On this page
HOL Guard is an open-source, local-first security layer for AI agents. It reviews an agent's shell commands, file access, package installs and MCP tool calls before they run, then allows them, blocks them or asks you to approve, based on your policy, and keeps a local receipt of every decision.
It is built by HOL and installs from PyPI as hol-guard. The core runtime is Apache-2.0 and works offline without an account.
The problem Guard solves
A coding agent can run commands, install dependencies, read files and call external tools in a single session. Most of that is ordinary work. The trouble is the small share that is not: an agent deleting your Documents folder, reading your saved cloud credentials, piping a .env file to an outside server, or pushing straight to your main branch. Those are the examples HOL shows on the HOL Guard page, and each one can come from a bad prompt, a prompt injection hidden in a file or web page, or a compromised package.
Native agent approvals help, but each agent has its own rules and its own settings. Guard puts one policy in front of all the agents on your machine and records what happened.
How HOL Guard works
Guard attaches to each supported agent in one or more of four ways, according to the harness support matrix:
- native hooks written into the agent's config, so Guard sees tool calls and prompts as they happen;
- managed MCP proxies that put Guard in front of local stdio MCP servers;
- a Guard-owned overlay, extension or plugin that the agent loads at runtime;
- a launcher shim that checks the agent's plugins, skills and MCP config before it starts.
When the agent tries an action, Guard's native Rust runtime evaluates it against your policy and returns a decision. Ordinary work goes through. A known threat is blocked. An ambiguous action pauses for your approval, which appears in the agent's own prompt when it has one, in Guard's local approval center, or in your terminal. Each decision is stored as a receipt in ~/.hol-guard on your machine.
What it checks
- Shell commands and file access: destructive operations, sensitive file reads, credential exposure and suspicious outbound commands.
- Package installs: supported package-manager operations, checked against supply-chain advisory data before installation.
- Plugins, skills and agent configuration: new or changed artifacts are inventoried and reviewed before launch.
- MCP servers and tools: server configuration plus tool calls through hooks and managed proxies.
- Prompts and tool results: supported events are screened for prompt injection and sensitive content.
Which agents it supports
Guard 3.x ships adapters for Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Antigravity, Grok, Hermes, Kimi Code, Pi, oh-my-pi, OpenClaw, OpenCode, ZCode and Devin, plus Paseo through the native providers it launches. Coverage is not identical across them. Codex, Claude Code and Cursor get hooks that can stop a tool call before it runs. Gemini CLI and Antigravity do not expose hooks, so Guard covers them with a launcher shim and a pre-launch scan. Check the matrix for your agent before you rely on a specific event.
Who HOL Guard is for
Guard is for anyone who lets an AI agent act on a real machine: solo developers using Claude Code, Codex or Cursor, people running several agents side by side, and teams that want one policy across a fleet. The local version is the whole product for an individual. Teams add Guard Cloud for shared policy, organization-wide history and dashboards, while enforcement still happens on each device.
Guard Local and Guard Cloud
Guard Local runs on the developer machine and keeps working offline. It handles blocking, approvals and the local decision trail. Guard Cloud is a separate, optional service. Per the pricing page:
- Free: local protection, approvals, receipts and local leaked-secret scanning on one machine, no account and no credit card.
- Solo, $4.99 a month: personal Cloud memory across two devices and GitHub leaked-secret monitoring for up to 5 repositories.
- Pro, $15 a month: longer history, instant alerts and full evidence.
- Team, $30 per seat a month: shared policy and team workflows.
If you enable Guard Cloud, sync stores redacted decision summaries, not your source code or secrets.
How to get started with HOL Guard
Guard needs Python 3.10 or newer. These steps come from the Guard get-started guide.
pipx install hol-guard
hol-guard inithol-guard init prints a plan and asks before each step: opening the local dashboard, installing Guard into the agents it detects, optionally pairing with Guard Cloud, and turning on desktop notifications for approval prompts. Then confirm the result:
hol-guard status
hol-guard doctorA few commands you will use day to day:
hol-guard approvalslists pending requests so you can approve or deny them.hol-guard receiptsshows the decision history.hol-guard command explainfollowed by a quoted command shows why Guard would pause it, without running it.hol-guard supply-chain scanchecks your workspace dependencies against advisory data.hol-guard updatemoves you to the latest release.
The latest stable release on the Guard page is v3.57.0, published October 25, 2026. Release notes live at hol.org/guard/releases.
What HOL Guard is not
Guard is not a sandbox. It does not isolate the agent's process; it decides whether specific supported actions run. It does not cover events an agent never exposes, which is why the support matrix lists what is blocked, reviewed, observed or not covered for each agent. And it is not a model guardrail that filters prompts and answers in the cloud. HOL's own comparison puts it this way: native approvals confirm single actions, static scanners inspect packages and MCP configs, sandboxes isolate processes, gateways centralize traffic, and Guard is the open-source local-runtime option for cross-agent policy and pre-execution review.
HOL Guard and the Plugin Scanner
The same repository ships a second tool, plugin-scanner, for people who publish plugins rather than run them. Guard protects agent activity on your machine. The scanner checks a plugin package in CI before it is released. See What is the HOL Plugin Scanner? and browse scanned listings at hol.org/plugins.
FAQ
Is HOL Guard free?
Yes. Local protection, approvals, receipts and local secret scanning are free on one machine with no account or credit card. Guard Cloud plans (Solo, Pro and Team) are optional and add sync, alerts and shared policy.
Is HOL Guard open source?
Yes. The Guard Local runtime is open source under Apache-2.0 in hashgraph-online/hol-guard. You can install, inspect and run it without a paid plan.
Does HOL Guard upload my code or secrets?
Not with Guard Local. It evaluates actions on your machine and works offline. If you turn on Guard Cloud, sync stores redacted decision summaries, not source code or secret values.
Which AI agents does HOL Guard work with?
Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Antigravity, Grok, Hermes, Kimi Code, Pi, oh-my-pi, OpenClaw, OpenCode, ZCode and Devin, with Paseo covered through its providers. How much Guard can block depends on the hooks each agent exposes.
Why did Guard pause my command?
Either your policy requires approval for that action, or a tool or artifact the agent uses has changed since Guard last saw it. Run hol-guard approvals to resolve it and hol-guard command explain to see which rule matched.
How is HOL Guard different from a sandbox?
A sandbox limits what a process can reach. Guard reviews individual actions, such as a command, a package install or an MCP tool call, and decides whether each one runs. You can use both.
