How it Works
Doberman operates as a runtime defense mechanism for AI coding agents by intercepting and evaluating every tool call before execution. Unlike traditional guardrails that analyze prompts after the model has made a decision, Doberman sits on the execution path, ensuring that no action—whether input, output, or tool call—proceeds without explicit authorization. This is achieved through a transparent proxy or host hook mechanism, which adheres to the Model Context Protocol (MCP), the standard interface between an agent and its tools. Every action is subjected to a verdict system that categorizes it into one of three outcomes: PASS, AUTH, or BLOCK.
The PASS verdict allows routine operations to proceed without interruption, ensuring zero friction for safe and expected actions. AUTH pauses sensitive operations, requiring human approval before execution. This approval can be granted through a one-click confirmation if the same action is repeated within five minutes, though destructive actions are never eligible for this shortcut. The BLOCK verdict stops dangerous actions entirely, preventing them from executing at all. This system guarantees that no blocked action ever reaches the tools, even if it bypasses other guardrails.
Doberman enforces two critical guarantees: fail-closed and raise-only learning. Fail-closed means that any uncertainty, error, or unhandled case results in a denial of the action. This includes scenarios where approval prompts time out or hang, ensuring that silence or inactivity does not inadvertently permit unsafe actions. Raise-only learning ensures that guardrails can only tighten over time; any policy weakening requires explicit, audited human approval and is gated behind a possession factor, such as a time-based one-time password (TOTP) or a local Doberman password.
The system integrates with multiple AI agents, including Claude Code, Codex, OpenClaw, and any MCP-compatible agent. For agents like Cursor, Doberman uses native hooks or an experimental MCP proxy. The installation process involves running a single command, such as doberman setup, which configures the guardrails, selects a strictness mode, and connects the agent to Doberman’s decision engine. The setup also includes optional features like two-factor authentication (2FA) and phone approvals, which push approval challenges to a user’s device for remote confirmation.
Doberman’s architecture includes a parity matrix that maps protections to each supported host, with every checkmark linked to a CI test proving its effectiveness. The decision engine operates independently of the agent’s internal guardrails, providing an additional layer of security that cannot be bypassed through prompt manipulation or other evasion techniques.
The tool also supports policy-as-code through a doberman.policy.yaml file, which can be committed to a repository and reviewed alongside the code it governs. This file defines blocked or sensitive file patterns, allowing teams to maintain and audit policies through version control. Additionally, Doberman includes a turn gate, an optional pre-model check that scans incoming prompts for known attack patterns before they consume inference tokens. This early-layer defense further reduces the risk of malicious or unintended actions.
This log can be pruned by age or row budget without affecting pending approvals, ensuring that storage and performance remain manageable. The system also includes health checks and recovery tools, such as doberman doctor, which verifies the integrity of installed hooks and flags any discrepancies. Uninstallation removes all hooks, state, and enrolled factors, ensuring a clean removal process.
Use Cases
Doberman is designed to address critical security risks associated with AI coding agents, particularly those that interact with sensitive systems or tools. One primary use case is preventing destructive actions, such as accidental or malicious execution of commands like rm -rf, which could permanently delete files or directories. By intercepting these calls before execution, Doberman ensures that such actions are blocked unless explicitly approved by a human operator.
Another key use case is protecting against data leaks, including the exposure of API keys, secrets, or other sensitive information. AI agents may inadvertently or maliciously leak such data through tool calls or outputs. Doberman’s runtime guardrails monitor these interactions, flagging and blocking any attempts to exfiltrate sensitive data.
By evaluating tool calls on the execution path, Doberman ensures that even if an agent is tricked into generating malicious instructions, those instructions cannot be executed without explicit authorization.
For teams collaborating on codebases, Doberman provides a policy-as-code framework that integrates with version control systems. The doberman.policy.yaml file allows teams to define and enforce security policies alongside their code, ensuring consistency and accountability.
Doberman’s adaptability extends to custom guardrails and audit sinks, enabling organizations to extend its functionality to meet specific security requirements. Developers can register their own rules or integrate Doberman with external audit pipelines, such as webhooks, to further enhance monitoring and compliance.
