HOL Guard
Local-first antivirus for AI agents that blocks risky commands, secret access, prompt injection, malicious packages, and MCP threats at runtime.
Open source alternative to:
HOL Guard is a local-first security layer for AI agents. It wraps coding agents and other agent harnesses — Codex, Claude Code, Cursor, Gemini CLI, OpenCode, GitHub Copilot CLI, and more — and evaluates what the agent is about to do before it runs: shell commands, file reads that touch secrets, package installs, MCP tool calls, and plugin or skill changes. Suspicious actions are blocked, ambiguous ones are paused for approval, and every decision is written to a local receipt log.
The tool covers several agent-specific attack surfaces. It flags credential and secret exposure, destructive commands, prompt injection in prompts and tool results, malicious or compromised packages, risky MCP server configuration, and newly added plugins and skills. A separate plugin-scanner CLI applies the same checks to plugin, skill, and MCP packages in CI, with SARIF output and a GitHub Action, while hol-guard abom exports an AI bill of materials of tracked agent artifacts.
Commercial AI agent security platforms such as Lasso Security, HiddenLayer, and SentinelOne's Prompt Security offer comparable runtime controls as paid, centrally managed services. Guard's core runtime is different: it is Apache-2.0 and runs entirely on the developer machine, without an account or network access. It installs with pipx install hol-guard, keeps working offline, and records receipts locally before any sync happens. The optional Guard Cloud adds synchronized history, team policies, fleet visibility, and shared approvals for organizations that want central control.
Categories:
Tags:
Frequently Asked Questions
Which AI agents does HOL Guard support?
HOL Guard supports Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Grok, Hermes, Kimi Code, Pi, oh-my-pi, OpenClaw, OpenCode, Antigravity, ZCode, and Devin. Coverage differs per agent because enforcement depends on the hooks and events each harness exposes. The project publishes a support matrix that documents enforcement, approval delivery, and failure behavior for each integration.
What are the system requirements for HOL Guard?
The standard install needs Python 3.10 or newer and pipx. The project also publishes a container image on GitHub Container Registry and ships updates through Homebrew. Guard Local runs on the developer machine and keeps working offline without a cloud account.
Does HOL Guard have a CLI and can it be automated?
Yes. Beyond init and status, the CLI includes diff, approvals, receipts, inventory, abom, and supply-chain scan commands, plus command test and command explain for inspecting a command without running it. The AI bill of materials exports as JSON, and the companion plugin-scanner writes text, JSON, Markdown, or SARIF reports for CI pipelines.
Does HOL Guard support teams and shared policy?
Guard Cloud is the optional team layer. It adds synchronized evidence, shared policies, fleet visibility, and shared approval workflows, while the local runtime keeps working without it. Organizations connect with the hol-guard connect command and retain local protection if the cloud service is unavailable.
Can I scan plugins and MCP servers before installing them?
Yes. The bundled plugin-scanner checks manifests, hardcoded secrets, MCP transport and command configuration, approval defaults, skills, lockfiles, and GitHub Actions permissions. It can run in CI through the ai-plugin-scanner-action GitHub Action with a minimum score and a fail-on-severity threshold, and it outputs SARIF for code scanning.
OpenAltFinder Score
Project Details
Repository details
Updated 10/19/2026, 12:00:23 PM
View Repository