# HOL Guard > HOL Guard is AI agent runtime security. It combines surface-specific pre-action policy controls with separate supply-chain inspection for packages, skills, plugins, and MCP configuration. Guard does not claim universal model-level prompt filtering or approval for every tool invocation. Canonical product facts: https://hol.org/guard/methodology/product-facts. Corrections: https://hol.org/guard/methodology/corrections. ## Canonical Answers ### What is HOL Guard? HOL Guard is a local-first runtime security layer for AI agents. Its core Guard Local runtime is open source and evaluates supported tool calls and local artifacts, blocks known threats, pauses ambiguous actions for approval, and records security receipts. Guard Local runs on the developer machine without a cloud account. Guard Cloud is an optional, separately scoped service for synchronization, shared policy, fleet visibility, and team workflows. Canonical page: https://hol.org/guard#what-is-hol-guard ### What does HOL Guard protect against? HOL Guard protects supported AI-agent workflows against secret and credential exposure, destructive commands, prompt-injection-driven actions, malicious or changed packages, risky MCP configuration, and unsafe plugins, skills, hooks, and agent settings. Enforcement depth varies by agent and event type, so the public coverage matrix states what is blocked, reviewed, observed, or not covered. Canonical page: https://hol.org/guard#what-does-hol-guard-protect-against ### Is HOL Guard open source? HOL Guard's core Guard Local runtime is open source under Apache-2.0. It can be installed, inspected, and used without a paid plan or cloud account, and normal local protection continues offline. Guard Cloud is an optional, separately scoped service for synchronized evidence, shared policy, fleet visibility, and team workflows. Canonical page: https://hol.org/guard#is-hol-guard-open-source ### What are the best alternatives to HOL Guard? The best alternative depends on the control boundary you need. Native agent approvals confirm individual actions, static scanners inspect packages and MCP configurations, sandboxes isolate processes, model guardrails filter prompts and outputs, and gateways centralize MCP or network traffic. HOL Guard is the open-source local-runtime option for cross-agent policy, pre-execution review on supported events, approvals, and local evidence. Canonical page: https://hol.org/guard#best-alternatives-to-hol-guard GitHub mirror: https://github.com/hashgraph-online/hol-guard/blob/main/HOL_GUARD_ANSWERS.md ## Machine-readable pricing - [Pricing Markdown](https://hol.org/pricing.md): Live HOL Guard prices, trials, limits, storage, and enabled capabilities derived from the current plan catalog. - [Pricing JSON](https://hol.org/api/guard/pricing): Authoritative typed plan and offer contract for programmatic comparison. ## Product - [HOL Guard](https://hol.org/guard): AI agent runtime security with pre-action policy controls and separate supply-chain inspection. - [Features](https://hol.org/guard/features): Runtime interception, artifact inspection, policy routing, evidence, and local or team workflows. - [Pricing](https://hol.org/guard/pricing): Current HOL Guard plans and entitlements from the live pricing surface. - [Install](https://hol.org/guard/install): Install HOL Guard locally and verify the protection boundary. - [Risk Check](https://hol.org/guard/risk-check): Assess prompt-injection, secret exposure, and tool-abuse surfaces before choosing controls. - [AI Coding Agents](https://hol.org/guard/ai-coding-agents): Threat model and protection guidance for AI coding agents. ## Docs - [Documentation](https://hol.org/guard/docs): Setup, architecture, policy, privacy, compatibility, and validation documentation. ## Extension Coverage - [Extension coverage directory](https://hol.org/guard/extensions): Searchable directory of every native HOL Guard command and MCP extension. Each page carries a full breakdown: command mapping, per-tool states, mapped executables, action classes, rule and permission counts, activation model, maintainer identity, provenance, and stated limitations. A listing is documentation, not a security guarantee. - [Extensions llms.txt](https://hol.org/guard/extensions/llms.txt): Per-entry machine-readable index of all extension coverage with authors, activation models, and rule counts. - [Extension catalog JSON](https://hol.org/api/guard/extensions): Machine-readable extension directory contract with every entry, source