Missed the latest GitHub check; these facts may be older.
Overview
dcg is a Rust hook that intercepts commands issued by AI coding agents such as Claude Code, Codex CLI, Gemini CLI, Copilot CLI and Cursor, and blocks destructive ones like `git reset --hard` or `rm -rf` before they run. Rules are grouped into packs (databases, Kubernetes, cloud, Docker and others), with heredoc and inline-script scanning, allowlists, per-agent profiles and a CI scan mode. A block prints the reason and a safer alternative.
Who it is for: Developers running AI coding agents who want a guardrail on shell commands
Strengths
Supports many agents, with native install flags such as --codex, --opencode, --grok
Core git and filesystem rules are active with no config file
50+ packs for databases, Kubernetes, cloud and containers, enabled per pack or category
dcg explain shows why a command was blocked; allow-once codes and allowlists handle exceptions
Weaknesses
DCG_BYPASS=1 disables all protection for that invocation
Broad warn/log policy is silently raised back to deny for critical rules
Most packs, including database and Docker, are opt-in until configured
Custom license (detected as NOASSERTION), not a standard OSI license
cavemanShortens coding-agent replies and compresses tool output before the model reads it
Live demo ↗
(opens in a new tab)119.3k stars+8,422 (+7.6%) in 30 daysApache-2.0