Primary question: Does your AI coding setup already provide reliable command-blocking, or do you need a dedicated local guard that works across every major agent?
RepoDaily adoption score
RepoDaily rates this as 86/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 5 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 5 next-action step(s), and 2 command/install signal(s) were detected.
Trending momentum is +497 stars, with maintenance/release/issue signals counted when present.
Risk is marked high, with 7 security note(s) and 3 explicit skip condition(s).
2 opportunity lens item(s), 4 alternative(s), and 3 type-specific section(s) support differentiation.
License source or license wording is present.
8 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
Destructive Command Guard, or dcg, is a single Rust binary that registers itself as a hook for AI coding agents. When an agent like Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, or Grok prepares to run a shell or git command, dcg inspects the command first and returns a deny decision before the shell ever sees it. The project describes itself as blocking commands such as git reset --hard, rm -rf, and force refspec pushes before they execute, with the goal of preventing accidental data loss caused by agent-generated commands.
The hook covers 14 agent integrations as of the README. Five are native hook integrations, including Claude Code, Codex CLI 0.125.0 and above, Gemini CLI, Copilot CLI, and Cursor. Grok gets a native ~/.grok/hooks/dcg.json path via dcg install --grok, plus an automatic Claude compatibility layer. Antigravity CLI installs through dcg install --agy into ~/.gemini/config/hooks.json. Aider is limited to git hooks, and Continue provides detection only. OpenCode and Pi are supported through a community plugin and an extension recipe respectively.
dcg is written in Rust edition 2024, requires Rust 1.95 per Cargo.toml, and ships as the dcg binary from src/main.rs. The current release is v0.6.8, dated 2026-07-15. The binary uses AST-based pattern matching via ast-grep-core with tree-sitter grammars for Bash, Python, JavaScript, TypeScript, Ruby, Go, and PHP to catch destructive payloads hidden inside heredocs and inline scripts. It stores decision logs in FrankenSQLite with FTS5 full-text search and exposes an MCP server through rust-mcp-sdk 0.9.0.
The README positions dcg as a cross-agent alternative to per-tool permission prompts. Instead of trusting each agent's own confirmation dialog, dcg applies a consistent rule set across every supported tool, with default packs that include a Windows filesystem and system pack blocking del /s, rd /s, Remove-Item -Recurse -Force, format, and vssadmin delete shadows out of the box.
Why it is trending now
- 497 stars in the trend window ending 2026-07-16, placing at trending rank 9 for the period.
- v0.6.8 shipped on 2026-07-15 with a Windows PowerShell 5.1 ConstrainedLanguage hotfix, and v0.6.7 shipped the previous day closing a stdin-driven database-client bypass class and blocking force-refspec pushes.
- Broad agent coverage across 14 integrations makes it one of the few local guards that works across Claude Code, Codex CLI, Gemini CLI, Copilot, Cursor, Hermes, Grok, and Antigravity from a single binary.
- Release artifacts include SHA-256 checksums, minisign signatures, signed DSR SLSA provenance, and a source-tree SPDX SBOM, which is unusually thorough for an early-stage CLI tool.
Problem it solves
- AI coding agents occasionally generate catastrophic commands such as git reset --hard, rm -rf against project roots, or force pushes to shared branches.
- Each agent ships its own permission prompt, so a developer using three agents faces three different confirmation dialogs with inconsistent rule sets.
- Destructive payloads can hide inside heredocs, piped stdin, or inline scripts that a surface-level command check misses.
- Windows users face a distinct threat surface including format, vssadmin delete shadows, and recursive Remove-Item calls that Unix-focused tools do not address.
How it works
- Install with the one-line curl script: curl -fsSL with the install.sh URL, piped to bash with --easy-mode. The script auto-detects the platform, downloads the correct binary, and configures detected agent hooks.
- On Windows, use the PowerShell installer: irm the install.ps1 URL, create a script block, and pass -EasyMode -Verify. The installer verifies the SHA-256 checksum, checks the minisign signature when available, and verifies Sigstore/cosign provenance when both cosign and a trusted bundle are present.
- dcg registers as a hook in each agent's configuration. For Grok, dcg install --grok writes ~/.grok/hooks/dcg.json. For Antigravity, dcg install --agy writes ~/.gemini/config/hooks.json.
- When an agent prepares a command, dcg inspects it against rule packs. Default packs include git, shell, and Windows-specific rules. Custom packs load from YAML via serde_yaml and support glob pattern paths.
- For commands containing heredocs or inline scripts, dcg applies AST-based matching using ast-grep with tree-sitter grammars for seven languages, catching destructive content nested inside multi-line payloads.
- Deny decisions are logged to a FrankenSQLite database with FTS5 full-text search. The production fail-open budget is 200 milliseconds, enforced separately from test deadlines.
Command Surface and Installation Paths
- Primary binary: dcg, compiled from src/main.rs, package name destructive_command_guard, version 0.6.8.
- Linux/macOS install: curl -fsSL of the install.sh raw URL piped to bash -s -- --easy-mode.
- Windows install: PowerShell script block created from irm of install.ps1, invoked with -EasyMode -Verify.
- Agent-specific install flags: dcg install --grok for native Grok hooks, dcg install --agy for Antigravity CLI via ~/.gemini/config/hooks.json.
- Self-test command: dcg test, whose exit code the Windows installer uses as the verification probe.
- Version pinning on Windows: -Version vX.Y.Z, with -RequireMinisign to fail closed if the sidecar or verifier is unavailable.
- Copilot hook path on Windows: %COPILOT_HOME%\hooks or %USERPROFILE%\.copilot\hooks, configured at user level for all workspaces.
