Local-first harness protection
Stop risky MCP servers, skills, and plugins before they run.
Guard watches what Codex, Claude Code, Cursor, Gemini CLI, and OpenCode are about to use — then only interrupts when something is new or changed.
Install Guard locally
Start with one harness on one machine — no account required.
100% local by default
All scans, diffs, and receipts stay on your machine.
First-party canary fixtures
Guard ships with test scenarios that verify detection before you use it on real tools.
Receipts on your device
Every approval and block is recorded locally so you can audit decisions later.
Open source
Read the code. Verify the claims. Ship with confidence.
How it works
Three steps. One decision.
Guard scans before your harness launches, diffs against your last approval, and blocks when something is new or changed.
Detect
Scans every skill, package, and plugin your AI agent can reach. MCP servers, hooks, extensions, and command surfaces are mapped before anything runs.
Verify
Flags compromised MCP servers, tampered hooks, and suspicious permission changes. Guard diffs the current state against your last approval and surfaces exactly what changed.
Execute
Blocks malicious payloads before execution. Only approved, verified tools run. Your agent never touches anything you have not explicitly reviewed.
Supported harnesses
Choose your harness.
Codex
Put Guard in front of the Codex setup you already use.
hol-guard install codexClaude Code
Connect Guard to Claude Code without losing your existing workflow.
hol-guard install claude-codeCursor
Check Cursor MCP config first, then keep a stable local memory of approvals.
hol-guard install cursorGemini CLI
Check Gemini extensions and MCP declarations before first use.
hol-guard detect geminiOpenCode
Evaluate layered OpenCode config before it turns into a silent change path.
hol-guard detect opencodePrivacy
What stays on your machine.
Guard does not meter local safety features. Everything below works before you sign in anywhere.
Always local, always free
- Harness discovery and artifact snapshots
- Local diffs against your last approved state
- Local policy decisions and overrides
- Wrapper-mode launch enforcement
- Local receipts and explain output
- Works offline with no cloud dependency
Optional after sign-in
- Receipt sync to Guard Cloud
- Curated advisory and revocation feeds
- Cross-device trust memory
- Team policy packs and shared exceptions
- Longer signed cloud receipt history
- Billing and entitlements
Cloud features activate only after you run hol-guard login and hol-guard sync. They do not unlock the core safety workflow.
Interception
Threat vectors Guard defeats.
Intercepted signature mismatch in .cursor/mcp.json. Payload dropped.
Intercepted signature mismatch in .codex/config.toml. Payload dropped.
Intercepted signature mismatch in .claude/settings.local.json. Payload dropped.
Before vs. after
Your stack without Guard vs. with it.
Every row is a real risk developers face today. Guard addresses each one — locally, before your harness even launches.
Pricing
Simple, transparent access.
Local protection is free forever. Pay only when cloud sync and shared policy save your team real time.
Everything you need to protect one device locally.
Reduce repeat work across your own devices.
Share policy and alerts without building an internal security tool.
FAQ
Common questions.
Yes. Guard is free forever on a single device with full local scanning. No sign-up, no credit card, no cloud dependency. Paid plans add multi-device sync, curated advisories for repeated review work, and team policy distribution.
No. Guard is local-first by default. All scans, approvals, diffs, and receipts stay on your machine. Cloud features (sync, alerts, team policies) are opt-in and only activate after you explicitly sign in.
Guard currently supports Codex, Claude Code, Cursor, Gemini CLI, and OpenCode. Each harness gets a tailored integration that wraps the launch command so Guard can scan before execution.
Guard scans MCP server declarations, local hooks, extensions, command-line arguments, and config files across your harness environment. It diffs against your last approved state and flags any changes—including endpoint drift, permission escalation, and hook injection.
Antivirus scans files for known malware signatures. Guard is harness-aware—it focuses on MCP servers, hooks, extensions, and command surfaces specific to AI development environments, and it explains the approval and change-review risks those tools introduce in a way traditional antivirus usually does not.
Yes. The Team plan ($99/mo) adds shared policy packs, harness templates, exception ownership, team alerts, alert preferences, and pooled credits. Teams can share Guard policy and exception handling instead of rebuilding the same review flow on each machine.
Protect your next session.
No sign-up required. Free for local use. Install Guard and get to your first protected harness launch in under a minute.