Doppelganger

A doppelganger ally is a contracted spy, a member of a thieves' guild that owes the party a favor, or a refugee whose own kind has cast them out for refusing a kill. The framing has to acknowledge that the party will never fully trust this NPC, and the doppelganger knows it. That tension is the relationship.

In play, the doppelganger is an infiltration multiplier. Shape-Shift as a bonus action means it can scout a fortress as the steward, return as itself to debrief, then reenter as the captain of the guard the same evening. Read Thoughts at DC 12 lets it confirm whether a target is lying without rolling Insight. The party should be feeding it questions and getting answers back, the way they would use a divination spell except the doppelganger gets to lie about what it heard. That ambiguity is part of why this ally is interesting.

In combat, it's a CR 3 with 52 HP, AC 14, and two Slam attacks at +6 for 11 each, with Advantage on the first round if the doppelganger initiated from disguise. Save Unsettling Visage (recharge 6, DC 12 Wis, Frightened) for a moment when an enemy spellcaster needs to be denied. The doppelganger will not stand in a melee line for the party. It flanks, ambushes, vanishes, returns. If the party tries to use it as a tank, it will Shape-Shift into a child and walk off the battlefield.

Make the doppelganger's true form genuinely strange the first time the party sees it. Grey skin, blank eyes, no body hair. The party should remember what's underneath every face it wears.

A doppelganger is a social problem first and a combat problem second. The fight only happens after the masquerade fails, and a good doppelganger encounter spends one or two whole sessions in disguise. The mayor, the trusted contact, the merchant who sold them their last potion: pick someone the party already knows and quietly swap them out. Read Thoughts (Detect Thoughts at DC 12, no components) is what makes the disguise hold up. Whenever a player asks a leading question, the doppelganger casts it and answers correctly.

When the mask comes off, lead with Unsettling Visage if it's available. The 15-foot emanation, DC 12 Wis save, Frightened on a fail, and the duration is the whole minute or until the target moves out of line of sight. Frightened means disadvantage on attacks against the doppelganger and they can't approach it, which gives it a free round to reposition or escape. Then Multiattack: two Slam at +6 for 11 bludgeoning each, with Advantage on every attack during the first round of combat. That ambush bonus is the entire reason the disguise existed. Open from a flanking position the party didn't know was a flanking position.

Shape-Shift is a bonus action and stats stay the same except size, so use it tactically mid-fight. Drop into the form of the bard the party loves and try to walk past the rogue. Become the dying town guard the cleric will reflexively run to. The doppelganger has Charmed immunity, Darkvision 60 ft., Insight +3, Deception +6, and 52 HP, so it's tough enough to survive long enough to vanish. At Bloodied, shift into a generic civilian and run. Doppelgangers do not die for a contract.

Roll the doppelganger's Deception checks behind the screen even when the players aren't suspicious yet. The sound of dice rolling unprompted teaches them to second-guess every NPC, which is the correct paranoia for this monster.