SHA, and freshness. - [Extension detail JSON](https://hol.org/api/guard/extensions/command.api-gateway): Per-extension machine-readable record (replace the ID with any catalog ID). ## Security Intelligence - [Security Hub](https://hol.org/guard/security): Security intelligence center for advisories, warnings, CVEs, labs, and harness guidance. - [Advisories](https://hol.org/guard/security/advisories): Published advisories with affected versions, severity, sources, and remediation. - [Warnings](https://hol.org/guard/security/warnings): Active warnings for AI-agent and software supply-chain threats. - [Labs](https://hol.org/guard/security/labs): Reproducible security research and safe attack demonstrations. - [Harness Security Guides](https://hol.org/guard/security/harnesses): Harness-specific coverage and limitations. - [CVEs](https://hol.org/guard/security/cves): Active, non-withdrawn CVE records from the HOL Guard feed with risk, exploitation, source, and remediation context. - [MCP security](https://hol.org/guard/security/mcp): Owned hub for MCP plugin security: tool poisoning, permissions, and shadow servers. Local-first runtime control, not a cloud MCP gateway. A scan is not a safety guarantee. - [Prompt injection](https://hol.org/guard/security/prompt-injection): Owned hub for prompt injection in AI coding agents: untrusted text interpreted as instructions. Action-boundary controls, not a complete prompt-injection preventer. Direct, indirect, jailbreak, and tool-result injection are different instruction attacks. A scan is not a safety guarantee. - [Secret exfiltration](https://hol.org/guard/security/secret-exfiltration): Owned hub for secret exfiltration by AI coding agents: credentials exposed through a tool, command, log, model request, or external destination. Partial secret-file block at supported local action boundaries. Not a secrets manager. A scan is not a safety guarantee. - [Unsafe command execution](https://hol.org/guard/security/unsafe-command): Owned hub for unsafe command execution by AI coding agents: a mistaken, poisoned, or overbroad plan becoming a shell action with destructive or irreversible consequences. Partial coverage at supported local action boundaries. Complements rather than replaces EDR. A scan is not a safety guarantee. - [Supply chain security](https://hol.org/guard/security/supply-chain): Owned hub for coding-agent plugin supply-chain trust boundaries: packages, skills, MCP servers, plugins, config, instruction files, and remote dependencies. A scan is not a safety guarantee. Not a complete supply-chain security program. - [OWASP MCP Top 10 mapping](https://hol.org/guard/security/owasp-mcp-top-10): Honest detect, prevent, and gap mapping from HOL Guard and plugin-scanner to the OWASP MCP Top 10. Not a complete MCP security program. ## Research - [Research Hub](https://hol.org/guard/research): Reproducible AI coding-agent security research, datasets, and methods. - [Runtime Security Benchmark](https://hol.org/guard/research/ai-coding-agent-runtime-security-benchmark): Versioned cross-harness runtime-security benchmark with downloadable evidence. - [Benchmark Methodology](https://hol.org/guard/research/methodology): Scenario, comparator, metric, fixture, and limitation definitions. - [HOL plugin security dataset](https://huggingface.co/datasets/HashgraphOnline/hol-plugin-security): First-party catalog scores, modeled fixtures, and public advisories - [Plugin security explorer](https://huggingface.co/spaces/HashgraphOnline/hol-plugin-security): Static Space; same honest map ## Decision Guides - [Guides Hub](https://hol.org/guard/guides): Decision guides for selecting AI-agent security controls. - [What Is an AI Firewall? AI Agent Security Layers](https://hol.org/guard/guides/ai-agent-security-layers): Define an AI firewall, distinguish it from WAF and network firewall controls, and evaluate coverage, timing, failure behavior, evidence, and non-coverage. - [MCP Scanning vs Runtime Enforcement](https://hol.org/guard/guides/mcp-scanning-and-runtime-enforcement): Separate scan-time MCP analysis from pre-action runtime enforcement. - [Runtime Guardrails and Supply Chain Security](https://hol.org/guard/guides/runtime-guardrails-and-supply-chain-security): Use runtime and supply-chain controls as complementary boundaries. - [Protect Secrets from AI Coding Agents](https://hol.org/guard/guides/protect-secrets-from-ai-coding-agents): Reduce agent access to secrets with layered controls. - [Prompt Injection