Destructive Command Guard: a Hook That Blocks Agents from Nuking Your Files

What it is — A Rust-based pre-execution hook (“dcg”) that intercepts and blocks catastrophic commands (git reset --hard, rm -rf ./src, DROP TABLE users, etc.) before AI coding agents can run them, across Claude Code, Codex CLI, Gemini CLI, Copilot, Cursor and others.

Key points

• Runs as a PreToolUse hook, parsing and pattern-matching each command through 50+ modular security packs (git, filesystem, databases, Docker, Kubernetes, cloud providers) with sub-millisecond, SIMD-accelerated filtering.
• Distinguishes context to avoid false positives — it won’t block grep "rm -rf" but will block an actual rm -rf /, and it scans heredocs/inline scripts (e.g. python -c "os.remove(...)") that would otherwise slip through.
• Started as a Python script from Jeffrey Emanuel, since rewritten in Rust with community contributions, and includes a pre-commit hook mode to catch dangerous commands during code review.