HOL Guard — Runtime Security Layer for AI Coding Agents

What is HOL Guard?

HOL Guard is a runtime security layer for AI agents. As coding agents such as Claude Code, Codex, Cursor, OpenCode, Copilot CLI, Kimi, and Grok take on more autonomous shell work, they gain the ability to run destructive commands, read credential files, install packages, or send data out — whether by mistake or through prompt injection. HOL Guard sits between the agent and those actions, intercepting tool calls and events before they execute and applying an allow, observe, ask, or block decision.

The project is published by HOL, which describes itself as a neutral consortium building agentic AI standards (the hashgraph-online organization on GitHub reports 5.6K+ stars and 2M+ PyPI downloads). The core runtime is Apache-2.0 open source; a companion service, Guard Cloud, adds shared policy and organizational telemetry and is proprietary.

How HOL Guard Works

Installation is a one-line curl script advertised at about 60 seconds. Once running, Guard reviews the tool calls and events of supported agents against your policy: clearly safe actions proceed, ambiguous ones pause for your approval, and dangerous ones are blocked. Live examples on the page include blocking an rm -rf of the Documents folder and blocking a read of ~/.aws/credentials. Every decision is recorded locally as what the project calls security receipts — an audit trail of what the agent tried to do and what Guard did about it.

Enforcement runs entirely locally — the site states your files never leave your machine — and works offline. Guard Cloud never performs enforcement; it carries shared policies, organization telemetry, and dashboards for teams. Beyond the runtime, the ecosystem includes a plugin-scanner for maintainers (CI trust scores, badges such as Scanner Clean and MCP Hardened, and scanning of bundled skills for prompt injection and secret leaks), MCP transport hardening, and a security hub publishing advisories on prompt injection, MCP tool poisoning, and supply-chain attacks.

Main Features

• Pre-action interception — reviews agent tool calls before execution with allow, observe, ask, or block outcomes.
• Local-first enforcement — all decisions run on-machine and offline, with a local audit trail of security receipts.
• Policy-based decisions — block destructive commands and secret access, pause ambiguous actions for human approval.
• plugin-scanner for maintainers — CI trust scores, release badges, and scanning of bundled skills for prompt injection and secret leakage.
• MCP hardening — transport hardening plus guidance on MCP tool poisoning via the security hub.
• Guard Cloud (optional) — shared policies, org telemetry, and dashboards for teams, with enforcement still local.

Pricing

HOL Guard uses a freemium model with four published tiers plus enterprise. Free costs $0. Solo costs $4.99 per month for 2 devices and 30-day history, with a 3-day trial. Pro costs $15 per month. Team costs $30 per month. Enterprise is gated behind sales contact. The core runtime is open source under Apache-2.0, so the enforcement layer itself can be inspected and self-managed; the paid tiers center on Guard Cloud capabilities such as shared policy and longer history.

Common Use Cases

• Protecting a personal dev machine — stopping an agent from rm -rf'ing directories or reading ~/.aws/credentials before it happens.
• Secret-exfiltration defense — intercepting attempts to send credentials or files to external endpoints.
• Team agent governance — Guard Cloud policies and dashboards for organizations standardizing agent behavior.
• Marketplace and plugin maintainers — gating releases with plugin-scanner trust scores and MCP Hardened badges.

Limitations

The page is explicit that enforcement coverage varies by agent and event type, with details deferred to a coverage matrix — so protection is only as complete as the integration for your particular agent and action types. Agents not in the supported list are not covered. Being a policy layer, it also introduces an approval workflow that teams must tune; ask-mode on every ambiguous action can become friction if policies are too coarse. Guard Cloud is proprietary and separate from the open-source core, and Enterprise pricing is not published. Finally, the project moves fast — the cited release, v3.44.0, was published October 14, 2026 — which signals active development but also means capabilities and pricing can shift quickly.

Summary

HOL Guard tackles a fresh, concrete problem: agents that can execute commands need a gate between intent and action. Its local-first design, open-source core, honest coverage caveats, and near-free individual pricing make it a low-risk addition to a developer workstation that already runs AI coding agents. Its weaknesses are those of any young security layer — uneven per-agent coverage, a fast-moving release line, and team features that depend on the proprietary cloud service. For developers delegating real shell work to agents, it is a sensible guardrail; for unsupported agents or non-CLI workflows, its value is unproven.