AI 代理安全
Destructive Command Guard Uses Rule-Based Hooks to Block Dangerous Agent Commands, Gains Nearly 500 GitHub Stars in One Day
The Rust tool dcg intercepts operations that could damage Git repositories, file systems, databases, and cloud resources before AI coding agents execute them. The project gained about 497 stars on July 26 alone, but it remains a pattern-matching defense and cannot replace sandboxing, permission isolation, and backups.
Once AI coding agents can operate terminals directly, the risks extend beyond generating incorrect code to deleting uncommitted work, rewriting Git history, or damaging infrastructure. Destructive Command Guard (dcg), which has recently surged in popularity on GitHub, places checks between tool calls and shell execution. Using hooks provided by products such as Claude Code, Codex CLI, Gemini CLI, Copilot CLI, and Cursor, it analyzes commands before returning an allow-or-deny decision.
Implemented in Rust, the project blocks dangerous operations such as recursive deletion, `git reset --hard`, and disk formatting by default. Its modular rule packs also cover PostgreSQL, Redis, Docker, Kubernetes, Terraform, AWS, GCP, Azure, GitHub Actions, and secrets management services. It scans embedded scripts in constructs such as heredocs and `python -c`, attempting to distinguish commands that will actually execute from strings appearing in `grep`, documentation, or test data. For Codex, dcg outputs concise, structured denial messages that conform to its hook protocol, preventing extra fields from causing the safeguard itself to fail.
Git Observatory listed dcg as an anomalously fast-growing project on July 26, observing an increase of about 497 stars in a single day; its GitHub page currently shows roughly 5,400 stars. This is a signal of adoption, not proof of security effectiveness. Rule-based systems may miss destructive paths involving encoding, indirect invocation, or novel combinations of tools, and they may also block legitimate operational work. Decisions can also be bypassed using `DCG_BYPASS=1`, one-time authorization codes, or permanent allowlists. Engineering teams should treat dcg as an additional brake while continuing to enforce least privilege, isolated workspaces, immutable backups, and human approval. Key areas to watch next include published false-positive rates, adversarial testing, and the extent to which different agents actually honor hook denial results.