Add policy guardrails to DesktopCommander with Intercept

[s-a-m-a-i]

DesktopCommander gives agents powerful system access — terminal commands, file operations, process management. That's awesome, but also risky without guardrails.

We built Intercept, a transparent MCP proxy that enforces YAML policies on every tool call. You can wrap DesktopCommander with it to add restrictions like:

execute_command:
  rules:
    - name: "block destructive commands"
      conditions:
        - path: "args.command"
          op: "matches"
          value: "rm -rf|mkfs|dd if="
      action: "deny"
      on_deny: "Destructive commands not permitted"
    - name: "rate limit commands"
      rate_limit: 20/minute
      on_deny: "Command rate limit reached"

The agent connects to Intercept, Intercept proxies to DesktopCommander. Blocked calls never reach the server. The agent doesn't know it's there.

Open source, MIT licensed: https://github.com/policylayer/intercept