard-driven why panel.

Turning telemetry off

Anonymous usage counts (command names and daily totals, never paths, prompts, or secrets) are on by default. Turn them off with:

doberman telemetry off

or set DO_NOT_TRACK=1 in your environment before you ever run a command, if you'd rather it never mint an id in the first place.

What this does not do

Doberman is defense-in-depth, not airtight, and I'd rather say that here than have you find out the hard way. The objective, deterministic layer that ships today is strong at path confinement, destructive-command detection, and known secret/egress shapes, but it's honest about its gaps: pure natural-language prompt injection with no matching command shape isn't something the deterministic rules alone catch: that needs the adaptive layer, which is still in progress. No single rule, including the secret-pattern checks, is a guarantee against an attacker who knows exactly what the rule looks for. Treat it as one strong layer in a stack, not the whole stack.

It's alpha software with a real test suite behind it (2,000+ tests in CI as of v0.18.5), so if you hit a rough edge, submit an issue and I promise I'll get to it within a week. I'd genuinely like to know what breaks it.

GitHub: https://github.com/DobermanCore/Doberman-Core
Docs: https://docs.trydoberman.dev