HOL Guard

HOL Guard is an open-source runtime guard for AI coding agents such as Claude Code, Codex and Cursor. It checks risky actions before they run, then allows them, asks for approval or blocks them.

It belongs to the AI security category as an agent runtime control. Hashgraph Online (HOL) maintains it under Apache-2.0, and the core works locally without an account.

The HOL Guard local dashboard lists the connectors and extensions Guard watches on the device.

What is HOL Guard?

AI coding agents can run shell commands, read files, install packages and call MCP tools inside one session. HOL Guard puts a policy check in front of those actions.

Each check resolves to allow, review, warn or block. Guard saves the decision as a local receipt, which you can read back with hol-guard receipts.

It sits at the agent’s tool-call boundary on the developer machine. It connects through native agent hooks, launch wrappers (hol-guard run) and managed MCP proxies.

The repository was created in March 2026. On 25 October 2026 it had 988 stars and 211 forks, and PyPI listed 3.56.0 as the latest stable release.

The same repository also ships Plugin Scanner, a CLI that checks agent plugins, skills and MCP integrations before they are published.

I based this review on the project’s README, documentation, agent support matrix and pricing page, checked on 25 October 2026.

What are HOL Guard’s key features?

Command protection and extensions

Command matching runs on a catalog of extensions compiled by Rust from declarative JSON. Each extension owns one area, such as Git or Kubernetes secrets, and lists its rules, severity and default action.

The Git protection extension marks forced pushes, hard resets and branch deletions for review by default.

The extension directory groups its 137 entries by protection model:

You can check how Guard classifies a command without running it:

hol-guard command test 'rm -rf ./build'
hol-guard command explain 'git clean -ndx'

Neither command executes the input or creates an approval.

Cloud and infrastructure commands

Built-in extensions also cover cloud CLIs for AWS, Azure, Google Cloud and Kubernetes. They flag permanent deletions, such as removing an S3 bucket, before the agent runs them.

The All tools catalog shows each built-in command area and lets you adjust its patterns.

Secret and credential access

Guard reads prompt intent as a risk signal alongside direct file reads. The get-started guide lists the secret-bearing paths it watches, including ~/.ssh, ~/.aws/credentials, .npmrc and Docker auth config.

It also flags exfiltration-style intent. Upload, post, webhook and gist verbs, shell-wrapper expansion and attempts to bypass Guard all raise the review level.

Package firewall

Package-manager shims let Guard evaluate an install before it runs. Shims exist for 15 managers, including npm, pnpm, yarn, bun, pip, uv, poetry, cargo, go and mvn.

Enforcement depth differs by ecosystem, and Guard labels each one instead of implying blocking it cannot deliver:

The first project-local run through npx or bunx always needs review. Guard binds the approval to the manager path, executable, manifest and lockfile, so changing any of them triggers a new review.

MCP servers, prompts and Safe Decode

Guard inventories MCP servers from each agent’s config and reviews MCP tool calls through hooks and managed proxies. New or changed servers, plugins and skills are diffed against the last snapshot before launch.

Safe Decode unwraps bounded encoded layers in commands and prompt text. It redacts the decoded preview, records the detector version as evidence and never executes the decoded payload.

Approvals, receipts and evidence

Blocked actions go to the agent’s native approval prompt where one exists. Otherwise they land in a local approval center on 127.0.0.1, and macOS and Windows also get a desktop notification.

Remembered trust is gated. Saving a broad allow rule, clearing policy or changing settings can require a password or TOTP code, enforced in the daemon so the dashboard and CLI cannot skip it.

Plugin Scanner for CI

Plugin Scanner is a separate CLI for plugin authors. It checks manifests, hardcoded secrets, MCP transport settings, approval defaults, lockfiles and GitHub Actions permissions.

It detects Codex, Claude Code, DeepSeek Harness, Gemini CLI, Kimi Code and OpenCode package formats. Reports come in text, JSON, Markdown or SARIF, and optional Cisco integrations add skill and MCP analysis.

The project’s GitHub Action gates a plugin repository on score and severity:

name: Plugin security
on: [push, pull_request]

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: hashgraph-online/ai-plugin-scanner-action@fdb49f9d85321a2ced2933301b395dd3c1ce9c8f # v1.2.631
        with:
          plugin_dir: "."
          min_score: 80
          fail_on_severity: high

Which AI agents does HOL Guard support?

HOL Guard supports 16 agents. What it can enforce depends on the hook events each agent exposes, and the project’s support matrix lists those event surfaces per integration.

How much does HOL Guard cost?

Local protection is free under Apache-2.0 and is not metered. Guard Cloud is an optional paid layer for synced history, alerts and team policy, and HOL publishes its prices:

Annual billing gives two months free. Enterprise identity, log pipeline and self-hosted or VPC deployment go through a sales review.