The tool’s support for phone approvals and two-factor authentication adds an additional layer of security for remote or distributed teams. By pushing approval challenges to a user’s device, Doberman ensures that sensitive actions can be authorized from anywhere, reducing the risk of unauthorized access or approvals granted under duress.
Key Features & Capabilities
Doberman’s core functionality revolves around its verdict system, which categorizes every tool call into PASS, AUTH, or BLOCK. PASS allows routine operations to proceed without intervention, ensuring minimal disruption to workflows. AUTH pauses sensitive operations, requiring human approval before execution. This approval process includes a one-click confirmation for repeated actions within a five-minute window, though destructive actions are never eligible for this shortcut. BLOCK stops dangerous actions entirely, preventing them from executing regardless of other guardrails.
The fail-closed guarantee ensures that any uncertainty, error, or unhandled case results in a denial of the action. The raise-only learning mechanism ensures that guardrails can only tighten over time, with any policy weakening requiring explicit, audited human approval. This approval is gated behind a possession factor, such as a TOTP or a local Doberman password, adding an additional layer of security.
Doberman integrates with a variety of AI agents, including Claude Code, Codex, OpenClaw, and any MCP-compatible agent. For agents like Cursor, Doberman uses native hooks or an experimental MCP proxy. The installation process is streamlined, with commands like doberman setup configuring guardrails, selecting strictness modes, and connecting the agent to Doberman’s decision engine. Optional features such as two-factor authentication and phone approvals further enhance security by requiring multi-factor confirmation for sensitive actions.
The tool supports policy-as-code through a doberman.policy.yaml file, which can be committed to a repository and reviewed alongside the code it governs. This file defines blocked or sensitive file patterns, allowing teams to maintain and audit policies through version control. Doberman also includes a turn gate, an optional pre-model check that scans incoming prompts for known attack patterns before they consume inference tokens. This early-layer defense reduces the risk of malicious or unintended actions reaching the model.
This log can be pruned by age or row budget without affecting pending approvals, ensuring that storage and performance remain manageable. The system includes health checks and recovery tools, such as doberman doctor, which verifies the integrity of installed hooks and flags any discrepancies. Uninstallation removes all hooks, state, and enrolled factors, ensuring a clean removal process.
For example, version 0.18.7 added phone approvals, allowing users to receive and respond to approval challenges on their mobile devices. This release also closed detection bypasses for destructive commands hidden behind wrappers like builtin, eval, or strace, ensuring that such commands are classified and blocked appropriately. Additionally, it prevented hooks from failing open when approvals timed out, further strengthening the fail-closed guarantee.
Version 0.18.6 addressed several detection bypasses, including issues with renamed tools, shell wrappers, and reverse shells. Cursor received an experimental native-hooks adapter with session heartbeat and doctor checks, expanding Doberman’s compatibility with additional agents.
Version 0.18.5 introduced features such as doberman decision-log-prune, which allows operators to delete resolved decision rows by age or row budget without affecting pending approvals. The doberman update command checks PyPI for updates and provides the upgrade command, while the status command nudges users when they are behind on updates. The dashboard was enhanced to allow copying pending approval details as JSON and to display the real Doberman mark, improving auditability and transparency. The doberman doctor command now reports on password factors and optional UI extras, providing users with a comprehensive health check of their installation.
Doberman’s benchmarking capabilities include a suite-agnostic harness that scores the tool as a filter over labeled actions, reporting attack bypass rates and benign over-block rates. This harness runs the real decision engine over each labeled tool call, ensuring deterministic and reproducible results. The system is regression-tested to maintain its effectiveness across different environments and use cases, with CI gates ensuring that any degradation in detection quality is promptly addressed.
The tool’s cross-call protections, such as the taint ledger and read-vs-send fingerprints, are keyed off repo-local identity rather than protocol sessions, ensuring statelessness and consistency. This design choice prevents drift between different environments and ensures that protections remain effective even as the system evolves. Doberman’s integration with external detection suites, such as RedCode-Exec, MSB, and LLMail-Inject, further enhances its ability to identify and block a wide range of attack vectors, making it a robust solution for securing AI coding agents.