Protection](https://hol.org/guard/guides/prompt-injection-protection): Reduce prompt-injection impact at supported action boundaries. Not a complete preventer. Coverage is harness- and event-specific. A scan is not a safety guarantee. - [Secure MCP for AI Coding Agents](https://hol.org/guard/guides/secure-mcp-for-ai-coding-agents): Secure MCP configuration and runtime use across supported harnesses. ## Comparisons - [Comparisons Hub](https://hol.org/guard/compare): Evidence-based comparisons using identical criteria. - [AI Coding Agent Security Tools and Platforms](https://hol.org/guard/compare/ai-coding-agent-security-tools): Compare runtime policy, native agent controls, SAST, dependency controls, secrets, identity, endpoint, network, DLP, and monitoring on identical criteria. - [Runtime Guardrails vs Native Controls](https://hol.org/guard/compare/runtime-guardrails-vs-native-agent-controls): Compare external runtime guardrails with native harness controls. Complementary, not interchangeable. Coverage is harness- and event-specific. Benchmark fixtures are modeled. - [Runtime Guardrails vs Code and Dependency Scanners](https://hol.org/guard/compare/runtime-guardrails-vs-code-and-dependency-scanners): Category-level comparison of runtime guardrails, static code analysis, and dependency scanners. Complementary, not interchangeable. A scan is not a safety guarantee. - [Best AI Agent Security Platforms](https://hol.org/guard/compare/best-ai-agent-security-platforms): Compare runtime policy, MCP gateways, model or API guardrails, SCA scanners, and native harness controls on identical criteria. No universal platform. A scan is not a safety guarantee. ## Supported Harnesses - [Codex coverage](https://hol.org/guard/security/harnesses/codex): Supported stable coverage for shell, prompt, mcp_tool, file_read, tool_result. Limitations: Inline file edits applied directly by the model without a tool call are not visible to Guard. - [Claude Code coverage](https://hol.org/guard/security/harnesses/claude-code): Supported stable coverage for shell, prompt, mcp_tool, file_read, tool_result. Limitations: Background agent sessions that run without an active terminal do not surface hook events to Guard. - [OpenCode coverage](https://hol.org/guard/security/harnesses/opencode): Supported stable coverage for shell, mcp_tool. Limitations: Prompt content is not currently surfaced through hooks. File read/write events bypass Guard unless OpenCode permission rules block them. - [GitHub Copilot CLI coverage](https://hol.org/guard/security/harnesses/copilot): Partial stable coverage for shell, prompt. Limitations: MCP tool calls routed through the VS Code extension are not visible to the CLI-level Guard hook. - [Cursor coverage](https://hol.org/guard/security/harnesses/cursor): Supported stable coverage for shell, mcp_tool, file_read. Limitations: Shell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session. Prompt submission is not surfaced through native Cursor hooks. - [Cline coverage](https://hol.org/guard/security/harnesses/cline): Supported stable coverage for shell, prompt, mcp_tool, file_read, file_write, tool_result, network_request. Limitations: Native Cline PostToolUse hooks are observation-only; full output mediation requires the Guard-managed Cline plugin transport. JetBrains protection is reported as unverified until a live pre-tool deny proof is observed. - [Gemini CLI coverage](https://hol.org/guard/security/harnesses/gemini): Partial stable coverage for shell, mcp_tool. Limitations: Prompt submission events and file read/write operations are not currently observable through the Gemini hook surface. - [Hermes coverage](https://hol.org/guard/security/harnesses/hermes): Partial stable coverage for shell, mcp_tool, prompt. Limitations: Hermes desktop and ACP entry paths may not register shell hooks; CLI and gateway honor hooks.pre_tool_call. - [OpenClaw coverage](https://hol.org/guard/security/harnesses/openclaw): Partial stable coverage for mcp_tool. Limitations: Shell commands and prompt events are not currently observable. Guard only intercepts MCP tool calls via the proxy layer. - [Antigravity coverage](https://hol.org/guard/security/harnesses/antigravity): Partial stable coverage for mcp_tool, prompt. Limitations: Shell commands are not currently observable through the Antigravity hook surface; Guard intercepts extensions and MCP registrations via scan at launch time. - [Kimi Code coverage](https://hol.org/guard/security/harnesses/kimi): Supported stable coverage for shell, prompt. Limitations: