Doberman
Doberman is an open-source security gate for AI coding agents. It runs as a transparent Model Context Protocol (MCP) proxy between an agent and its tools, normalizing every tool call into a SecurityObject and returning one of three verdicts: PASS for routine actions, AUTH when human approval is required, and BLOCK for dangerous actions before they reach the underlying tool. The project is Apache-2.0 licensed, local-first, and currently in alpha. The decision engine combines deterministic guardrails, such as path confinement and destructive-command detection, with per-entity behavioral baselines that flag unusual destinations, volumes, or lookalike characters. Doberman includes four strength modes—Light, Balanced, Strict, and Paranoid—that adjust bulk-delete thresholds, anomaly step-up authentication, and handling of lethal-trifecta exfiltration attempts. Hard blocks remain identical across modes. Doberman is designed so the safety-critical core is auditable. It provides tiered authentication, a local redacted decision log, and append-only audit records. Policy changes are classified as strengthening or weakening, and any weakening requires explicit 2FA-gated human approval; the system never auto-loosens. Extensible interfaces allow custom guardrails to be added through Python entry points.
- Category
- Open Source
- Pricing
- Free
Problem solved
Doberman prevents AI coding agents from taking dangerous or unauthorized actions by gating every tool call with an adaptive authorization layer. It stops destructive commands, secret exfiltration, prompt injection, and tool poisoning before they execute, while allowing routine work to flow without friction.
Use cases
- Block destructive shell commands like rm -rf during agent runs
- Require human approval for writes to sensitive paths
- Prevent secret exfiltration in AI coding workflows
- Protect production repositories with strict or paranoid modes
- Audit and review all agent tool calls in a local decision log
- Integrate Doberman with OpenAI Codex, Claude Code, or MCP-compatible agents
- Create custom guardrails via Python entry points
Audience
- Developers
- ML Engineers
- Enterprise
- Startups
- Researchers
Pros
- Fail-closed design blocks on any error or uncertainty
- Runs local-first, keeping decision logs on your machine
- Multiple security modes from Light to Paranoid
- Extensible guardrail interfaces via Python entry points
- Approve-only weakening with 2FA and audit log
Cons
- Currently alpha; APIs and behavior may change
- Requires an MCP-compatible agent to function
- Step-up authentication can add friction in interactive workflows
- Subjective baseline may require tuning for unusual workloads
- No managed cloud version mentioned; users must self-host
Official website: https://www.trydoberman.dev/
Canonical LambdaBase page: https://www.lambdabase.com/tools/doberman