HOL Guard
Open source runtime security layer for AI coding agents
About HOL Guard
HOL Guard is a local-first security layer that sits between an AI coding agent and your machine. It evaluates the actions an agent is about to take, shell commands, file access, MCP calls, package installs, plugins and skills, and decides whether to allow them, block them, or pause and ask you. Every decision is recorded as an attributable receipt, so a run can be reviewed afterwards rather than taken on trust.
The reasoning behind it is worth stating, because it explains why this is not just another scanner. Code scanners run after files have already changed. Sandboxes constrain a process but have no idea what the agent intended. MCP gateways see MCP traffic and nothing else, missing local shell commands, package installs, hooks and agent configuration. HOL Guard combines those signals at the runtime boundary instead, which is the one place all of them are visible. It is Apache-2.0, published on PyPI, and runs entirely locally with no cloud account required. Guard Cloud is an optional paid service adding synchronised evidence, team policies and shared approvals; its tiers are named Solo and Pro but no prices are published, and the local client deliberately does not hardcode them.
Install with pipx and run the init command. It discovers which compatible agents you already have, explains every setup change before applying it, and walks you through a first protected action. From then on it hooks into whatever integration each agent exposes, preferring the deepest one available, and evaluates supported events against a single policy. Safe work proceeds untouched. Known threats are blocked. Genuinely ambiguous actions are routed to a native prompt or the local approval centre, which is the design decision that keeps it from turning ordinary work into a stream of confirmations.
- •Tool call interception - Screens shell, file, MCP, prompt and tool-result events through native hooks, managed proxies or reversible launch overlays.
- •Secret and credential detection - Flags sensitive file access, credential-shaped output, staged exfiltration and suspicious outbound commands.
- •AI supply chain review - Checks package installs, plugins, skills, MCP servers, hooks and agent configuration before trust is granted.
- •Prompt injection screening - For adapters exposing prompt events, inspects prompt and tool intent for instructions that try to expose secrets or evade controls.
- •Human approval routing - Sends only ambiguous actions for a decision, according to the active policy.
- •Security receipts - Records attributable evidence and inventory changes so decisions can be reviewed and explained later.
Aimed at developers who let coding agents run commands with real permissions, and at teams who need to show what an agent did rather than assert it was fine. It currently integrates with Codex, Claude Code, GitHub Copilot CLI, Cursor, Gemini CLI, OpenCode, Grok and others. Two honest caveats: enforcement depth varies by agent and event type, so check the support matrix for your specific setup rather than assuming uniform coverage, and the 3.x line is an opt-in alpha while 2.x remains the stable channel that normal installers select.
Pricing
$0 - $30/mo
- Free$0/mo
- Solo$4.99/mo
- Pro$15/mo
- Team$30/mo
- EnterpriseContact sales
From the vendor pricing page, 2026-09-16
