HOL Guard extension coverage directory

Command and MCP coverage with source, activation model, maintainer identity, and stated limitations for every entry — so a listing never reads like a security guarantee.

Install Guard Publisher Studio
How coverage is classified
Required protection
Part of Guard’s required safety floor. It runs whenever Guard runs and cannot be opted out per workspace.
Built-in coverage
Ships with the native Guard runtime and follows your existing Guard policy configuration.
Package firewall
Coverage is delegated to Guard package-firewall controls for installs, scripts, and dependencies.
External · opt-in
Off by default. Enable it deliberately through Guard controls; this directory never activates coverage.

Showing 30 of 215 coverage entries

Source checked live · f8b6a51306

Most reviewed coverage

  1. Container runtime protection64
  2. appimg34
  3. Amazon S3 command protection28
  4. agentsocks command protection20
  5. DataMan command protection18

Community contributions

  1. Aether-VaultCommunity
  2. agent-wireCommunity
  3. AgentBridge command protectionCommunity
  4. AgentHub MCPCommunity
  5. AgenticJobs command protectionCommunity

Community coverage, provenance recorded

Contributions marked “Community contribution” entered this directory through public pull requests with a recorded merge, digest, and source path. A verified publisher profile attributes the contributor; it is not an upstream endorsement or a HOL safety certification.

Browse contribution sources Claim a publisher page

Questions worth asking before you enable

No. Every entry documents source, activation model, maintainer identity, and stated limitations so you can evaluate coverage before enabling it. A listing is documentation, not a certification, and a maintainer profile is not an upstream endorsement.

The directory is generated from the canonical extension catalog in the hol-guard repository and checked on every page load. Each entry page links to the exact source tree it was reviewed at.

Enablement is managed through your workspace Guard policy, never from this directory. Built-in and required coverage run whenever Guard runs; external coverage waits for a deliberate opt-in through Guard controls. Setup starts at https://hol.org/guard/install

The action is stopped at Guard’s pre-action boundary before it executes, and the decision is recorded with evidence your workspace can review in decision memory. Exact behavior follows your Guard policy combined with the entry’s reviewed rules.

No. Guard is local-first: interception, decisions, and evidence stay on your machine unless your workspace explicitly enables cloud features. This directory is documentation only and never executes commands.

Community extensions are merged through public pull requests with recorded provenance. Open the Publisher Studio to claim a publisher page for a contribution you maintain.

Run Guard with the coverage you understand

Install the CLI, connect your agents, and review each entry’s limits here before it ever intercepts a command.

Install Guard Publisher Studio

Explore more of Guard