# dcg (Destructive Command Guard)

> A Rust pre-tool hook that blocks destructive shell and git commands before a coding agent runs them

- Category: Evaluation & Production Ops / Guardrails & Security
- Language: Rust
- Repository: https://github.com/Dicklesworthstone/destructive_command_guard
- Canonical page: https://ai-tldr.dev/tools/dcg/
- Updated: 2026-07-13

## In short

dcg (Destructive Command Guard) is a Rust pre-tool hook that blocks destructive shell and git commands before a coding agent runs them. It sits in the Guardrails & Security category of the Evaluation & Production Ops tools and is open-source, written in Rust. To get started: install on Linux or macOS.

## Overview

Destructive Command Guard — `dcg` — is a hook that sits between an AI coding agent and your shell. The problem it addresses is narrow and familiar: agents occasionally run something like `git reset --hard`, `rm -rf ./src` or `DROP TABLE users`, and hours of uncommitted work disappear in a second. dcg intercepts the command before it executes, refuses the destructive ones, and explains why along with a safer alternative.

It is written in Rust for speed, since it runs on the critical path of every tool call — the project credits SIMD-accelerated filtering and lazily compiled regexes for sub-millisecond execution. Patterns are organised as a modular pack system of more than fifty packs grouped into categories: enabling a bare category such as `database` turns on every sub-pack beneath it, and single sub-packs can be dropped again. Out of the box it blocks dangerous git and filesystem commands with no configuration; on Windows the filesystem and system packs are on by default, so `del /s`, `rd /s`, `Remove-Item -Recurse`, `format` and `vssadmin delete shadows` are covered too. Beyond simple pattern matching it scans heredocs and inline scripts, classifies context and applies allowlists.

dcg detects which agent is calling it and can apply a per-agent profile that adds or removes packs, widens the allowlist, or ignores allowlists entirely for unknown callers. The supported list is long and hook-native where possible: Claude Code, Codex CLI 0.125.0+, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok, Antigravity CLI, OpenCode, Oh My Pi, Crush, Pi, Posit Assistant, with Aider (git hooks only) and Continue (detection only). Escape hatches are deliberate and graded: `DCG_BYPASS=1` for one command, an allow-once code printed in the block message, or a permanent allowlist entry with a recorded reason. The project began as a Python hook by Jeffrey Emanuel and was ported to Rust by Darin Gordon before being substantially expanded.

Distribution is security-conscious: the PowerShell installer verifies a mandatory SHA256 checksum, checks the release's minisign signature when minisign is present, and verifies Sigstore/cosign provenance when cosign and a trusted bundle are available.

## What it does

- Blocks destructive git, filesystem, database, Kubernetes, cloud and container commands before execution, with an explanation and a safer alternative
- 50+ modular rule packs organised into categories, enabled or disabled per category or per sub-pack in `~/.config/dcg/config.toml`
- Per-agent profiles: add or remove packs, extend the allowlist, or disable allowlist bypass entirely for unknown callers
- Native hook integration across Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok, OpenCode, Crush, Oh My Pi and more
- Sub-millisecond Rust implementation with SIMD-accelerated filtering, heredoc and inline-script scanning, and context classification
- Graded escape hatches — one-shot `DCG_BYPASS=1`, an allow-once code from the block message, or a permanent allowlist entry with a reason
- Installers verify a SHA256 checksum, plus minisign and Sigstore/cosign provenance when the tooling is available

## Getting started

The installer auto-detects your platform, downloads the right binary and wires up whichever supported agents it finds. It works on Linux, macOS and Windows (natively via PowerShell, or through WSL).

1. Install on Linux or macOS

   Easy mode configures the hooks for every detected agent.

```bash
curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash -s -- --easy-mode
```

2. Install on Windows

   The PowerShell installer verifies the checksum, adds dcg to your user PATH and runs a self-test.

```powershell
& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.ps1"))) -EasyMode -Verify
```

3. Wire up a specific agent

   Several agents get a native hook rather than the Claude compatibility layer; ask for the one you use.

```bash
dcg install --grok       # ~/.grok/hooks/dcg.json
dcg install --opencode   # tool.execute.before plugin
dcg install --crush      # hooks.PreToolUse in crush.json
dcg install --omp        # Oh My Pi tool_call extension
```

4. Choose your rule packs

   List the real pack and category IDs with `dcg packs`, then enable what you need. A bare category expands to all of its sub-packs.

```toml
# ~/.config/dcg/config.toml
[packs]
enabled = [
    "database.postgresql",    # Blocks DROP TABLE, TRUNCATE
    "kubernetes.kubectl",     # Blocks kubectl delete namespace
    "cloud.aws",              # Blocks aws ec2 terminate-instances
    "containers.docker",      # Blocks docker system prune
]
```

5. Get past a false positive

   Prefer an allowlist entry for anything recurring; DCG_BYPASS disables all protection for that one invocation.

```bash
DCG_BYPASS=1 <command>                              # single command
dcg allow-once <code>                               # code from the block message
dcg allowlist add core.git:reset-hard -r "reason"   # permanent
```

## When to use it

- Stopping a coding agent from destroying uncommitted work with `git reset --hard` or `rm -rf`
- Keeping agents away from production databases, Kubernetes namespaces and cloud resources via the database, kubernetes and cloud packs
- Running several different coding agents on one machine under one policy, with per-agent trust profiles
- Giving a less-trusted or unrecognised agent a stricter rule set and no allowlist bypass

## Version history

- 2026-07-13 v0.6.6: dcg v0.6.6 shipped and the project reached the top of GitHub Trending, drawing attention to Rust hooks that intercept destructive shell and git commands from AI coding agents before they run.