HOL Guard CLI
HOL Guard checks an AI agent's shell commands, secret reads, MCP calls and package installs before they run and holds risky actions until you decide
- 971 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Writes its own hooks into Claude Code, Codex, Cursor and other agents' settings and puts package-manager shims on PATH
- A background process sees the full text of every command, file read and MCP call before it runs and keeps a log in ~/.hol-guard
- After hol-guard connect, decisions sync to Guard Cloud; remote commands to the device are a separate opt-in
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/hol-guardDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Writes its own hooks into Claude Code, Codex, Cursor and other agents' settings and puts package-manager shims on PATH
- A background process sees the full text of every command, file read and MCP call before it runs and keeps a log in ~/.hol-guard
- After hol-guard connect, decisions sync to Guard Cloud; remote commands to the device are a separate opt-in
This is third-party code. Review the repository files before installing.
What it does
HOL Guard installs as a PyPI package and sits between an AI agent and the operating system. The hol-guard init command finds installed agents, prints a plan and asks before each step: connecting an agent, opening the local dashboard, linking Guard Cloud. In Claude Code it adds PreToolUse and PermissionRequest hooks to .claude/settings.local.json, in Codex the same hooks go into .codex/config.toml, and in Cursor it hooks the moments before a shell command, an MCP call and a file read. Every intercepted action goes through a local policy. Guard looks for destructive commands, access to credential files, outbound data transfer and signs of prompt injection. It unwraps base64, hex or gzip payloads for inspection without executing them. The outcome is allow, warn, block or queue for approval. You can answer in the agent's own prompt where it has one, in the local approval center on 127.0.0.1 or with hol-guard approvals, and every decision lands in the hol-guard receipts log. Before a package install, Guard checks the version against advisories on vulnerable and malicious packages that hol-guard supply-chain sync downloads. When you launch an agent through Guard it records plugins, skills and MCP settings, and on the next launch it stops at any new or changed tool. The hol-guard command test and hol-guard command explain commands show how a command would be judged without running it.
Who it is for. For developers who let Claude Code, Codex, Cursor and other agents run commands and install dependencies on a work machine, and for teams that want shared rules and a shared decision log.
Good fit when
- Your agent runs without confirmations, and commands like rm -rf or git push to main have to stop before they run
- New npm or PyPI dependencies show up often, and you want each version checked before install
- The machine holds ~/.ssh, ~/.aws/credentials or .npmrc, and an agent reading them should need your consent
- You keep adding MCP servers, skills and plugins and want hol-guard diff to show what changed since the last launch
- An audit needs a JSON list of the machine's AI components: hol-guard abom --format json exports it
Not a fit when
- You use Copilot as a VS Code extension: Guard does not claim interception inside the editor and supports only Copilot CLI
- You need a network firewall or a gateway for all MCP traffic: Guard works with agent events on a single machine
- You maintain a plugin and want to check the package in CI before release: the same repository ships a separate plugin-scanner for that
- The machine has no Python 3.10 or newer and no pipx, and you cannot install them
Example request
Install HOL Guard, connect it to Claude Code in this project and check that rm -rf ./build comes to me for approvalLimitations
- The developer warns that a scan is not a safety guarantee. Guard reduces damage at supported checkpoints and is not a complete defense against prompt injection.
- Coverage depends on the events each agent exposes to hooks. In Claude Code, Guard does not intercept prompt submission, and in Kimi Code, Grok and ZCode an action passes unchecked if the hook crashes or times out.
- A hook that runs after a tool only records the violation; it cannot undo a command that already ran.
- The documentation promises full package protection for npm and PyPI. Cargo, Go, Maven, Gradle, Composer and RubyGems are in beta, and system package managers are monitored only.
- Guard Cloud is paid. Some local dashboard buttons, such as repair and protection removal, are for subscribers only; without a subscription the same actions run as CLI commands.
How to disable. hol-guard uninstall claude-code removes Guard from one agent, and hol-guard uninstall --all from every connected one. To remove it from the machine entirely, run hol-guard uninstall --self: it disconnects agents, removes package-manager shims and local state, then the package itself. With --dry-run any of these commands only shows what would change.
FAQ
How is HOL Guard different from npm audit or a linter?
npm audit and linters inspect code and dependencies ahead of time. Guard receives a specific agent action from a hook at call time, whether a command, a file read or an MCP call, and decides whether to let it through. The project also covers static checks: plugin-scanner does them for plugin maintainers.
How do I protect an AI agent from malicious packages?
Install the package-manager shim with hol-guard package-shims install --manager npm, and npm installs go through a Guard check before they run. hol-guard supply-chain explain minimist@1.2.5 --ecosystem npm shows the verdict for one version. hol-guard supply-chain scan checks all project dependencies at once.
What data goes to Guard Cloud?
None until you run hol-guard connect. After that, according to the developer, a short record of what was allowed and blocked is synced, without files, prompts or passwords. The Solo plan keeps 30 days of history for two devices; a third machine stays locally protected without sync. Remote commands from the cloud to a device are off by default.
Why did Guard stop a command, and how do I let it through?
Your policy requires approval for the action, or the tool the agent uses for it has changed. hol-guard command explain with the command text shows which rule matched. hol-guard approvals lists pending requests, and hol-guard approvals approve with the request id approves one.
How do I require a password for approvals?
Turn on the approval password with hol-guard settings approval-password enable. Allow decisions and settings changes then need the password, and with TOTP enabled they need a code from an authenticator app. After five failed attempts Guard locks that factor.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
A Claude Code hook that rates Bash command risk with rules and Haiku, asking for approval only on risky commands
A security scanner CLI for code and AI agents: vets .claude, hooks, MCP configs and SKILL.md before cloning and finds leaked keys
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
A guard for coding agents: blocks destructive Git and file system commands and attempts to read sensitive files before they run
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| HOL Guard (this entry) | yes | 971 | |
| CC Safety Net | no | 1,749 | a hook for Git and file system commands only, no package or MCP checks |
| Rafter CLI | no | 27 | secret scanner and pre-commit hook that vets skills before install |
| MCP Scanner | yes | 1,096 | Cisco's static MCP server scanner, does not intercept agent calls |
README in short
The repository's front page opens with a pipx install and a table of six protected areas, from shell commands to the decision log. Next come a list of 16 supported agents, a table of everyday commands and a section on plugin-scanner for plugin maintainers, with SARIF reports and a GitHub Actions step. The last big section explains how to add a rule for a new tool. Rules are written as declarative JSON, and a Rust compiler builds them into a catalog. Third-party rules stay off until the machine's administrator enables them.