If Cloud lapses or goes offline, local blocking, receipts and approvals keep working. A connected machine reports its Guard version, OS, protected AI tools, plugin and skill inventory and applied policy.

You can limit that report to version, protection state and policy status with hol-guard settings set fleet-posture off. Centrally managed installs cannot opt out.

HOL Guard vs mcp-audit

mcp-audit audits MCP configurations offline by default and can inspect live server tool definitions with --connect. It covers 8 client scopes and maps every finding to the OWASP MCP Top 10.

HOL Guard works at a different moment. Instead of auditing a config, it evaluates supported agent actions, such as shell commands, MCP calls and package installs, while the agent runs.

The two cover different layers, so running both is reasonable.

Pick mcp-audit if you need MCP configuration auditing with SARIF reports in CI. Pick HOL Guard if you need local enforcement of agent actions on developer machines.

HOL Guard vs Cisco DefenseClaw

Cisco DefenseClaw is Cisco AI Defense’s Apache-2.0 governance layer for AI coding agents and agentic runtimes. It combines a Python CLI, a Go gateway, connector hooks, scanners and observability exporters.

Its connectors cover agents including Claude Code, Codex, Cursor, Hermes and OpenClaw. The repository also documents a Splunk app for audit evidence.

DefenseClaw hooks fail closed by default. The exception is Cisco Secure Client deployments with no policy set, where hook delivery defaults to fail-open.

HOL Guard overlaps on agent hooks. Its distinct pieces are a package firewall with shims for 15 managers and a per-command extension catalog with 137 entries.

HOL’s Plugin Scanner can also call Cisco’s skill and MCP scanners as optional extras.

Pick DefenseClaw for Cisco-backed governance with a gateway and Splunk-ready audit evidence. Pick HOL Guard if package installs and destructive shell commands are your main exposure.

HOL Guard vs Runlayer

Runlayer is a commercial AI control plane built around a governed MCP gateway. It attaches identity-aware policy, OAuth checks, real-time security scans and audit logging to every tool call.

Its runtime monitoring can alert on and block agent sessions. Runlayer runs hosted or self-hosted in your own AWS account, with Terraform and Kubernetes deployment options.

HOL Guard is local-first and open source. It needs no gateway and keeps protecting when the cloud is unreachable, but its team governance features sit in paid Guard Cloud plans.

Pick Runlayer for a central, identity-aware gateway across many agents and company tools. Pick HOL Guard for free per-machine enforcement first and optional cloud sync later.

How do you get started with HOL Guard?

1. Install the CLI. HOL Guard needs Python 3.10 or newer and pipx.
2. Run the setup wizard. hol-guard init detects supported agents and asks before each change, including dashboard and agent hook installs.
3. Check coverage. hol-guard status shows what is protected, and hol-guard approvals lists anything waiting for a decision.

pipx install hol-guard
hol-guard init
hol-guard status

When should you use HOL Guard?

HOL Guard fits developers and small teams who give coding agents broad permissions, such as Codex in YOLO mode.

It matters most when agents install packages, use cloud CLIs or work in a home directory full of credentials.

It is a weak fit for protecting a production LLM application from prompt injection. That is a guardrail problem, covered by tools like Lakera or NeMo Guardrails .

It also does not replace an MCP gateway when compliance requires one central control point for every agent.

What are alternatives to HOL Guard?

• mcp-audit : an offline MCP config auditor with SARIF output. Use it to gate MCP configs in CI.
• Cisco DefenseClaw : open-source agent governance from Cisco AI Defense, with connector hooks, a Go gateway and audit export.
• Runlayer : a commercial AI control plane and MCP gateway that adds identity, policy and audit across many agents.
• Agentic Radar : scans agentic workflow code, graphs its agents and tools, and maps them to known vulnerabilities.

For the wider catalog grouped by sub-category, see the AI security tools hub .

What are HOL Guard’s limitations?

• Coverage varies by agent. OpenClaw exposes only MCP tool events, and Claude Code native prompt submission is not intercepted.
• Some hooks fail open. Kimi Code, Grok and ZCode keep working without Guard if its hook crashes or times out.
• Post-execution hooks cannot undo. A PostToolUse event reports a policy violation but cannot reverse a tool that already ran.
• Package blocking is uneven. Only npm and PyPI have Protected status. Six other ecosystems are in Beta.
• The project is young and moves fast. The repository dates from March 2026 and PyPI lists 228 published versions, so expect frequent upgrades.
• Cloud sync shares inventory. A connected machine reports its tools, plugins and policy to Guard Cloud unless you limit fleet posture.

Frequently Asked Questions