Adaptive authorization for AI coding agents

Your agent can rm -rf ~ your machine.
Doberman won't let it.

Doberman sits between your AI coding agent and its tools as a transparent Model Context Protocol (MCP) proxy, turning every action into PASS / AUTH / BLOCK before it runs.

$ pip install doberman-core
View on GitHub ↗

Apache-2.0 Local-first Fail closed Alpha, not airtight

On the execution path

AI Agent
DobermanMCP proxy
filesystem shell web / http
PASS
routine work, zero friction
AUTH
held until you approve
BLOCK
never reaches the tool

Nothing reaches a tool without a verdict.

Prompt injection, tool poisoning, and data exfiltration all end in a tool call. Doberman is the code that call has to pass through.

Invariant

Fail closed

Any error, uncertainty, or unhandled case denies the action. Every path to a tool runs through the decision engine.

Invariant

Raise-only learning

Guardrails and adaptive learning can auto-tighten, never silently loosen. Every weakening requires explicit, 2FA-gated, audited human approval.

Three verdicts. One execution gate.

BLOCK dangerous actions stopped before the tool AUTH sensitive actions held for approval PASS routine work goes straight through
destructive command
# Agent cleans up build artefacts and misjudges the target…
agent → run_terminal_cmd "rm -rf ~"
BLOCK destructive_command
"Recursive force-delete of a home/root target."
# The command never reaches the shell.
step-up authentication
# Agent refactors authentication code…
agent → write_file "backend/auth/session.ts"
AUTH sensitive_path
"Target is a sensitive path; authentication required before proceeding."
Doberman — Action ReviewMEDIUM
write_file  backend/auth/session.ts DenyApprove
transparent proxy
# Agent is doing normal feature work…
agent → write_file "src/components/Button.tsx"
PASS
The write goes straight through to the real tool server.
# Same gate as the two above.

One dial, four postures.

Hard blocks are identical in every mode: secret exfiltration, destructive commands, role-boundary violations. The dial only moves where step-up authentication begins.

Doberman strength modes and what changes between them
ModeBest forBulk-delete thresholdAnomaly step-upLethal-trifecta exfil
Light Exploratory / trusted environments100 filesNoAUTH
Balanceddefault Everyday coding agents25 filesYesAUTH
Strict Production repos, shared codebases10 filesYesBLOCK
Paranoid Highly autonomous / security-critical agents3 filesYesBLOCK

Set it with doberman policy set-mode <mode> or in .doberman/policies.yaml. The lethal trifecta (sensitive data and untrusted-content provenance and an external destination) steps up in Light/Balanced, and hard-BLOCKs in Strict/Paranoid.

A small, open, auditable decision path.

Doberman normalizes every tool call into a SecurityObject and routes it through six layers. The safety-critical core stays small enough to read.

  1. 01

    Tool mediation doberman.proxy

    The chokepoint. Doberman intercepts and normalizes every tool call an agent makes.

  2. 02

    Decision engine doberman.engine

    Combines guardrail verdicts into a final allow / authenticate / block. The execution rule and the raise-only combine are the safety invariants.

  3. 03

    Objective guardrail + built-in rules

    Deterministic rules: path confinement, destructive-command detection, external-destination & secret-exfil checks, smuggled-token channels.

  4. 04

    Subjective guardrail & baseline

    Per-entity behavioral baselines raise risk on the unusual: unfamiliar destinations, odd volumes, lookalike characters. It adds signal; it is never the only gate.

  5. 05

    Tiered auth doberman.auth

    Local confirmation → TOTP 2FA → narrow, time-limited role elevation. Approvals are single-use and action-bound.

  6. 06

    Audit + drift defense doberman.storage

    A local, redacted decision log. Policy changes are classified strengthen-vs-weaken; weakening is 2FA-gated and append-only logged. Nothing auto-loosens.

Extensible by design. Core declares stable interfaces and discovers implementations through Python entry points. A plugin registers its own rules, detectors, auth providers, or audit sinks without core importing it by name.

RuleDetectorAuthProviderAuditSink

Protected in one command.

Gate every tool call your Claude Code agent makes (built-ins and MCP tools) with no MCP reconfig. Or wrap a single tool server as a transparent proxy.

The fast path: Claude Code hooks
# 1. install
$ pip install doberman-core

# 2. interactive wizard: pick a mode,
#    tune guardrails, wire the hooks
$ doberman setup

# …or accept sensible defaults, non-interactively
$ doberman setup --yes

# Doberman now gates every Bash / Edit / Write / Web /
# MCP call, and scans tool *output* for leaked secrets.
# An agent can't even disable the hooks: editing
# .claude/settings.json is a blocked control-plane path.
A

Or wrap any MCP tool server

Doberman is a transparent stdio proxy. Put your server command after --:

doberman serve -- npx -y @modelcontextprotocol/server-filesystem ~/proj

B

Point your agent at it

Replace the agent's MCP entry with the Doberman-wrapped version. claude mcp add doberman -- doberman serve -- …. Cursor, Codex, and any MCP client use the same config shape.

C

Scan & benchmark

doberman scan turns local MCP capabilities into a risk map. The suite-agnostic harness scores Doberman as a filter and reports ASR (attack bypass) and FPR (benign friction).

Build it with us.

Doberman is early, open, and short on hands. Every PR gets a real review.

Discord
Ask questions, argue about threat models, or say hello. discord.gg/Sfy5XGNqty ↗
Good first issues
Labelled level-1 to level-4 by difficulty, each scoped to one file. Browse the open ones ↗
Write a rule
The four interfaces above are the contribution surface. A new detector is a new package, not a core patch. Contributing guide ↗

Give your agent a leash it can't slip.

The core is standalone: no proprietary dependency, ever, CI-enforced. Basic protection works the moment you install it.

$ pip install doberman-core
Star on GitHub ↗ Join the Discord ↗