dcg: A Seatbelt for Agents With Shell Access
Every agent horror story ends one of the same three ways: a git reset --hard, an rm -rf, or a DROP TABLE the model executed with total confidence. dcg — the Destructive Command Guard — is the seatbelt. It hooks into Claude Code, Codex CLI, Copilot CLI, Cursor and Gemini CLI, inspects every shell command the agent is about to run, and blocks the destructive ones milliseconds before they execute. It topped GitHub trending today at +444 stars in a day, now around 2,800 total.
The engineering is the interesting part. It is a Rust binary that answers in under a millisecond, because it sits in the hot path of every single command your agent runs. The architecture is whitelist-first: explicitly safe patterns get cleared before any destructive matching happens, which keeps false positives from wrecking the workflow. Protection comes in 50+ modular packs — core rules like git reset and rm -rf are always on, and you opt into packs for Postgres drops, Kubernetes deletes, Docker prunes, Terraform destroy, even AWS and GCP instance terminations. The detail that shows real-world scar tissue: it scans heredocs and python -c / bash -c one-liners, which is exactly where agents smuggle dangerous commands past naive filters. And it fails open — if the guard ever times out, your work continues.
The industry answer to agent safety is sandboxes and VMs. That answer is correct and almost nobody uses it. The reality is millions of people running agents raw on their laptops with full shell access, and for them the practical answer is a guard at the last moment before execution. One curl install auto-configures every supported agent on your machine. MIT licensed.
https://github.com/Dicklesworthstone/destructive_command_guard
← Back to all articles
The engineering is the interesting part. It is a Rust binary that answers in under a millisecond, because it sits in the hot path of every single command your agent runs. The architecture is whitelist-first: explicitly safe patterns get cleared before any destructive matching happens, which keeps false positives from wrecking the workflow. Protection comes in 50+ modular packs — core rules like git reset and rm -rf are always on, and you opt into packs for Postgres drops, Kubernetes deletes, Docker prunes, Terraform destroy, even AWS and GCP instance terminations. The detail that shows real-world scar tissue: it scans heredocs and python -c / bash -c one-liners, which is exactly where agents smuggle dangerous commands past naive filters. And it fails open — if the guard ever times out, your work continues.
The industry answer to agent safety is sandboxes and VMs. That answer is correct and almost nobody uses it. The reality is millions of people running agents raw on their laptops with full shell access, and for them the practical answer is a guard at the last moment before execution. One curl install auto-configures every supported agent on your machine. MIT licensed.
https://github.com/Dicklesworthstone/destructive_command_guard
Comments