Amplibee
What is HOL Guard?
HOL Guard is a security layer that sits next to your AI coding agent and asks you before the agent does something risky.
Coding agents can run shell commands, read secrets and install packages without a pause. Guard adds that pause for the actions that matter.
What does it protect?
It reviews agent actions before they run and routes risky ones to you for approval.
- Shell commands and file access, including destructive operations and credential exposure
- Package installs, checked against supply-chain intelligence
- MCP servers and tool calls
- Plugins, skills and agent configuration, with new or changed tools reviewed before launch
- Prompts and tool results, screened for prompt injection
Which agents does it support?
The project lists Claude Code, Codex, Cursor, GitHub Copilot CLI, Cline, Gemini CLI and several others.
Guard connects through native agent hooks, managed MCP proxies and launch integrations. Coverage depends on the events each agent exposes, and the project publishes a support matrix per integration.
How do I get started, and what are the limits?
Install it with pipx install hol-guard, then run hol-guard init. The first-run wizard finds supported agents and asks before each setup change.
It needs Python 3.10 or later. A scan is not a safety guarantee, so treat Guard as one control among others rather than a full defence.
Alternatives to HOL Guard
Most coding agents have their own permission settings, and some people run agents in a sandbox. HOL Guard adds one approval layer that works across several agents and also checks package installs and MCP calls.
- Built-in agent permissionsThe allow and deny settings and prompts that each coding agent ships with.
- Containers or dev environmentsRunning the agent inside an isolated container or virtual machine.
How HOL Guard compares
| Option | Best for | Trade-off |
|---|---|---|
| HOL Guard | Developers who use more than one coding agent and want one local approval layer | Coverage depends on the hooks each agent exposes, and it is not a guarantee of safety |
| Built-in agent permissions | A simple setup with no extra tool | They are configured separately in every agent and differ in what they cover |
| Containers or dev environments | Limiting the damage an agent can do to your main machine | More setup, and the agent may still reach what you mount or share into it |
HOL Guard is a fit when you let coding agents run commands and want to be asked before the risky ones. For strong isolation, use a sandbox as well, since Guard does not replace one.
Questions people ask about HOL Guard
What is HOL Guard?
A free, open-source tool that runs locally and asks you before AI coding agents run risky commands, read secrets, call MCP tools or install packages.
Is it free?
Yes. The local tool is free and open source under Apache-2.0. Guard Cloud is optional and aimed at teams.
Do I need an account?
No. You can run it locally without an account.
Which coding agents work with it?
Claude Code, Codex, Cursor, GitHub Copilot CLI, Cline, Gemini CLI and others in the project’s list.
How do I install it?
Run pipx install hol-guard and then hol-guard init.
Does it guarantee my machine is safe?
No. The maker states that a scan is not a safety guarantee, and coverage depends on what each agent exposes.
Can I review what it decided?
Yes. It records local receipts of decisions, and you can resolve approvals from the CLI or a local dashboard.
What are the alternatives to HOL Guard?
Built-in agent permission prompts and running agents in a container or sandbox are the usual options. They differ in how much they cover and how much setup they need.
