Command data protectionCommand
Detects shell flows that can send credentials or local file contents to a network destination.
By HOL Guard TeamBuilt-in coverageCore safetyProject maintained
HOL Guard extension coverage directory
Command and MCP coverage with source, activation model, maintainer identity, and stated limitations for every entry — so a listing never reads like a security guarantee.
How coverage is classified
- Required protection
- Part of Guard’s required safety floor. It runs whenever Guard runs and cannot be opted out per workspace.
- Built-in coverage
- Ships with the native Guard runtime and follows your existing Guard policy configuration.
- Package firewall
- Coverage is delegated to Guard package-firewall controls for installs, scripts, and dependencies.
- External · opt-in
- Off by default. Enable it deliberately through Guard controls; this directory never activates coverage.
- Container runtime protectionCommand
Reviews container lifecycle, cleanup, execution, network, and persistent-data operations that can expose credentials or mutate host state.
By HOL Guard TeamBuilt-in coverageCore safetyProject maintained - Encoded execution protectionCommand
Reviews decode-and-execute flows whose effective program is hidden from normal command inspection.
By HOL Guard TeamBuilt-in coverageCore safetyProject maintained - Filesystem protectionCommand
Reviews recursive deletion and access-control changes across filesystem trees.
By HOL Guard TeamRequired protectionCore safetyProject maintained - Git protectionCommand
Reviews everyday Git porcelain plus local and remote operations that can discard work, replace history, refresh a remote Guard cannot verify
By HOL Guard TeamRequired protectionCore safetyProject maintained - Guard self-protectionCommand
Prevents commands from authorizing their own Guard approval or weakening protected Guard state.
By HOL Guard TeamRequired protectionCore safetyProject maintained - Kubernetes secret protectionCommand
Reviews Kubernetes CLI operations that can reveal cluster or application secrets.
By HOL Guard TeamBuilt-in coverageCore safetyProject maintained - Shell, Git, and filesystem protectionCommand
Reviews destructive shell, Git, filesystem, redirection, and protected configuration mutations.
By HOL Guard TeamBuilt-in coverageCore safetyProject maintained - System protectionCommand
Reviews storage formatting and operating-system power-state mutations.
By HOL Guard TeamRequired protectionCore safetyProject maintained - Windows protectionCommand
Reviews destructive Windows storage and operating-system commands.
By HOL Guard TeamRequired protectionCore safetyProject maintained
Community coverage, provenance recorded
Contributions marked “Community contribution” entered this directory through public pull requests with a recorded merge, digest, and source path. A verified publisher profile attributes the contributor; it is not an upstream endorsement or a HOL safety certification.
Questions worth asking before you enable
Is a listing here a security guarantee?
No. Every entry documents source, activation model, maintainer identity, and stated limitations so you can evaluate coverage before enabling it. A listing is documentation, not a certification, and a maintainer profile is not an upstream endorsement.
How current is this directory?
The directory is generated from the canonical extension catalog in the hol-guard repository and checked on every page load. Each entry page links to the exact source tree it was reviewed at.
How do I contribute new coverage?
Community extensions are merged through public pull requests with recorded provenance. Open the Publisher Studio to claim a publisher page for a contribution you maintain.
Run Guard with the coverage you understand
Install the CLI, connect your agents, and review each entry’s limits here before it ever intercepts a command.