explaingit

dicklesworthstone/destructive_command_guard

Analysis updated 2026-05-18

★ 5,319RustAudience · developerComplexity · 2/5Setup · easy

TLDR

A hook that intercepts and blocks destructive commands like rm -rf or git reset hard before an AI coding agent can run them.

Mindmap

mindmap
  root((repo))
    What it does
      Blocks destructive commands
      Explains why blocked
      Suggests safer alternative
    Tech stack
      Rust
      SIMD filtering
      Cross platform installer
    Use cases
      Protect uncommitted work
      Guard AI coding agents
      CI scan mode
    Audience
      Developers using AI agents
      DevOps and platform teams
    Coverage
      Git and filesystem
      Databases and cloud
      50 plus rule packs

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

What do people build with it?

USE CASE 1

Stop an AI coding agent from accidentally running git reset hard or rm -rf on your project.

USE CASE 2

Add stricter rule packs to block dangerous database, Kubernetes, or cloud commands.

USE CASE 3

Use scan mode in CI or pre-commit hooks to catch destructive commands during code review.

USE CASE 4

Configure different trust levels for different AI agents on the same machine.

What is it built with?

RustCLIClaude CodeCodex CLI

How does it compare?

dicklesworthstone/destructive_command_guardserenity-rs/serenityimageoptim/gifski
Stars5,3195,5045,509
LanguageRustRustRust
Setup difficultyeasymoderatemoderate
Complexity2/53/52/5
Audiencedeveloperdeveloperdeveloper

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · easy Time to first run · 5min

Uses a custom, non-standard license rather than a common open source license.

Uses a custom license rather than a standard open source license, check the LICENSE file for exact terms.

In plain English

This project, called dcg, is a safety tool for people who let AI coding agents run shell commands on their behalf. AI assistants like Claude Code, Codex, Gemini CLI, GitHub Copilot, Cursor, and several others occasionally issue commands that are genuinely destructive, things like git reset hard, rm -rf on a source folder, or dropping a database table, and those commands can wipe out hours of work in seconds. dcg sits in front of these agents as a hook and inspects every command before it is allowed to run, blocking the dangerous ones and explaining why, with a suggestion for a safer alternative. Installation is a single script that auto detects your operating system, whether Linux, macOS, or Windows through WSL, downloads the right binary, and wires itself into whichever supported coding agents it finds on your machine. Windows also has its own native PowerShell installer that verifies the download's checksum and signature before installing. Out of the box, dcg blocks common dangerous git and filesystem commands, and it can be extended with more than fifty optional rule packs covering databases, Kubernetes, Docker, the major cloud providers, and infrastructure tools like Terraform. It is built to be fast enough that a user will not notice any delay, and it is designed to tell the difference between a command that is actually dangerous and one that merely mentions a dangerous pattern, so something like a grep search for the text "rm -rf" is not blocked while an actual rm -rf command is. The tool can also be configured per agent, since some AI agents are trusted with a wider set of allowed commands than others, and administrators can adjust which rule packs apply to which agent. There is also an explain command that shows exactly why a particular command would be blocked, and a scan mode meant for use in continuous integration pipelines and pre-commit hooks, catching dangerous commands during code review rather than at execution time. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1
Show me how to install dcg and hook it into Claude Code and Cursor.
Prompt 2
Help me write a dcg config that enables the postgresql and kubernetes rule packs.
Prompt 3
Explain how dcg tells the difference between a grep search for rm -rf and an actual rm -rf command.
Prompt 4
Walk me through setting up agent-specific trust levels in dcg's config.toml.

Frequently asked questions

What is destructive_command_guard?

A hook that intercepts and blocks destructive commands like rm -rf or git reset hard before an AI coding agent can run them.

What language is destructive_command_guard written in?

Mainly Rust. The stack also includes Rust, CLI, Claude Code.

What license does destructive_command_guard use?

Uses a custom license rather than a standard open source license, check the LICENSE file for exact terms.

How hard is destructive_command_guard to set up?

Setup difficulty is rated easy, with roughly 5min to a first successful run.

Who is destructive_command_guard for?

Mainly developer.

Open on GitHub → Explain another repo

This repo across BitVibe Labs

Verify against the repo before relying on details.

Alternatives & similar repos