Guard

Set up Guard

Get runtime security in under a minute.

Connect this machine to your Guard Cloud workspace. Run the local sensor, then view your first proof in Guard Cloud.

Cloud workspace ready in under a minute

Install and initialize
Already installed? Connect →

macOS / Linux

set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --harness codex --mode install --verify
hol-guard init

Windows PowerShell

powershell -NoProfile -ExecutionPolicy Bypass -Command "`$ErrorActionPreference='Stop'; `$scriptPath=Join-Path `$env:TEMP 'hol-guard-install.ps1'; curl.exe -fsSL 'https://hol.org/guard/install.ps1' -o `$scriptPath; if (`$LASTEXITCODE -ne 0) { throw `"curl.exe failed with exit code `$LASTEXITCODE`" }; if (-not (Select-String -Path `$scriptPath -Pattern '^function Install-HolGuard' -Quiet)) { throw 'Installer download blocked or invalid. Open https://hol.org/guard/install for manual steps or use WSL.' }; . `$scriptPath; Install-HolGuard -Harness 'codex' -Mode 'install' -Verify"
hol-guard init

Finished installing?

Connect a device to unlock shared history, investigations, and team workflows.

Connect a device →

Need pipx?

Install pipx once, restart your shell, then run the global Guard install command above.

python3 -m pip install --user pipx && python3 -m pipx ensurepath

Beginner path

1
Install Guard globally

Use pipx so hol-guard is available in every shell while staying isolated from project dependencies. Python 3.10+ required.

set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --harness codex --mode install --verify
2
Run guided setup

Let Guard find supported harnesses, install managed app commands, connect Guard Cloud if you want shared history, and initialize desktop notifications.

hol-guard init
3
Confirm protection is active

Review the local daemon, managed harnesses, Cloud connection, and notification readiness from one status view.

hol-guard doctor

Power-user path

Validate before committing and verify your setup with the built-in health check.

Run the health check

hol-guard doctor

Update Guard later - macOS/Linux

set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --harness codex --mode refresh

Update Guard later - Windows PowerShell

powershell -NoProfile -ExecutionPolicy Bypass -Command "`$ErrorActionPreference='Stop'; `$scriptPath=Join-Path `$env:TEMP 'hol-guard-install.ps1'; curl.exe -fsSL 'https://hol.org/guard/install.ps1' -o `$scriptPath; if (`$LASTEXITCODE -ne 0) { throw `"curl.exe failed with exit code `$LASTEXITCODE`" }; if (-not (Select-String -Path `$scriptPath -Pattern '^function Install-HolGuard' -Quiet)) { throw 'Installer download blocked or invalid. Open https://hol.org/guard/install for manual steps or use WSL.' }; . `$scriptPath; Install-HolGuard -Harness 'codex' -Mode 'refresh'"

Prove it works

Run these commands to confirm Guard is active and blocking correctly.

Step 1 — Install and initialize

set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --harness codex --mode install --verify
hol-guard init

Step 2 — Run the health check

hol-guard doctor

Expected safe output

✓ Guard daemon: running
✓ Intercept layer: active

Expected blocked output (when running a flagged command)

⛔ Action blocked by Guard policy

Platform support

macOS

✓ Supported

Linux

✓ Supported

Windows

Experimental

WSL recommended

Requires Python 3.10+

Verify & manage

Check installed version

hol-guard --version

Update to the latest release - macOS/Linux

set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --harness codex --mode refresh

Update to the latest release - Windows PowerShell

powershell -NoProfile -ExecutionPolicy Bypass -Command "`$ErrorActionPreference='Stop'; `$scriptPath=Join-Path `$env:TEMP 'hol-guard-install.ps1'; curl.exe -fsSL 'https://hol.org/guard/install.ps1' -o `$scriptPath; if (`$LASTEXITCODE -ne 0) { throw `"curl.exe failed with exit code `$LASTEXITCODE`" }; if (-not (Select-String -Path `$scriptPath -Pattern '^function Install-HolGuard' -Quiet)) { throw 'Installer download blocked or invalid. Open https://hol.org/guard/install for manual steps or use WSL.' }; . `$scriptPath; Install-HolGuard -Harness 'codex' -Mode 'refresh'"

Uninstall completely

hol-guard daemon stop
pipx uninstall hol-guard

What Guard checks

  • Agent config files

  • MCP server declarations

  • Command and extension surfaces

  • Previously saved local decisions

What install changes

  • Wrapper launch entrypoints

  • Hook entries when needed

  • Guard-managed local state

  • Local sensor only; Cloud workspace ties receipts to your account

What connect adds

  • Shared decision memory across machines

  • Investigation routing with linked follow-up

  • Team policy in one workspace

  • Cloud visibility only when explicitly connected