Tool output post-processing and inline edits applied without a tool call are not visible to Guard. Hooks run in parallel, so separate requests may be reviewed concurrently. - [Grok Build coverage](https://hol.org/guard/security/harnesses/grok): Supported stable coverage for shell, prompt, mcp_tool, file_read, file_write. Limitations: Grok UserPromptSubmit hooks are observe-only, so prompt screening cannot block the model from seeing the prompt. Enforcement is the catch-all PreToolUse hook, including subagent and MCP tools. --always-approve and bypassPermissions weaken Grok's own prompt policy, but the Guard hook still returns a native deny when policy blocks a tool call. - [Pi coverage](https://hol.org/guard/security/harnesses/pi): Supported stable coverage for shell, prompt, mcp_tool, file_read, tool_result. Limitations: Package install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension. - [Oh My Pi coverage](https://hol.org/guard/security/harnesses/omp): Supported stable coverage for shell, prompt, mcp_tool, file_read, tool_result. Limitations: Package install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension. - [ZCode coverage](https://hol.org/guard/security/harnesses/zcode): Supported stable coverage for shell, prompt, mcp_tool, file_read. Limitations: Inline edits applied directly by the model without a tool call are not visible to Guard. Background sessions that run without an active terminal do not surface hook events. Stable contract: 3.0.1, verified 2026-09-09, expires 2026-10-09. Devin is not listed as supported because the pinned stable and 3.0 alpha contracts contain no Devin adapter. ## Additional Public Routes - [Affiliate program](https://hol.org/guard/affiliates): Public Guard education, pricing, docs, and harness pages. - [Public data API and MCP](https://hol.org/guard/developers/public-data): Read-only HOL Guard public facts, threat campaigns, coverage, policy guidance, benchmark data, and optional MCP access. - [Download HOL Guard Desktop](https://hol.org/guard/download): Download HOL Guard Desktop installers for macOS, Windows, and Linux. macOS is signed and notarized. Windows publisher signing is shown per release from attested Authenticode evidence, not from a GitHub URL. Local-first, with Guard Cloud optional. - [Guard for enterprises](https://hol.org/guard/enterprises): Public Guard education, pricing, docs, and harness pages. - [Brand campaigns](https://hol.org/guard/extension-studio/campaigns): Public Guard education, pricing, docs, and harness pages. - [Contribute coverage](https://hol.org/guard/extensions/contribute): Search the coverage catalog with a tool name, then claim a merged provenance contribution, improve project-maintained coverage, or build a reviewable contribution kit with the offline Extension Builder. - [Extension use cases](https://hol.org/guard/extensions/use-cases): Reviewed workflows that turn real HOL Guard catalog coverage into step-by-step guidance — reader job, when the workflow is the wrong fit, prerequisites, steps, expected result, limitations, and an evidence grade stating these are catalog-derived workflows, not independently benchmarked. - [Harness compatibility matrix](https://hol.org/guard/harnesses): Public Guard education, pricing, docs, and harness pages. - [Antigravity](https://hol.org/guard/harnesses/antigravity): Public Guard education, pricing, docs, and harness pages. - [Claude Code](https://hol.org/guard/harnesses/claude-code): Public Guard education, pricing, docs, and harness pages. - [Codex](https://hol.org/guard/harnesses/codex): Public Guard education, pricing, docs, and harness pages. - [GitHub Copilot CLI](https://hol.org/guard/harnesses/copilot): Public Guard education, pricing, docs, and harness pages. - [Cursor](https://hol.org/guard/harnesses/cursor): Public Guard education, pricing, docs, and harness pages. - [Gemini CLI](https://hol.org/guard/harnesses/gemini-cli): Public Guard education, pricing, docs, and harness pages. - [Grok Build](https://hol.org/guard/harnesses/grok): Public Guard education, pricing, docs, and harness pages. - [Hermes](https://hol.org/guard/harnesses/hermes): Public Guard education, pricing, docs, and harness pages. - [Kimi Code](https://hol.org/guard/harnesses/kimi): Public Guard education, pricing, docs, and harness pages. - [OpenClaw](https://hol.org/guard/harnesses/openclaw): Public Guard education, pricing, docs, and harness pages. - [OpenCode](https://hol.org/guard/harnesses/opencode): Public Guard education, pricing, docs, and