tunahanaliozturk/derbent

One guarded pass for all your coding agents.
Every tool call that reaches Derbent, MCP or a CLI's built-in tools, is decided by one policy and written
to a tamper-evident log, and the calls you care about wait for you.
Derbent guards against mistakes and prompt injection, and keeps an audit trail. It is not a sandbox: an
agent that can already run shell commands as you can get around it (see Limits).
In Turkish history, a derbent was a guarded post on a mountain pass: its keepers decided who went through
and kept a record of everyone who did. Derbent does the same for your coding agents' tool calls.
Claude Code, Codex, GitHub Copilot CLI and Antigravity CLI connect to Derbent as one MCP server, and your
other MCP servers sit behind it. Each CLI's pre-tool hook sends its built-in tools, such as the shell and
file edits, through the same gate. Every call is decided by your rules and written down.
Support for Codex and Antigravity CLI is experimental (configured from their docs, not yet checked in a
real session).
It is one binary for Windows, macOS and Linux. There is no daemon and no network listener: a SQLite file
is the only shared state (ADR 0001).
What you get
- **Rules that allow, deny or ask**, by agent, tool and argument. The first match wins. The same rules
apply to MCP tools and to built-in tools such as the shell, in all four CLIs, and a repository can add
project rules that only make them stricter.
- **Approvals.** A call your rules ask about waits until you press a in the terminal UI, or is denied
after 50 seconds by default.
- **Receipts.** Every call gets a hash-chained receipt, and derbent verify names the first receipt
where the chain breaks after one was edited, moved, inserted or removed. Keep the head hash it prints
to catch the newest ones being deleted too.
Also:
- **Shared memory and handoffs.** Agents keep notes per repository and can leave tasks for each other.
- **Pins** hold back a downstream server's tool when its definition changes.
- **Budgets** stop an agent stuck in a loop.
Install
Download the binary for your system and SHA256SUMS from the
latest release, check the hash, and put it
on your PATH as derbent (derbent.exe on Windows):
Or build it with Go 1.27 or later:
Homebrew (brew install tunahanaliozturk/tap/derbent) and Scoop install it too; see
Install and set up.
Every release can be rebuilt byte for byte from its tag. Install and set up has the
other systems, how to check a release, and each CLI's entries by hand.
Quick start
derbent init shows every change and asks once before it makes any. It copies each file it changes
first and never replaces an entry you already have. With --dry-run it only shows the changes. Two of
them, from a real run with the paths shortened:
It also adds the derbent gate hook to each CLI's settings; Install and set up shows
every entry. Start your agents as usual. Their calls now appear in the UI, and calls the rules ask about
wait there for you. Built-in tools says what each CLI's hook covers.
To put your other MCP servers behind the gate, so each agent needs only the one derbent entry, see
Downstream servers.
How a call is decided
Rules live in config.toml in your user config directory (%AppData%\derbent\ on Windows,
~/.config/derbent/ on Linux, ~/Library/Application Support/derbent/ on macOS). A downstream MCP
server's tools are named __ , and a CLI's built-in tools native__ :
To see how a call would be decided before it happens:
It prints each rule and why it matches or not, down to the first match, then the project's rules,
budgets, pin and grant, and ends with verdict: ask (rule:3) for this call under the rules above. Rules covers globs, the three presets (watch,