Destructive Command Guard (dcg)
A high-performance hook for AI coding agents that blocks destructive commands before they execute, protecting your work from accidental deletion.
- Source repo
- Dicklesworthstone/destructive_command_guard
- Stars
- ★ 6.2k
- Last updated
- today
- License
- NOASSERTION
- Primary language
- Rust
- FA score
- 61/100 · Some gaps
At a glance
- How it runs
- Works with
- Portable with changesCodex · Claude CodeChatGPT (Partial support)
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A developer using Claude Code who wants to prevent accidental git reset --hard or rm -rf from losing uncommitted work.
- Not a fit if
- Environments where installing agent hooks is not possible
- Users of limited integrations like Aider (git hooks only)
- Teams expecting zero false positives without allowlist tuning
- Source review
- 61/100 · Some gaps
What does this agent do, and when should you use it?
dcg (Destructive Command Guard) is a high-performance hook that intercepts destructive commands before they execute, blocking them with clear explanations and safer alternatives. It supports multiple AI coding agents, including Claude Code, Codex CLI, Gemini CLI, Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok (xAI), Posit Assistant, and related tools. Written in Rust, it features a modular pack system with 50+ security packs covering databases, Kubernetes, cloud providers, and more. It operates with sub-millisecond latency, uses SIMD-accelerated filtering, and includes heredoc/inline-script scanning, smart context detection, and rich terminal output. Installation is straightforward via scripts or Homebrew, and it automatically configures supported agent hooks.
dcg acts as a pre-execution hook for AI agents. It reads the command from the agent's hook input, parses it, and evaluates it against layered rules: trigger detection, content extraction, and AST-based pattern matching. If a destructive pattern is matched, it blocks the command and outputs a human-readable denial panel on stderr, with machine-readable JSON on stdout for agent compatibility. It supports environment variables, config files, agent-specific profiles, allowlists, and bypass mechanisms. It also provides scan mode for CI, explain mode, and commands like dcg allowlist, dcg packs, and dcg simulate.
- A developer using Claude Code who wants to prevent accidental git reset --hard or rm -rf from losing uncommitted work.
- A DevOps engineer who needs to enforce a security policy across team members' AI coding agents.
- A security auditor who wants to scan codebases for dangerous commands in CI pipelines.
- A Windows workstation user who needs native PowerShell and cmd protection against destructive operations.
- An organization that wants to create custom security packs for internal tools and proprietary systems.
- A Codex CLI user who needs first-class hook support to ensure blocked commands are correctly reported.
How do you install or deploy this agent?
For Linux/macOS/WSL, use the one-liner installer: curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash -s -- --easy-mode. For native Windows (PowerShell): & ([scriptblock]::Create((irm "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.ps1"))) -EasyMode -Verify. Alternative via Homebrew (macOS/Linux): brew install dicklesworthstone/tap/dcg && dcg install.
How do you use this agent?
After installation, dcg automatically configures hooks for supported agents. For example, when an agent attempts git reset --hard HEAD~5, dcg intercepts and blocks it. To enable more protection, edit ~/.config/dcg/config.toml and add packs like database.postgresql. To allow a command permanently, use dcg allowlist add core.git:reset-hard. To bypass for a single command, set DCG_BYPASS=1. Use dcg explain "<command>" to understand why it's blocked.
What are this agent's strengths and limitations?
- Sub-millisecond latency with SIMD-accelerated filtering.
- Extensive default protection for core filesystem and git operations, plus 50+ configurable security packs.
- Broad agent support including native Codex CLI integration, VS Code, Cursor, and more.
- Smart context detection distinguishes data from execution, reducing false positives.
- Requires installation and hook configuration, which may be complex for new users.
- Potential for false positives requiring allowlist adjustments.
- Dependent on specific agent hook mechanisms; some agents (e.g., Aider) have limited integration.
- Cannot prevent an AI model from writing scripts to bypass hooks; should be used as a guardrail, not a complete enforcement boundary.
How does this agent compare with similar options?
