HOL Guard

HOL Guard is a local-first runtime control layer for AI coding agents. It sits between an agent such as Claude Code, Codex or Cursor and the developer's machine, and it checks risky actions before they run. On supported integrations, Guard can allow, ask or block a covered action, and it keeps a local record of what happened. The core Guard Local runtime is free and open source under the Apache-2.0 license. Guard Cloud is a separate, optional paid add-on for teams that want shared policy and dashboards.

What problem it solves

AI coding agents are useful because they can act: they run shell commands, read and edit files, install packages, call MCP servers and push code. The same ability is what makes them risky. An agent can follow a bad instruction from a README, a web page or a poisoned tool description. It can misread a task and delete the wrong folder, read a credentials file, send a .env file to an outside server, or install a package nobody reviewed. Native approval prompts in each agent help, but they differ from tool to tool, and they are easy to click through when you are moving fast. HOL Guard gives developers one consistent checkpoint across the agents they already use, so the same policy applies whether the action comes from Claude Code, Codex, Cursor or another supported harness.

How it works

Guard installs locally and hooks into the pre-action events that each supported agent exposes. When the agent tries to take a covered action, Guard evaluates it against the policy you choose before the action executes. Routine work, such as building a project or opening a file to edit, is allowed. Actions that match known risky patterns, such as deleting a documents folder, reading saved cloud credentials, piping secrets to a remote host or pushing straight to a main branch, can be blocked or paused for your approval. Ambiguous actions are routed to an ask decision so you stay in control. Every decision is written to a local trail that you can review later.

The policy decision path runs on your machine. Guard Local does not need a cloud account, your files are not uploaded, and normal local protection keeps working without an internet connection. Enforcement depth varies by agent and by event type, so HOL publishes a coverage matrix that states what is blocked, reviewed, observed or not covered for each integration. That honesty matters: Guard is a control point for supported events, not a promise that every possible attack is stopped. A scan or a decision is not a safety guarantee.

What it covers

HOL Guard focuses on the actions that cause real damage in agent workflows:

• Destructive shell commands, such as recursive deletes outside the project.
• Secret and credential access, such as reading cloud credential files or SSH keys.
• Data movement, such as sending local files or environment variables to an unknown endpoint.
• Package installs, including malicious or changed packages.
• MCP calls and risky MCP configuration.
• Unsafe plugins, skills, hooks and agent settings.
• Git operations that bypass review, such as pushing directly to a protected branch.
• Actions driven by prompt injection, where an agent is steered by untrusted content.

Supported agents

Guard works with a growing list of AI coding agents and harnesses. The public install page lists Cursor, Claude Code, Codex, OpenCode, Antigravity CLI, Hermes, OpenClaw, GitHub Copilot CLI, Antigravity, Kimi, Grok, Pi and Zcode. Each harness has its own one-line install command that installs Guard and configures that agent in one step. Developers who prefer Python tooling can install with pipx install hol-guard and then run hol-guard init.

Target audience and use cases

HOL Guard is built for individual developers, open-source maintainers and engineering teams who let AI agents run commands on real machines.

• Solo developers use it to stop an agent from deleting files, leaking a token or installing an unreviewed dependency while they work quickly.
• Teams that are rolling out Claude Code, Codex or Cursor use it to apply a consistent baseline policy across many laptops without relying on each person to read every approval prompt.
• Security and platform engineers use the local decision trail as evidence of what agents tried to do and what was allowed or blocked.
• Maintainers and plugin publishers pair Guard with HOL's separate plugin-scanner, which validates Codex plugins, Claude Code plugins, Antigravity CLI extensions and OpenCode bundles in CI before release.

Integrations and extensibility

Guard integrates directly with agent hook systems rather than asking you to change how you work. The companion plugin-scanner can run locally or as a GitHub Action to gate pull requests, computing a weighted trust score across security, MCP posture, installability and maintenance. It flags insecure HTTP MCP endpoints, wildcard binds and missing auth, checks manifest and marketplace metadata, and scans bundled skills for prompt injection markers, zero-width characters, dangerous shell commands and secret leaks. HOL also maintains a public security hub with advisories, attack breakdowns and configuration guidance for threats such as prompt injection, MCP tool poisoning, supply-chain attacks and secret exfiltration.

Guard Local vs Guard Cloud

Guard Local reviews supported agent actions on the developer's computer and applies configured policy at supported events. Local decisions continue without Cloud connectivity, and the local trail records approvals and changes. Guard Cloud adds synchronized settings and history, organization policy that local devices cannot weaken, shared dashboards and evidence export. Cloud connectivity is for visibility and coordination, not for enforcement, so local protection does not depend on it.

Pricing

Local HOL Guard is 100% free and open source, with no credit card required. Guard Cloud is optional: a Solo plan keeps decision history across devices, and Pro and Team plans add shared policy for groups. Enterprise pricing is available on request. Because the local runtime is free, most developers can start with Guard Local and add Cloud only if they need it.

Security and privacy

Guard is designed so that the security decision happens close to the action, on the machine where it would run. Files stay local, decisions are recorded locally, and the open-source code can be inspected by anyone. The project is built in the open with frequent public releases and release notes.

Alternatives and fit

The right tool depends on the control boundary you need. Native agent approvals confirm single actions, static scanners inspect packages and MCP configurations before use, sandboxes isolate processes, model guardrails filter prompts and outputs, and network gateways centralize MCP or network traffic. HOL Guard is the open-source, local-runtime option for cross-agent policy, pre-execution review on supported events, approvals and local evidence. Many teams combine it with sandboxing and code review rather than replacing them.

Getting started

Install Guard in about a minute with the harness-specific command on hol.org/guard, or run pipx install hol-guard and hol-guard init. Then keep using your agent as normal. Guard stays quiet for routine work and steps in only when a covered action needs a decision. HOL Guard is made by HOL.