It blocks agent commands before the shell receives them
dcg connects to the hook systems exposed by Claude Code, Codex CLI, Gemini CLI, Copilot, Cursor, and several other coding tools. When an agent proposes a shell command, the Rust binary classifies it and returns an allow or deny decision. The default Unix rules cover destructive filesystem operations, dangerous Git history changes, and disk commands. That is a useful last check when an agent has write access to a repository and is moving faster than a reviewer can read its transcript.
The repository goes well beyond matching rm -rf. Its pack catalog covers databases, containers, Kubernetes, clouds, storage, and infrastructure tools, but most of those protections are opt-in. More than 50 packs are advertised, while only core filesystem, core Git, and system disk protection start enabled on Unix. dcg init writes a starter config with examples. Buyers should read that distinction carefully because installing the binary does not automatically guard every destructive operation named in the README.
The hook is a guardrail, not an access-control boundary
The escape routes are explicit. DCG_BYPASS=1 skips protection for one invocation, an allow-once code approves one denied command, and permanent allowlists can exempt a rule or command. Removing the hook disables it altogether. These controls make the tool usable when its parser gets in the way, but they also define its security limit. A process that can change its environment or agent configuration is outside the protection model.
That leaves native controls in charge of the hard boundary. Keep Git work recoverable, limit cloud credentials, require database permissions appropriate to the task, and use the agent's sandbox or approval system. dcg can catch a bad string before execution; it cannot restore a deleted resource or stop a caller that deliberately disables the 1 hook responsible for screening commands.
What happened when we ran it
Our sandbox installed commit d1ada2d in 75 seconds, adding 361 packages. The build completed successfully in 363 seconds. This was a sizeable Rust checkout with 603 files, about 305,091 source lines, and 22.5 MB checked out, so compiling it from source is a longer job than the one-line binary installer suggests.
The test command failed with exit code 101 after 399 seconds. Cargo reported 5,311 passed and 2 failed out of 5,313. The tail showed several passing groups, then a group with 9 passes and 1 failure, and ended by naming rebase_recovery_e2e as the test target to rerun. The supplied tail does not name both failed cases or establish a cause, so the defensible result is simple: this commit did not pass its full suite in our fresh Debian container.
The scan also found 10 CI workflow files and a tests directory, but no Dockerfile. Those repository signals show substantial automated testing without providing a ready-made container path. Our run used 3 CPUs, 12 GB of RAM, an unprivileged Rust image, and no secrets. It measured setup and tests, not detection accuracy across a production command history.
Current issues show both unwanted blocks and missed commands
Open issue 357 documents a practical false positive in v0.13.9. A quoted heredoc prevents shell expansion, yet a body line beginning with a backtick can trigger the heredoc.shell:launcher-unverified rule. The reporter hit it while posting Markdown through command-line clients and suggests honoring the quoted delimiter. Until that behavior changes, users who submit fenced Markdown may need to place the body in a file, use an allow-once code, or accept interruptions.
Issue 361 reports the opposite problem. In a 33-case corpus, paths such as /usr/*/git branch -D main escaped the core Git pack even though the basename is literally git. The report says 0 of 4 wildcard-directory bypass shapes were caught in the tested releases. This is an edge spelling rather than the ordinary command most agents emit, but a command guard should be judged on both false denials and false allowances.
Agent coverage differs by client and operating system
The installer auto-detects several clients and merges hook configuration instead of asking users to wire every JSON file by hand. Codex CLI 0.125.0 or newer gets a specific output format because its hook protocol rejects unknown fields. Native Windows has a PowerShell installer and default Windows filesystem and system packs; WSL follows the Unix path. Aider receives only Git-hook coverage, while Continue is listed as detection-only.
Run dcg doctor after installation and test one harmless command plus one known denial in the actual client. An installed binary proves little if the agent is using another shell tool, a malformed hook file was preserved, or the client does not enforce the returned decision. The README's integration notes are detailed enough to make that verification possible, which matters more than the length of the supported-client list.
August maintenance is active, while the license needs reading
GitHub recorded 5,868 stars, 5 combined open issues and pull requests, and a last push on August 28, 2026. Release v0.13.9 was published the same day. The open queue includes recent, specific parser reports and pack expansion requests, which suggests users are exercising the rules rather than only starring the idea. The combined GitHub count should not be read as 5 confirmed bugs.
GitHub labels the license as NOASSERTION, and the README calls it custom. Organizations that require an OSI-approved or standard SPDX license should read the repository's license before distributing the binary. For everyone else, the decision turns on expectations: dcg is a practical extra refusal layer with 5,311 passing tests in our run, but it does not deserve the trust normally assigned to a sandbox or a permission system.