Pre-execution interception
Blocks risky shell commands, secret reads, MCP registrations, and config changes before an AI agent executes them.
HOL Guard
HOL Guard is a local safety layer for AI coding agents that reviews risky actions before execution. Offline scanning, one-machine use, and Guard Cloud sync.
Overview
HOL Guard is a local protection layer for AI coding agents. It is designed to stop risky actions before they run, including shell commands, secret reads, MCP changes, and configuration edits.
The page positions Guard as a tool for people using agentic coding apps who want a review step before execution. It runs locally, supports offline operation, and can be used without an account on one machine. If a blocked action is actually needed, the user can review the diff and allow it from the same flow.
Core capabilities
Local-first scanning
Runs scanning locally on the machine instead of relying on a remote check before the harness starts.
Launch-time integration
Wraps the launch command for supported coding apps so protection is applied as the agent starts.
One-keystroke approval
Provides a local review flow where blocked actions can be approved with one keystroke after checking the diff.
Offline operation
Keeps the safety check usable offline; local scanning does not require a network connection.
Optional cloud receipt sync
Can sync decision receipts across machines when Guard Cloud is enabled, while keeping file contents, prompts, and environment variables out of sync.
Practical use cases
Review agent actions before they run
Use Guard when you want an AI coding assistant to pause before it runs a shell command, reads a secret file, or edits configuration. The tool acts as a local approval gate at execution time.
Protect offline development workflows
Use the local scanner in environments where network access is limited or unavailable. The page says scanning works offline and does not require a network connection.
Standardize protection across multiple agents
Use Guard with supported agents such as Cursor, Claude Code, Codex, OpenCode, Gemini CLI, Hermes, or OpenClaw when you want a consistent safety layer across different coding apps.
Handle false positives without breaking flow
Use the approval flow when an agent blocks something that is actually needed. The page says you can inspect the diff, allow the action, and keep a local decision history.
Keep decision history available on more than one machine
Use Guard Cloud if you want receipts synced across machines while keeping file contents, prompts, and environment variables out of the sync path.
Pros and Cons
Pros
- Works locally and does not require a network connection for scanning.
- Can be used without an account on one machine.
- Targets actions that happen before execution, including commands, secret reads, MCP registrations, and config changes.
- Supports several agents and coding apps, including Cursor, Claude Code, Codex, OpenCode, Gemini CLI, Hermes, and OpenClaw.
- Lets users approve a blocked action after reviewing the diff.
Cons
- The public page does not provide a full pricing table on the accessible content.
- Setup and integration details are shown in a short install flow, but the page does not expose a full documentation set in the collected text.
FAQ
Does HOL Guard work without an account?
Yes. The source says Guard is free forever on one machine with full local scanning, and it does not require sign-up, a credit card, or a cloud dependency for local protection.
Does Guard add latency?
Yes. The source says Guard adds less than 50 ms for a typical scan and runs locally on your machine before your harness starts, without making a network call.
What data leaves my machine?
By default, nothing leaves your machine. The source says Guard never reads file contents server-side. If you opt in to Guard Cloud, only decision receipts are synced, not file contents, prompts, or environment variables.
Which agents work today?
Guard currently supports Hermes, OpenClaw, Codex, Claude Code, Cursor, Gemini CLI, and OpenCode. The page says each app gets a tailored integration that wraps the launch command so Guard can scan before execution.
How do I uninstall Guard?
The source says Guard can be uninstalled by stopping the daemon and uninstalling the package with pipx. It also says Guard leaves no background services, though decision history remains on disk in ~/.hol-guard unless you delete that folder.
Quick Facts
- Category
- Developer Tool
- Primary use
- Review and block risky AI agent actions before execution
- Platform
- Local machine
- Supported agents
- Hermes, OpenClaw, Codex, Claude Code, Cursor, Gemini CLI, OpenCode
- Website
- hol.org
- Cloud mode
- Optional receipt sync via Guard Cloud
HOL Guard Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
Ghost
Ghost is a terminal-based AI assistant for chatting, code generation, and CLI tasks. Includes free models, supports Linux, macOS, Windows, and is open source.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
hob
hob is an independent workspace for coding agents, with local control over sessions, terminals, history, routing, and follow-up work.
SonOf
SonOf connects to your repo and PM tool, audits your codebase, and turns approved work into shipped tickets with senior engineering review.