harness pages. - [Pi / Oh My Pi](https://hol.org/guard/harnesses/pi): Public Guard education, pricing, docs, and harness pages. - [Z Code](https://hol.org/guard/harnesses/zcode): Public Guard education, pricing, docs, and harness pages. - [Hermes](https://hol.org/guard/hermes): Public Guard education, pricing, docs, and harness pages. - [Leak check](https://hol.org/guard/leak-check): Scan a public GitHub repository for likely leaked credentials without exposing secret values or exact locations in the public result. - [Aggregate telemetry](https://hol.org/guard/methodology/aggregate-telemetry): HOL Guard methodology and release gates for any future aggregate security-event telemetry publication. - [Corrections](https://hol.org/guard/methodology/corrections): Public corrections, retractions, researcher-attribution rules, and correction-resolution measurement for HOL Guard claims. - [Editorial policy](https://hol.org/guard/methodology/editorial-policy): HOL Guard publication rules for evidence, claim expiry, review, corrections, retractions, comparisons, and recurring integrity checks. - [Product fact methodology](https://hol.org/guard/methodology/product-facts): How HOL Guard verifies, scopes, expires, retracts, and publishes security capability claims. - [OpenClaw](https://hol.org/guard/openclaw): Public Guard education, pricing, docs, and harness pages. - [Research acknowledgements](https://hol.org/guard/research/acknowledgements): Public, consented acknowledgements for researchers and reporters who materially improve HOL Guard evidence and methodology. - [Canary Commons](https://hol.org/guard/research/canary-commons): Safe agent-security test corpus shared for reproducing HOL Guard benchmark scenarios. - [Independent validation program](https://hol.org/guard/research/independent-validation): Evidence rules and current status for independent review and replication of HOL Guard security research. - [Research programs and bounties](https://hol.org/guard/research/programs): Public rules, scope, neutrality commitments, reward terms, and conflict disclosures for HOL Guard correction, safe bypass, and replication programs. - [Quarterly live benchmark](https://hol.org/guard/research/quarterly-live-benchmark): Status and evidence requirements for HOL Guard quarterly live benchmark reporting. - [Threat campaigns](https://hol.org/guard/security/campaigns): Publication-gated HOL Guard threat intelligence for reviewed AI-agent campaigns, with sources, uncertainty, timeline, coverage, corrections, and downloadable artifacts. - [Community intelligence](https://hol.org/guard/security/community): Threat signal tied to the actual AI stack. - [MCP tool poisoning lab](https://hol.org/guard/security/labs/mcp-tool-poisoning): Threat signal tied to the actual AI stack. - [Prompt injection lab](https://hol.org/guard/security/labs/prompt-injection): Threat signal tied to the actual AI stack. - [Secret exfiltration lab](https://hol.org/guard/security/labs/secret-exfiltration): Threat signal tied to the actual AI stack. - [Supply chain lab](https://hol.org/guard/security/labs/supply-chain): Threat signal tied to the actual AI stack. - [Policy recipes](https://hol.org/guard/security/policies): Reviewed starting points for common HOL Guard policy decisions, with exact matchers, limitations, tests, and downloadable hashes. - [Monthly threat reports](https://hol.org/guard/security/reports): Monthly reviewed HOL Guard threat-campaign reports with sources, limitations, severity context, and corrections. - [Skill security](https://hol.org/guard/security/skills): Threat signal tied to the actual AI stack. - [Trust intelligence](https://hol.org/guard/security/trust): Threat signal tied to the actual AI stack. ## Feeds - [Guard Security RSS](https://hol.org/guard/security/rss.xml) - [Guard Security JSON Feed](https://hol.org/guard/security/feed.json) - [Guard Threat Campaign JSON Feed](https://hol.org/guard/security/campaigns/feed.json) - [Guard Threat Campaign Records](https://hol.org/guard/security/campaigns/data.json) - [Guard Advisory Records](https://hol.org/guard/security/advisories/{slug}/data.json) - [Guard Security Sitemap](https://hol.org/guard/security/sitemap.xml) - [Guard CVE Sitemap](https://hol.org/guard/security/cves/sitemap.xml) - [Guard Sitemap](https://hol.org/guard/sitemap.xml) ## Policies - [robots.txt](https://hol.org/robots.txt) ## Contact - Website: https://hol.org - GitHub: https://github.com/hashgraph-online - Twitter: https://twitter.com/hashgraphonline