DobermanAdaptive authorization for AI coding agents
Your agent can rm -rf ~ your machine.
Doberman won't let it.
Doberman sits between your AI coding agent and its tools as a transparent Model Context Protocol (MCP) proxy, turning every action into PASS / AUTH / BLOCK before it runs.
Apache-2.0 Local-first Fail closed Alpha
On the execution path
Nothing reaches a tool without a verdict.
Prompt injection, tool poisoning, and data exfiltration all end in a tool call. Doberman is the code that call has to pass through.
Fail closed
Any error, uncertainty, or unhandled case denies the action. Every path to a tool runs through the decision engine.
Raise-only learning
Guardrails and adaptive learning can auto-tighten, never silently loosen. Every weakening requires explicit, 2FA-gated, audited human approval.
Three verdicts. One execution gate.
One dial, four postures.
Hard blocks are identical in every mode: secret exfiltration, destructive commands, role-boundary violations. The dial moves only where step-up authentication begins.
| Mode | Best for | Bulk-delete threshold | Anomaly step-up | Lethal-trifecta exfil |
|---|---|---|---|---|
| Light | Exploratory / trusted environments | 100 files | No | AUTH |
| Balanceddefault | Everyday coding agents | 25 files | Yes | AUTH |
| Strict | Production repos, shared codebases | 10 files | Yes | BLOCK |
| Paranoid | Highly autonomous / security-critical agents | 3 files | Yes | BLOCK |
Set it with doberman mode <mode> (lowering it is possession-factor-gated). The lethal trifecta is sensitive data, untrusted-content provenance, and an external destination in the same action.
A small, open, auditable decision path.
Doberman normalizes every tool call into a SecurityObject and routes it through six
layers. The safety-critical core stays small enough to read.
- 01
Tool mediation
doberman.proxyThe chokepoint. Doberman intercepts and normalizes every tool call an agent makes.
- 02
Decision engine
doberman.engineCombines guardrail verdicts into a final allow / authenticate / block. The execution rule and the raise-only
combineare the safety invariants. - 03
Objective guardrail + built-in rules
Deterministic rules: path confinement, destructive-command detection, external-destination & secret-exfil checks, smuggled-token channels.
- 04
Subjective guardrail & baseline
Per-entity behavioral baselines raise risk on the unusual: unfamiliar destinations, odd volumes, lookalike characters. The baseline adds signal; it is never the only gate.
- 05
Tiered auth
doberman.authLocal confirmation → TOTP 2FA → narrow, time-limited role elevation. Approvals are single-use and action-bound.
- 06
Audit + drift defense
doberman.storageA local, redacted decision log. Policy changes are classified strengthen-vs-weaken; weakening is 2FA-gated and append-only logged. Nothing auto-loosens.
Extensible by design. Core declares stable interfaces and discovers implementations through Python entry points. A plugin registers its own rules, detectors, auth providers, or audit sinks without core importing it by name.
Protected in one command.
Gate every tool call your Claude Code agent makes (built-ins and MCP tools) with no MCP reconfig. Or wrap a single tool server as a transparent proxy.
# 1. install $ pip install doberman-core # just browsing? watch the real engine block a # scripted attack reel. no agent, no wiring $ doberman demo # 2. interactive wizard: pick a mode, # tune guardrails, wire the hooks $ doberman setup # …or accept sensible defaults, non-interactively $ doberman setup --yes # Doberman now gates every Bash / Edit / Write / Web / # MCP call, and scans tool *output* for leaked secrets. # An agent can't even disable the hooks: editing # .claude/settings.json is a blocked control-plane path.
Or wrap any MCP tool server
Doberman is a transparent stdio proxy. Put your server command after --:
doberman serve -- npx -y @modelcontextprotocol/server-filesystem ~/proj
Point your agent at it
Replace the agent's MCP entry with the Doberman-wrapped version. claude mcp add doberman -- doberman serve -- …. Cursor, Codex, and any MCP client use the same config shape.
Scan & benchmark
doberman scan turns local MCP capabilities into a risk map. The suite-agnostic harness scores Doberman as a filter and reports ASR (attack bypass) and FPR (benign friction).
Build it with us.
Doberman is early, open, and short on hands. Every PR gets a real review.
- Discord
- Ask questions, argue about threat models, or say hello. discord.gg/Sfy5XGNqty ↗
- Good first issues
- Labeled
level-1tolevel-4by difficulty, each scoped to one file. Browse the open ones ↗ - Write a rule
- The four interfaces above are the contribution surface. A new detector is a new package, not a core patch. Contributing guide ↗
Questions, answered straight.
How does Doberman stop an AI coding agent from running dangerous commands?
Doberman sits between the agent and its tools and reads every tool call before it executes. A local policy engine returns one of three verdicts: PASS runs immediately, AUTH holds the call for human approval, and BLOCK returns an error to the agent so the call never runs. Destructive commands, secrets leaving in arguments, and writes outside the repo are caught on the execution path, not in the prompt.
Which AI agents does it work with?
Claude Code and Codex get native hooks (doberman install-hooks). Anything
that speaks MCP — Cursor, OpenClaw, custom agents — points at Doberman as a transparent stdio proxy in
front of its tool server. One policy applies across all of them.
How is this different from the agent's built-in permission prompts?
Built-in prompts show a command and ask every time, and roughly 93% of them get approved on autopilot. Doberman reads the call itself — a secret in an argument, where the bytes are going, whether a path escapes the repo — passes routine work silently, and interrupts only when something deserves a human. A block never executes, even with the agent's own permissions in auto mode.
Is my code or data sent to the cloud?
No. Doberman runs entirely on your machine: the policy engine, decisions, and the audit log are local. The log stores path classes, reason codes, and HMAC fingerprints, never raw arguments or secrets.
What happens when Doberman hits an error or something it doesn't recognize?
It fails closed: unknown situations and internal errors deny by default, and every AUTH or BLOCK carries a reason code plus a one-line explanation. It's defense in depth, not a silver bullet — the honest limits are in the docs.
Give your agent a leash it can't slip.
The core is standalone: no proprietary dependency, ever, CI-enforced. Basic protection works the moment you install it.