HOL Guard

What HOL Guard MCP server does

HOL Guard MCP server adds a local security layer around AI-agent activity. It reviews shell commands, file access, package installation operations, MCP server configuration, MCP tool calls, prompts, and tool results where the connected agent exposes the necessary events.

The system looks for secret exposure, destructive behavior, suspicious outbound commands, prompt injection, and supply-chain risks. Based on policy, a reviewed action can be allowed, blocked, or held for approval. Local receipts preserve decision history for later inspection.

This places the project in the Security category for teams that need controls around agent execution rather than only static code analysis. The repository also includes a separate plugin-scanner command-line tool for checking agent plugins, skills, and MCP integrations before publication.

How it works

HOL Guard connects to supported agents through native hooks, managed MCP proxies, and launch integrations. Coverage depends on which events each agent makes available, so enforcement, approval delivery, and failure behavior vary by integration.

The stdio MCP server works alongside the local HOL Guard installation. The CLI can show protection status, diagnose an integration, inspect changes before launch, list tracked artifacts, display pending approvals, and read recorded decisions. A local dashboard provides another place to manage protection and resolve approvals.

For command analysis, hol-guard command test and hol-guard command explain classify commands and show matching rules without executing them or creating an approval. Supply-chain commands can synchronize intelligence, scan workspace dependencies, and explain a package verdict with its available advisory evidence.

Setup and configuration

HOL Guard requires Python 3.10 or newer and pipx. Install it with:

pipx install hol-guard
hol-guard init

The first-run wizard discovers supported agents and asks before making setup changes, including opening the dashboard, installing agent integrations, or connecting optional cloud services. Use hol-guard status to check the installation and hol-guard update to update it.

Codex can be installed explicitly with hol-guard install codex, then tested with hol-guard run codex --dry-run before a normal hol-guard run codex launch. The dry run records the current artifact state.

Tools and capabilities

HOL Guard MCP server supports workflows for:

• Reviewing commands, file access, package installs, and MCP tool calls.
• Routing pending decisions to native prompts or the approval center.
• Approving or denying requests by request ID.
• Inspecting receipts, tracked artifacts, and agent configuration changes.
• Exporting an AI bill of materials as JSON.
• Scanning workspace dependencies for supply-chain concerns.

The separate plugin scanner provides scan, lint, verify, submit, and doctor commands for supported plugin and skill package formats.

Limitations and notes

Protection coverage is not uniform across agents; consult the project’s support matrix for integration-specific behavior.

HOL Guard MCP server runs locally without an account. Guard Cloud is optional and adds shared history, team policy, and fleet management. The available package verdict depends on advisory evidence and ecosystem coverage, and command coverage comes from the project’s catalog. External extension contributions require explicit opt-in, while required core protections remain enabled.