Ten minutes before a hackathon demo, my coding agent misread a prompt and deleted the project it was supposed to be presenting. We lost. Obviously. But what stuck with me was how it happened: nothing in the loop asked whether that action should run before it ran. The agent had my full trust on every tool call, all the time, no exceptions. That gap turned into Doberman. It's an open-source, local-first authorization layer for coding agents. Every shell command, file write, and MCP call gets exactly one verdict before it executes: pass, pause for a human, or block outright, no matter what the agent decided on its own. I'm Alan. It's Apache-2.0, Python 3.11+, with around 2,000 tests in CI right now. It hooks into Claude Code, has an experimental Codex CLI hook and a native OpenClaw plugin, and transparently proxies everything else that speaks MCP. It's currently in the Alpha stage with a lot of bugs so would love for you too break it. Submit any issues you find it and I promise to have it fixed within a week. If a coding agent has ever done something like this to you, I want to hear the story. Github: https://github.com/DobermanCore/...
Doberman is an open-source, runtime security layer for AI coding agents. It sits between the agent and its tools and gives every action a PASS, AUTH or BLOCK verdict before it runs. A deterministic core catches known dangerous behavior, while an adaptive layer learns what’s normal for you and raises risk when something looks off. It fails closed and learning is raise-only.
Works with Claude Code, Codex, OpenClaw and MCP clients like Cursor.
