# Destructive Command Guard

> MIT-with-rider hook that blocks destructive agent shell and git commands

**Category:** AI Agents  
**Pricing:** open-source  
**URL:** https://github.com/Dicklesworthstone/destructive_command_guard  
**GitHub:** https://github.com/Dicklesworthstone/destructive_command_guard  
**Added:** 2026-09-22

---

## The Hook

dcg is a high-performance agent hook that blocks destructive git/shell/cloud commands before coding agents can wipe your tree.

## What's Good

MIT with an OpenAI/Anthropic rider (Dicklesworthstone/destructive_command_guard). Rust hook with modular security packs (filesystem, git, k8s/helm, CI, cloud CLIs, and more), allowlists, ask-mode where the host supports it, and install paths across Claude Code, Codex CLI, Gemini CLI, Copilot CLI/Chat, Cursor, Hermes, OpenCode, Grok Build CLI, and related hook surfaces. Built for sub-millisecond blocking so agents do not feel a tax on every command.

## The Catch

Vs sandbox products (E2B/Daytona/AgentBox) and Pi containerization docs: dcg is a deny-list hook on the host agent, not a VM/microVM boundary. The license rider voids rights for OpenAI, Anthropic, and their affiliates/agents — fine for most operators, a hard stop if you are those orgs or building their eval pipelines. Packs can be disabled incorrectly; treat "disabled packs" behavior as something you verify, and remember a hook is only as strong as the agent actually invoking it.

## Verdict

MIT-with-rider destructive-command hook. Strong default safety net for local coding agents; read the OpenAI/Anthropic rider before corporate adoption.