Agent Integration Matrix
- Native hooks: Claude Code, Codex CLI 0.125.0+, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat (via Claude compatibility), Cursor IDE, Hermes Agent.
- Native with separate path: Grok (xAI) via ~/.grok/hooks/dcg.json, also picked up through Claude compatibility layer automatically.
- Native config injection: Antigravity CLI (agy) via ~/.gemini/config/hooks.json through dcg install --agy.
- Community plugin: OpenCode via aspiers/ai-config opencode plugin (dcg-guard.js).
- Extension recipe: Pi via docs/pi-integration.md.
- Limited support: Aider (git hooks only), Continue (detection only, no blocking).
License and Supply-Chain Considerations
The LICENSE file is MIT with an OpenAI/Anthropic rider. The rider defines Restricted Parties as OpenAI, L.L.C. and Anthropic, PBC, their affiliates, and anyone acting on their behalf. No rights are granted to those parties, and any purported license is null and void without prior written permission from the copyright holder, Jeffrey Emanuel. The rider also covers derivative works, training corpora, and evaluation harnesses.
This means organizations building products on top of OpenAI or Anthropic APIs, or contractors working on behalf of either company, cannot legally use dcg without separate permission. For independent developers and companies not in the restricted set, the MIT base applies normally.
On the supply-chain side, the v0.6.8 release notes describe manual rebuilds of all six binaries outside GitHub Actions, with SHA-256 checksums, minisign signatures, signed DSR SLSA provenance, a source-tree SPDX SBOM, and real installer verification on Linux, macOS, and Windows PowerShell 5.1. The Windows installer mandates a SHA-256 checksum check and optionally verifies minisign and cosign provenance.
Who should pay attention?
Good fit if
- You run two or more AI coding agents and want a single rule set instead of per-agent permission prompts.
- You work on Windows and need blocking for del /s, rd /s, Remove-Item -Recurse -Force, format, and vssadmin delete shadows.
- You want heredoc and inline-script inspection, not just top-level command matching.
- You are not affiliated with OpenAI or Anthropic and can use the software under the MIT base license.
Skip for now if
- Your organization is an OpenAI or Anthropic affiliate, contractor, or entity acting on their behalf — the license rider voids all rights.
- You already have a centralized command-execution policy server or sandboxing layer that blocks destructive commands before they reach the shell.
- You only use Aider or Continue and need full blocking — Aider support is git hooks only, and Continue is detection only.
Risks and cautions
The MIT license carries an OpenAI/Anthropic rider that prohibits use by those companies, their affiliates, and anyone acting on their behalf, creating a hard legal boundary for a large segment of the AI tooling ecosystem.
- The rider voids all license rights for OpenAI, Anthropic, their affiliates, and contractors acting on their behalf, including use in training corpora and evaluation harnesses.
- The rider applies to derivative works, so any downstream product built on dcg inherits the same restriction.
- Enforcement includes injunctive relief and attorneys' fees for the prevailing party, raising the stakes of accidental non-compliance.
- Agent integrations are uneven: Aider is git hooks only and Continue provides detection without blocking, which can create false confidence if users assume parity across all 14 listed tools.
- v0.6.7 closed a stdin-driven database-client bypass class that could circumvent command inspection when input was piped through database clients.
- v0.6.7 added blocking for force-refspec pushes and repaired project allowlists outside Git repositories.
- Windows installer mandates SHA-256 checksum verification before installation proceeds.
- Optional minisign signature verification via -RequireMinisign fails closed if the sidecar or verifier is missing.
- Optional Sigstore/cosign provenance verification activates when both cosign and a trusted bundle are available.
- Production fail-open budget is 200 milliseconds, enforced separately from test-only deadlines to avoid masking real latency regressions.
- Decision logs use FrankenSQLite 0.1.16 with atomic commit-marker recovery hardening and FTS5 full-text search.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Claude Code permission prompts | You only use Claude Code and are satisfied with its built-in confirmation dialogs for shell commands. | Free, built into the agent |
Manual git hooks | You want lightweight pre-commit or pre-push guards without installing a separate binary. | Free, requires hand-written scripts |
Docker or container sandboxing | You want filesystem-level isolation so destructive commands cannot touch the host regardless of agent behavior. | Free if you already containerize development environments |
| You run Codex CLI exclusively and trust its own hook system without cross-agent rule sharing. | Free |
What this trend reveals
Internal fork for restricted organizations
Companies affiliated with OpenAI or Anthropic cannot use dcg under the current rider, but the rule-pack format and heredoc inspection logic are valuable. An internal fork with a clean MIT or Apache-2.0 license could replicate the detection model without the rider conflict.
Check whether your legal team considers your organization a Restricted Party under the rider's affiliate definition before investing in a fork.
Custom rule packs for infrastructure commands
dcg loads custom YAML rule packs via serde_yaml with glob pattern paths. Teams can author domain-specific packs for cloud CLI tools, Kubernetes commands, or database migrations to extend protection beyond the default git and shell rules.
Write a pack that blocks kubectl delete namespace or terraform destroy in production contexts and run dcg test to confirm detection.
RepoDaily verdict
dcg solves a real and growing problem — destructive commands generated by AI coding agents — with solid technical foundations in Rust, AST-based heredoc inspection, and unusually rigorous release signing. The OpenAI/Anthropic license rider is the dominant caveat: it creates a hard legal boundary that excludes a large portion of the AI tooling ecosystem. For independent developers and non-restricted organizations, dcg is a practical, fast-to-evaluate guard worth installing alongside any multi-agent coding setup.