Guard

AI coding app quick start

OpenCode quick start

Evaluate layered OpenCode config before it turns into a silent change path.

Install GuardBack to install

Prerequisite

Install Guard

If you haven't installed Guard yet, run the install script first. This installs hol-guard via pipx and configures it for OpenCode in one step.

Terminal

set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --harness opencode --mode install --verify

Already have Guard installed? Skip to the harness command below. Full install guide.

Harness command

Attach to OpenCode

Terminal

hol-guard detect opencode

Guard stays local by default — no account required to protect your first session. Connect Guard Cloud later to sync security records across your devices.

What Guard checks

  • ~/.config/opencode/opencode.json
  • project opencode.json or opencode.jsonc
  • declared MCP and command surfaces

What install changes

  • Starts in wrapper mode first.
  • Treats config layering as part of the decision trail.

Verification

Confirm the setup before your first protected session.

1

Run the setup command

Start with the Guard command matched to this AI coding app and its setup mode.

Command

hol-guard detect opencode
2

Run the next verification commands

Confirm Guard sees the expected config paths before your first protected session.

Command

hol-guard doctor opencode
3

Check your first security record

After Guard records a local decision, open the receipt list to confirm what was scanned.

Command

hol-guard receipts

Safe demo & test protection

Use --dry-run for demos and CI. Guard scans and reports without blocking, so you can show what it catches without interrupting a live session.

Sync to Guard Cloud

Connect Guard Cloud to carry your security records, team memory, and approval history across every machine and teammate — no rebuilding approvals when you switch devices.

Review Guard Cloud plans →

Troubleshooting

Something not working?

  • Guard does not intercept launches

    Run hol-guard doctor opencode and check that the wrapper path matches your installed binary.

  • No security record after the first run

    Check that ~/.hol-guard/ is writable. Guard writes every decision there by default.

  • Cloud sync not reflecting local decisions

    Run hol-guard sync --status to see if Guard Cloud can reach the server. Local protection keeps running even when sync is unavailable.

Approval surface

Guard local approval center (browser, localhost) via wrapper mode — opens when a new or changed MCP server entry needs a decision.

Run command

hol-guard run opencode

Uninstall / revert

Guard leaves no background services. Your approval history stays on disk in ~/.hol-guard/ unless you delete that folder.

Uninstall command

hol-guard uninstall opencode

Current phase notes

  • OpenCode's native approval surface is not replaced — Guard adds a wrapper-level check before OpenCode launches.
  • Project and global config layers are evaluated together. Layering conflicts surface in the receipt trail.