Doberman CLI
A guard on an AI agent's execution path: every tool call gets a PASS, AUTH or BLOCK verdict before it runs
- 243 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Writes hooks into Claude Code, Codex and Cursor settings and wraps MCP servers, seeing the full text of each tool call
- Stores a password, a second factor and the decision log on the device, and anonymous statistics are on by default
- A wrong strictness setting weakens the protection, and an unanswered approval prompt blocks the agent
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/dobermanDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Writes hooks into Claude Code, Codex and Cursor settings and wraps MCP servers, seeing the full text of each tool call
- Stores a password, a second factor and the decision log on the device, and anonymous statistics are on by default
- A wrong strictness setting weakens the protection, and an unanswered approval prompt blocks the agent
This is third-party code. Review the repository files before installing.
What it does
Doberman sits between the agent and its tools as a transparent MCP proxy or a host hook and decides on every action before it runs. `PASS` lets routine work through with no friction. `AUTH` pauses a sensitive action until you approve: repeat the same action within five minutes and it offers a one-click confirm (destructive actions never repeat this way). `BLOCK` stops a dangerous action and it never runs. Install with `pip install doberman-core`. For Claude Code the recommended route is hooks: `doberman setup` asks which agents to guard, picks a strictness mode, tunes guardrails and wires them. Codex CLI is guarded through a native PreToolUse hook (experimental), Claude Desktop, Cursor and any MCP client connect through `doberman serve -- <your server>`, and OpenClaw has a plugin. `doberman doctor` and `doberman demo` help verify it; the demo runs five attacks: secret exfiltration, `rm -rf`, a force push to a protected branch, a token leak and a `.env` read. Two properties are built in. Doberman fails closed: on an error or uncertainty the action is denied, and if nobody answers an approval prompt a timeout resolves it to denial. Learning is raise-only: a policy can be weakened permanently only with audited human approval through TOTP or the local password. Policy can live in the repository as `doberman.policy.yaml`. The `doberman dash` panel shows a live feed of decisions and a queue of pending approvals.
Who it is for. Developers and teams who run Claude Code, Codex or Cursor with broad permissions and want `rm -rf`, key leaks and hidden instructions stopped before they run.
Good fit when
- The agent runs without confirmations and you need destructive commands like `rm -rf` stopped in the repository
- You worry that a page or file with a hidden instruction will make the agent send your keys out
- A force push to a protected branch and reading `.env` should need your decision
- You want protection rules stored in the repository and reviewed like code through `doberman.policy.yaml`
- The agent runs unattended and approval requests should be answered from a panel or with a two-factor code
Not a fit when
- You need an OS-level network firewall: Doberman sits on the agent's tool-call path and does not intercept all machine traffic
- You want static checking of MCP servers before connecting: scanners like mcp-scanner fit that
- You use an agent with neither hooks nor MCP: there is nowhere to attach the guard
- The project is alpha and critical infrastructure needs a product with a stable API
Example request
Install Doberman for Claude Code in this project, run doberman demo and show which five attacks it stoppedLimitations
- The project is alpha. Hooks for Codex CLI and Cursor are marked experimental.
- Python 3.11 or newer is required. The guard acts only on calls that go through the proxy or the host hook.
- Anonymous usage statistics are on by default: command names and daily totals without paths, prompts or secrets. Turn them off with `doberman telemetry off` or the `DO_NOT_TRACK=1` variable.
- If you remove the package first, the hooks remain pointing at a missing binary. Run `doberman uninstall --global` first.
- With no answer to an approval prompt the action is denied on timeout, so an unattended agent may get stuck on denials.
How to disable. Run `doberman uninstall --global`: it removes the Claude Code and Codex hooks, project and device state and enrolled factors, and then the package itself through pip or pipx. If you removed the package first, reinstall `doberman-core` and run the global uninstall. `doberman doctor` flags hooks that point at a missing binary.
FAQ
How do I connect Doberman to Claude Code?
Run `pip install doberman-core`, then `doberman setup`. The wizard asks which agents to guard, picks a strictness mode and writes the hooks. Afterwards check `doberman doctor` and watch `doberman demo`.
What do PASS, AUTH and BLOCK mean?
`PASS` lets a routine action through, `AUTH` pauses a sensitive one until you approve and `BLOCK` stops a dangerous one so that it never runs. The decision is made before the tool starts.
What happens if I do not answer an approval prompt?
The action is denied. The desktop dialog has a 2-minute limit and the whole approval flow a 10-minute ceiling, and the log records it as `timeout`, not as a human denial.
How does Doberman connect to an MCP server?
Run `doberman serve -- <your server>`: the proxy wraps the tool server and checks every call. That is how Claude Desktop, Cursor and other MCP clients connect.
Can I turn off the statistics?
Yes. Run `doberman telemetry off` or set `DO_NOT_TRACK=1`. By the project description only command names and daily totals are collected, without paths, prompts or secrets.
Discussion
No questions or reviews yet.
Related
CLI toolsA plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A policy engine for AI agent actions: a Claude Code hook scores each call before it runs, then allows, blocks or waits for you
Runtime security for Claude Code, Codex and Cursor: tool call policies, observe and enforce modes and a local dashboard.
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Doberman (this card) | no | 243 | |
| HOL Guard | yes | 1,094 | also intercepts agent commands through hooks, while Doberman adds a proxy for MCP servers, a three-way verdict and policy in the repository |
| CC Safety Net | no | 2,014 | a hook only for Git and file system commands, while Doberman checks all tool and MCP calls |
| MCP Scanner | yes | 1,117 | static checking of MCP servers, while Doberman decides on each call while the agent runs |
README in short
The page starts with the threats to an agent and presents Doberman as a guard on the execution path. It then offers a verdict table, a diagram, the principles of fail-closed and raise-only learning, a table of how to plug in for different agents and a quick start. After that come verification, the turn gate, a comparison on an attack benchmark, guardrail plugins, policy as code and strictness tuning.