Doberman is a runtime guardrail for AI coding agents that sits on the tool-execution path, between the agent and its files, shell, MCP servers, and APIs. It aims to stop destructive commands, secret leaks, and prompt-injected data exfiltration before the call runs, rather than inspecting prompts and advising after the model has decided.
It connects through an MCP proxy or a host hook, normalizes each tool call, and runs it through a risk engine that returns exactly one verdict: PASS lets routine work through, AUTH pauses a sensitive action for human approval, and BLOCK stops a dangerous one so it never runs. It supports Claude Code through hooks, Codex CLI through a native hook (experimental), OpenClaw through a plugin adapter, Cursor through native hooks (experimental), and Claude Desktop or any other MCP client through the proxy.
Two properties define its behavior. It fails closed: errors, uncertainty, and unanswered approval prompts resolve to a denial. It is raise-only: guardrails and adaptive learning can tighten automatically, but any permanent loosening needs audited human approval behind a possession factor (a TOTP code or the local Doberman password).
An optional turn gate checks the user's turn, including attached or fetched content, against known prompt-injection signatures before the model starts inferring, while the action gate stays the main guarantee. A benchmark harness reports the attack bypass rate and the benign over-block rate against a labeled corpus and suites such as AgentDojo, RedCode-Exec, MSB, and LLMail-Inject. The project is in alpha.
Features
- Three verdicts: every tool call gets PASS, AUTH (paused for approval), or BLOCK before it runs
- Fail closed: errors, uncertainty, and approval timeouts resolve to a denial, logged distinctly as a timeout
- Raise-only policy: automatic tightening, with every loosening gated behind TOTP or a local password and recorded in an append-only ledger
- Host coverage: hooks for Claude Code, Codex, and Cursor, an OpenClaw adapter, and an MCP proxy for any MCP client
- Turn gate: screens the user's turn for known prompt-injection signatures before inference
- Taint tracking: a ledger of values from untrusted sources and read-versus-send fingerprints across calls
- Policy as code: a repo-committed policy file of blocked and sensitive globs, reviewed in pull requests
- Strictness modes: Light, Balanced, Strict, and Paranoid modes plus an enforce, monitor, or off dial
- Live dashboard: a feed of blocked actions and a pending-approvals queue, plus a terminal UI
- Guardrail plugins: third-party rules and audit sinks register through Python entry points and load only when enabled
- Benchmarks: attack bypass and benign over-block rates measured against labeled suites, with CI gating on regressions
