What is HOL Guard?
HOL Guard is a security layer for AI agents that work on your computer, such as Claude Code, Codex, Cursor or GitHub Copilot CLI. It sits between the agent and the operating system and checks actions before they run: terminal commands, file access, package installs and MCP server calls. It is developed by Hashgraph Online (HOL), open source under the Apache-2.0 license, and has close to 900 stars on GitHub.
Coding agents already have their own permission systems, but each one handles them differently. HOL Guard applies the same rules to every installed agent and adds checks that are usually missing: exposed secrets, prompt injection in tool results, and vulnerable or malicious packages.
Main Features
- Command review: flags destructive operations, sensitive file access and suspicious outbound commands
- Package firewall: evaluates installs from npm, pip and other package managers before they happen
- MCP, plugin and skill checks: inventories the agent's tools and re-reviews new or changed ones
- Prompt injection defense: screens prompts and tool results for hidden instructions
- Approval center: asks for confirmation on doubtful actions and records every decision in a searchable history
- Broad agent support: Claude Code, Codex, Cursor, Cline, Gemini CLI, GitHub Copilot CLI, OpenClaw, Devin and more
How Does HOL Guard Work?
You install it from the terminal with pipx (Python 3.10 or newer) and run the setup wizard, which finds the agents on your machine and asks before every change. From then on HOL Guard hooks into the agents through their native hooks or an MCP proxy, and for each action decides whether to allow it, block it or ask for approval, according to your policy.
Everything runs locally, without an account, through a command line and a browser dashboard. The optional Guard Cloud service adds history shared across machines, alerts and, on team plans, shared policies and central management. The authors themselves warn that scanning is not a safety guarantee: it reduces risk, it does not remove it.
Who is HOL Guard for?
- Developers who use AI agents with terminal access
- Anyone installing third-party MCP servers, plugins and skills
- Teams that want the same security rules across every agent
- Security leads who need a record of what agents do
- Maintainers publishing plugins and MCP integrations
Use Cases
- Stopping an agent from deleting folders or running destructive commands without confirmation
- Blocking the install of a compromised npm package
- Noticing that an agent is reading API keys or .env files
- Checking a new MCP server before connecting it
- Exporting the list of AI tools used in a company for an audit
Pricing
HOL Guard running locally is free and open source, with no account. The optional Guard Cloud service starts with the Solo plan at $4.99 a month (2 devices and 30 days of history) after a 3-day trial; Pro and Team plans add more features for companies.
Pros and Cons
Pros:
- Open source, free and usable without an account
- One set of rules across many different agents
- Also covers packages, MCP and prompt injection
Cons:
- A technical, command-line-only tool
- Coverage depends on what each agent lets it intercept
- Not a safety guarantee, and false positives can happen
Final Verdict
HOL Guard is a sensible addition for anyone who lets AI agents work on their machine, especially with third-party MCP servers and packages. The free local version is enough for most developers; the Cloud is for people managing several machines or a team. Treat it as a second layer of protection, not a replacement for the agent's own permissions and common sense.