HOL Guard
Local-first antivirus for AI agents that blocks risky commands, secret access, prompt injection, malicious packages, and MCP threats at runtime.
HOL Guard is a local-first security layer for AI agents. It wraps coding agents and other agent harnesses — Codex, Claude Code, Cursor, Gemini CLI, OpenCode, GitHub Copilot CLI, and more — and evaluates what the agent is about to do before it runs: shell commands, file reads that touch secrets, package installs, MCP tool calls, and plugin or skill changes. Suspicious actions are blocked, ambiguous ones are paused for approval, and every decision is written to a local receipt log.
The tool covers several agent-specific attack surfaces. It flags credential and secret exposure, destructive commands, prompt injection in prompts and tool results, malicious or compromised packages, risky MCP server configuration, and newly added plugins and skills. A separate plugin-scanner CLI applies the same checks to plugin, skill, and MCP packages in CI, with SARIF output and a GitHub Action, while hol-guard abom exports an AI bill of materials of tracked agent artifacts.
Commercial AI agent security platforms such as Lasso Security, HiddenLayer, and SentinelOne's Prompt Security offer comparable runtime controls as paid, centrally managed services. Guard's core runtime is different: it is Apache-2.0 and runs entirely on the developer machine, without an account or network access. It installs with pipx install hol-guard, keeps working offline, and records receipts locally before any sync happens. The optional Guard Cloud adds synchronized history, team policies, fleet visibility, and shared approvals for organizations that want central control.