The main alternative is the original Python script by Jeffrey Emanuel, which dcg improves upon with a Rust rewrite, offering better performance and more features. Another comparison is standard git hooks, but dcg provides broader coverage and agent-specific integration.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Destructive Command Guard (dcg) This agent | 61 · Some gaps | CLIFree | ★ 6.2k | today | Rust | Codex · Claude Code |
| mirrord: Run Local Processes Inside Your Kubernetes Cluster | 55 · Major gaps | CLIFree | ★ 5.4k | today | Rust | Codex · Claude Code |
| SkillSpec | 74 · Some gaps | CLIFree | ★ 707 | 2mo ago | Rust | Codex · Claude Code |
| DeepTide - AI Coding Agent by DeepSeek | 44 · Major gaps | CLIFree + model costs | ★ 1.1k | 1mo ago | Rust | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: minimal protection by default (core git/filesystem/disk), other packs opt-in; user confirmation mechanisms (allow-once, allowlist, DCG_BYPASS); data flow transparency (stdout/stderr separation, JSON output); sensitive data handling limited (history stored locally in SQLite, but no explicit encryption); dependency security not fully verified (dependency versions not pinned, self-update feature); external effects clear (blocks commands, but provides bypass); rollback limited (no automatic rollback, only suggests stash); source attribution clear (authors and contributors listed). Deductions: dependency security not fully verified, sensitive data handling lacks explicit encryption, rollback limited.
Evidence shows: self-consistency good (README and test scripts align, robot mode output stable); dependency availability not fully verified (dependency versions not pinned, self-update may introduce risk); failure messages clear (provides reasons and suggestions). Deductions: dependency availability not fully verified.
Evidence shows: audience clear (AI coding agent users), scenarios broad (multiple agents and platforms); capability boundaries clear (core packs default, others optional); trigger precision high (context-aware, distinguishes data vs execution); environment fit good (Linux/macOS/Windows/WSL). Deductions: none significant.
Evidence shows: information architecture clear (README, docs directory); install notes detailed (curl, PowerShell); naming stable (dcg); examples and FAQ present (README examples); known limitations not explicitly listed; license custom MIT (with OpenAI/Anthropic restriction), may affect usage; versioning and changelog not explicit; maintenance responsibility clear (authors and contributors). Deductions: known limitations not explicit, license non-standard, versioning and changelog missing.
Evidence shows: output usability high (JSON and human-readable); marginal value high (solves real problem); cost-benefit reasonable (performance optimized, low latency). Deductions: none significant.
Evidence shows: claims traceable (README and test scripts correspond); cross-source corroboration limited (only in-repo evidence); fact/inference separation good (README distinguishes features from suggestions). Deductions: cross-source corroboration limited.
- License includes restrictions on OpenAI and Anthropic, which may affect some users.
- Dependency versions are not pinned, and self-update may introduce supply chain risks.
- History storage is not explicitly encrypted and may contain sensitive commands.
- DCG_BYPASS environment variable can completely disable protection; use with caution.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
This release closes commands that ran unguarded (Claude Code's Monitor tool, wrapper and remote-shell redirects, GNU tar helper programs, archive extraction into credential or .git paths) and a long list of false positives reported against 0.15.2. Claude Code users: refresh the hook after upgrading. The hook matcher is now Bash|PowerShell|Monitor. Run dcg install (or dcg doctor --fix); hook self-healing does the same on its next run. Existing Bash or Bash|PowerShell dcg entries are migrated in place, and unrelated hooks keep their matchers. …View on GitHub ↗ -
Release notes excerpt
Security fix release. v0.15.1 can fail open under load. Please upgrade. On a busy machine the v0.15.1 hook could exit without printing a verdict for some destructive commands. Every agent reads a hook that exits silently as "allow", so those commands ran. With about sixteen hook processes running at once, 3-9% of requests for commands such as watch 'git reset' --hard (commands that only dcg's embedded-script reader can judge) were let through this way. Run one at a time, the same commands were always denied. In v0.15.2 a check that runs out of time is retried with the time the hook has …View on GitHub ↗ -
Release notes excerpt
Two fixes. One made the Oh My Pi bridge let a command through unjudged; the other made the installers skip signature checking with some distro builds of cosign. Oh My Pi users: refresh the bridge after upgrading. The #504 fix is in the generated dcg-guard.ts file, not only in the dcg binary, so an existing bridge keeps the old behaviour until it is rewritten. - dcg update rewrites your user/profile bridge for you when omp is on your PATH (it runs the new installer, which runs dcg install --omp --force). It does not if you pass --no-configure. …View on GitHub ↗