destructive_command_guard: Block Dangerous Commands Before Execution

Overview

dcg (Destructive Command Guard) intercepts commands submitted by AI coding agents and checks them for destructive operations before execution. It aims to prevent mistakes such as hard-resetting a Git working tree or recursively deleting files, with a denial message that explains the risk.

It is intended for developers who give coding agents shell access and want a command-level safety layer. Its modular rules also let teams extend protection to databases, cloud tools, containers, and other systems, though many of those rule packs require explicit configuration.

Key Features

• Hooks into a range of coding agents, including Claude Code, Codex CLI, Gemini CLI, Copilot, Cursor, and others.
• Checks Git and filesystem commands with core protection available by default.
• Offers optional rule packs for databases, cloud providers, infrastructure tools, containers, and more.
• Scans heredocs and inline scripts for potentially destructive commands.
• Provides dcg explain to show why a command matches a rule.
• Supports CI scanning and structured output formats, including SARIF for scan results.
• Includes configuration options for allowlists, per-rule policies, and stricter handling of unverified commands.

Use Cases

• A developer using an AI coding agent can block accidental deletion of files or uncommitted changes.
• A team can enable relevant rule packs to guard agent-issued commands against production databases or cloud resources.
• A security-conscious developer can inspect commands embedded in shell scripts or inline code before an agent runs them.
• A project maintainer can scan code in CI for dangerous commands and review findings in a supported output format.

Getting Started

On Linux, macOS, or Windows via WSL, the README provides this quick installer:

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash -s -- --easy-mode

See the README for native Windows installation, supported agent setup, configuration, and rule-pack details.

Considerations

• The README describes a custom license badge, while the repository metadata reports NOASSERTION; review the repository's license file before relying on reuse or redistribution rights.
• Default protection is deliberately limited: core Git and filesystem rules are enabled, with additional packs generally requiring configuration. Check which rules are active for your setup.
• Behavior depends on agent hook support and configuration. The README distinguishes among native integrations, compatibility paths, and limited or detection-only support.
• dcg is a guardrail, not a substitute for backups or command review. Its allowlist and bypass mechanisms can permit commands through, and evaluation failure behavior is configurable.