Doberman

Working through this problem and would like other founders' actual experience rather than the generic answer. Doberman (open-source runtime guardrails for AI coding agents) is Apache-2.0 and staying that way: the core, the policy engine, the basic detection, the CLI, all of it. That's not up for negotiation. It's a safety tool, and gating the protection itself behind a paywall defeats the point.

Where I'm stuck: what's actually monetizable without making the free version feel deliberately hobbled. Candidates I'm weighing: a hosted dashboard for teams (centralized audit logs, org-wide policy management), premium detection rule packs distributed as plugins on top of the same open core, SSO and RBAC for orgs that need it for compliance reasons anyway. All of those plug in through the same extension points the open core already exposes to community plugin authors, so in theory a premium plugin isn't structurally different from a community one, just maintained and supported by me.

Anyone who's shipped an open-core security or dev-tool product: what actually converted, and what did you try that just made users feel punished for using the free tier?

https://github.com/DobermanCore/Doberman-Core

Launched Doberman on Product Hunt this week. It's an open-source runtime authorization layer for AI coding agents, sits between the agent and its tools and checks every shell command, file write, or MCP call before it executes. v0.18.5 shipped two days before launch. Current numbers: 198 GitHub stars, 28 forks, alpha software with about 2,000 tests in CI.

The mistake right after the launch is worth writing up. I posted the same link to seven subreddits within about a day, same domain each time, near-identical text on two of them. Reddit's own sitewide spam filter removed every single one, not the subreddit mods. New account, high link-post velocity, same domain repeated, that's a textbook spam signature, and I walked into it thinking I was just "sharing something I built in the obviously relevant places."

Lesson: an account needs to look like a person before it can look like a maker. Verified email, some karma, some link-free comment history, then post once, in one place, and let it breathe before the next one. Going to do the slow grind of building up an new account for a couple of months before even thinking about pushing Doberman on it.

Happy to answer questions about the launch, the tool, or exactly how I torched a week of Reddit karma in under a day.

https://www.producthunt.com/products/doberman

I think agent security is going to be a boring, unavoidable line item the way backups became one, and I wanted the open-source default to exist before the enterprise vendors define the category. Doberman sits between a coding agent and its tools, every tool call gets allow/authenticate/block from a local policy engine before it runs. Apache-2.0, local-first, pip install doberman-core.

The open-core bet: the runtime, policy engine, and adapters are free forever, and the paid layer later is compliance evidence and team controls. 19 contributors have merged PRs since it went public.

Live on Product Hunt today: https://www.producthunt.com/products/doberman