Harness guide
Kimi security guide
Multimodal AI agent for coding and research tasks.
Beginner mode: HOL Guard pauses risky actions before they surprise you.
Expert mode: receipts, policy memory, and cloud review keep teams aligned.
Safe demo: learn with static traces before connecting live workflows.
Platforms and permissions
Kimi runs on macOS, Linux as a cli harness.
- Shell commands
- Scope: Pre-tool command review
- Guard role: Guard checks destructive writes, package installs, and subprocess intent before execution.
- Files
- Scope: Harness config and workspace files
- Guard role: Guard fingerprints config, hooks, skills, and changed artifacts that alter agent behavior.
- Network
- Scope: MCP endpoints and remote package sources
- Guard role: Guard flags new remote endpoints, staged downloads, and suspicious egress paths.
- MCP servers
- Scope: Tool servers and declared permissions
- Guard role: Guard compares MCP declarations and tool capabilities before the harness trusts them.
- Secrets
- Scope: Secret-looking reads and outputs
- Guard role: Guard blocks or pauses concrete secret exposure signals without labeling normal reads as leaks.
- Writes
- Scope: Local machine changes
- Guard role: Guard requires fresh review for material writes, new scripts, and changed install surfaces.
- Repo access
- Scope: Project-local agent files
- Guard role: Guard keeps repo-scoped overrides visible before they influence future agent sessions.
Verify and diagnose
Run these commands after connecting Kimi to confirm HOL Guard is active.
Test command
hol-guard apps test kimiStatus command
hol-guard doctor kimiWhat this app can do
- Read project context.
- Suggest or run commands.
- Call connected tools.
What can go wrong
- Hidden instructions can steer the agent.
- A tool can request private files.
- Build output can look like credentials.
What HOL Guard blocks
- Reads of secret-bearing files.
- High-risk shell commands before execution.
- New or changed tools that need review.
- Suspicious package, MCP, or skill behavior.
Known limits
- HOL Guard cannot inspect encrypted traffic before your harness decrypts it.
- HOL Guard cannot guarantee safety if you manually bypass a blocked action.
- HOL Guard works best when local receipts are connected to Guard Cloud.