Doberman is a runtime authorization layer for AI coding agents. It sits between the agent and its tools as a Model Context Protocol (MCP) proxy or as a host hook, and gives every tool call one of three verdicts before it executes: PASS (routine work goes through), AUTH (a sensitive action pauses for human approval), or BLOCK (the action never runs).
Two properties define its behaviour. It fails closed: any error, uncertainty, or unanswered approval prompt resolves to a denial, with prompt deadlines of 2 minutes for the desktop dialog and 20 minutes as the overall backstop. It is raise-only: guardrails and adaptive learning can tighten automatically, but any permanent loosening requires an audited human approval gated by a possession factor (TOTP if enrolled, otherwise a local password) and is recorded in an append-only policy-change ledger.
It fronts Claude Code through hooks, Codex CLI through a PreToolUse hook, OpenClaw through a plugin adapter, and Claude Desktop, Cursor, or any other MCP client through the proxy. A parity matrix maps each protection to each host and regenerates from CI tests. The deterministic rule set covers path confinement, destructive-command detection, secret patterns, egress classification of shell, package, and git commands, environment-dump detection, role boundaries, and protection of Doberman's own state and the hosts' hook configuration. An adaptive layer with per-entity behavioural baselines and drift detection runs on the proxy path only.
An optional turn gate applies the same decision engine at a pre-inference hook, so a turn carrying a flagrant signature is refused before any tokens are spent. Third-party rules and audit sinks register through the doberman.rules and doberman.audit_sinks entry-point groups, and a benchmark harness scores the engine over labelled actions for attack-bypass and benign over-block rates, with CI gating on regressions.
Documented limitations include whole-script homoglyph confusables, bare hash-shaped secrets with no credential name, static rather than runtime egress classification, and egress verbs hidden behind flag-taking wrappers or nested shells, which step up to AUTH rather than a hard BLOCK.
Features
- Three-way verdicts: PASS, AUTH, or BLOCK for every tool call, decided before execution
- Fail-closed by default: errors, unhandled cases, and timed-out approval prompts all deny, logged distinctly as timeout or denied
- Raise-only tuning: strictness modes Light, Balanced, Strict, and Paranoid, an enforcement dial (enforce, monitor, off), and preference weights that tighten freely but loosen only with a possession factor
- Host integrations: Claude Code, Codex CLI, OpenClaw, Claude Desktop, Cursor, and any MCP-compatible agent via doberman serve --
- Deterministic rules: path confinement, destructive commands, credential shapes and high-entropy tokens, oversized base64 blobs, environment dumps, and control-plane self-protection
- Egress classification: reads destinations out of curl, wget, scp, rsync, nc, ssh, socat, and similar commands; a secret piped to an external host is a hard BLOCK
- Egress broker seam: an opt-in, stdlib-only HTTP CONNECT forward proxy enforces a default-deny allowlist at the socket and can raise verdicts from observed connection history
- Turn gate: pre-inference screening of prompts and attached or tool-fetched content
- Dashboard and TUI: a live verdict feed and a pending-approvals queue whose cards export redacted decision details as JSON
- Plugins and benchmarks: entry-point rule and audit-sink plugins, a decision-log pruning command, and a labelled-corpus benchmark harness
