Safety layer for agentic coding tools - classifies shell commands before execution
npm install deliberateA safety layer for AI coding agents.
AI agents have access to your shell. They can run any command. Delete files. Exfiltrate credentials. Open reverse shells. The only guardrail: a yes/no prompt you'll inevitably approve on autopilot.
Deliberate forces you to be deliberate. Every command gets classified and explained before execution:
```
[Bash] rm -rf node_modules
π¨ [DANGEROUS] Recursively deletes the node_modules directory and all contents.
> Allow? [y/n]
The analysis persists after executionβno more vanishing prompts:
``
π¨ DELIBERATE [DANGEROUS]
Recursively deletes the node_modules directory and all contents.
Three risk levels:
- β
SAFE β Read-only, no system changes
- β‘ MODERATE β Modifies files or services, reversible
- π¨ DANGEROUS β Destructive, credential access, network exfiltration
Every command shows its analysis. You decide with context, not blind trust.
Four layers, each serving a purpose:
``
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Layer 1: Pattern Matcher β
β Regex rules. Deterministic. Can't be bypassed β
β by prompt injection. β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Layer 2: ML Classifier β
β Semantic embeddings via CmdCaliper. Trained on β
β 712 labeled commands. Catches novel attacks. β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Layer 3: LLM Explainer β
β Human-readable explanations. Uses your β
β configured provider (Claude, Ollama, etc). β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β Layer 4: Catch-All Backup β
β Automatic backup before ANY destructive command. β
β Files recoverable even if you approve by mistake. β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
The AI agent can't explain away its own commandsβthe classifier runs independently.
Individual commands can look safe while the sequence is catastrophic. Deliberate tracks command history within sessions and detects dangerous patterns:
| Pattern | What It Detects |
|---------|-----------------|
| REPO_WIPE | rm + git rm + force push |
| MASS_DELETE | 3+ rm commands in sequence |
| HISTORY_REWRITE | git reset --hard + force push |
| TEMP_SWAP | copy to temp, delete original, copy back |
When a pattern is detected, you see the full contextβnot just the current command.
Before destructive commands run, you see exactly what will be affected:
``
β οΈ WILL DELETE: 17 files, 2 directories (2,847 lines of code) [156.3 KB]
Files:
- src/ai/deliberate-ai.ts
- src/core/classification/classifier.ts
- src/cli/commands.ts
... and 14 more
Supported commands:
- rm / git rm β shows files and line countsgit reset --hard
- β shows uncommitted changes that will be discardedgit clean
- β shows untracked files that will be deletedgit checkout --
- β shows modified files that will revertgit stash drop
- β shows stash contents that will be lost
Every destructive command triggers an automatic backup before execution:
``
~/.deliberate/backups/
βββ my-project/
βββ 20250114_120000/
βββ metadata.json # Command, paths, restore info
βββ files/ # Backed up files (original structure)
βββ git_state/ # Branch, commit, uncommitted diff
Files are recoverable even if you approve a destructive command by mistake. The metadata.json includes file mappings for exact restore to original locations.
`bash`
npm install -g deliberate
deliberate install
The installer configures:
- Claude Code: Adds hooks to ~/.claude/settings.json.~/.config/opencode/plugins/
- OpenCode: Installs plugins to and registers them in ~/.config/opencode/opencode.json.~/.antigravity/hooks/
- Antigravity: Adds hooks to and updates settings.json.~/.gemini/hooks/
- Gemini: Adds hooks to and updates settings.json.
- LLM: Sets up your provider (Claude, Anthropic API, or Ollama) for explanations.
Python 3.9+ is required. The installer auto-installs sentence-transformers, scikit-learn, and numpy. The CmdCaliper embedding model (~419MB) downloads on first use.
`bash`
deliberate install # Install Claude Code hooks + OpenCode plugin, configure LLM
deliberate status # Check installation
deliberate classify "rm -rf /" # Test classification β DANGEROUS
deliberate serve # Start classifier server (faster)
The classifier ships with 481 labeled examples: reverse shells, credential theft, cloud operations, container escapes, privilege escalation, and safe workflows.
`bashAdd to training/expanded-command-safety.jsonl
{"command": "...", "label": "DANGEROUS", "category": "..."}
$3
Uncertain classifications get logged. Review and approve them:
`bash
python training/approve_cases.py # Review pending
python training/build_classifier.py --model base # Retrain
`Requirements
- Node.js 18+
- Python 3.9+
- Claude Code or OpenCode 1.0+
Works on macOS, Linux, and Windows.
OpenCode Support
Deliberate integrates with OpenCode via two plugins (installed automatically):
- Command Safety: Intercepts
bash commands like rm, git reset, docker rm.
- Change Summaries: Summarizes file modifications from write, edit, patch, and multiedit tools.Unlike standard plugins, these reuse the same Python analysis engine as Claude Code, ensuring consistent safety rules and explanations across platforms.
Note: You must restart OpenCode after
deliberate install.Antigravity Support
Deliberate integrates with Antigravity via shell hooks (installed automatically):
- PreToolUse: Intercepts
Bash tool usage to analyze commands.
- PostToolUse: Logs file changes from Write/Edit tools.Hooks are installed to
~/.antigravity/hooks/ and enabled in ~/.antigravity/settings.json.Gemini Support
Deliberate integrates with Gemini CLI via shell hooks (installed automatically):
- pre-command: Intercepts shell commands.
- post-file-change: Logs file modifications.
Hooks are installed to
~/.gemini/hooks/ and enabled in ~/.gemini/settings.json.Uninstall
`bash
deliberate uninstall
``Removes all hooks, plugins, and configuration.
Command embeddings by CmdCaliper from CyCraft AI.
Copyright Β© 2026 The Radar. All rights reserved.
Source available for inspection and personal use.