Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Documentation Overview
HOL Guard: Open-Source Antivirus for AI Agents
 | Stop risky AI actions before they compromise your machine. HOL Guard is a local-first security layer for AI agents, tools, plugins, skills, MCP servers, and package installs. Install HOL Guard Read the documentation PyPI Package ( hol-guard)Report an Issue |
|---|
HOL Guard brings antivirus-style runtime protection to AI agents. It evaluates supported agent actions and local artifacts for secret exposure, prompt injection, unsafe commands, malicious packages, and MCP risks. Guard can allow safe work, block known threats, pause ambiguous actions for approval, and record security receipts for later review.
Use HOL Guard locally without a cloud account. Connect Guard Cloud when you want synchronized evidence, team policies, fleet visibility, and shared approval workflows.
Install HOL Guard
hol-guard init discovers compatible AI agents, explains each setup change before applying it, and guides you through your first protected action.
Guard 3.x alphas are opt-in and do not replace the stable 2.x release selected by normal installers. To evaluate a published alpha, pin its exact version from the GitHub prereleases:
Return to the stable 2.x channel with pipx install --force "hol-guard<3".
Install guide · GuardPolicy v1alpha1 · Supported agents · Local vs. cloud · Security policy
What HOL Guard Protects
| Threat surface | Guard protection |
|---|---|
| Agent tool calls | Evaluates supported shell, file, MCP, prompt, and tool-result events through native hooks, managed proxies, or reversible launch overlays. |
| Secrets and credentials | Detects sensitive file access, credential-shaped output, staged exfiltration, and suspicious outbound commands. |
| AI supply chain | Reviews package installs, plugins, skills, MCP servers, hooks, and agent configuration before trust is granted. |
| Prompt injection | For adapters that expose prompt events, screens prompt and tool intent for instructions that attempt to expose secrets, evade controls, or trigger destructive behavior. |
| Human approval | Routes ambiguous actions to native prompts, the local approval center, or Guard Cloud according to the active policy. |
| Security evidence | Records attributable receipts and inventory changes so decisions can be reviewed, explained, and synchronized. |
Guard prefers the strongest integration each agent exposes. Enforcement depth varies by agent and event type; see the support matrix for the exact current contract.
Supported AI Agents
HOL Guard currently integrates with Codex, Claude Code, GitHub Copilot CLI, Cursor, Gemini CLI, Hermes, OpenClaw, OpenCode, Antigravity, Kimi Code, Grok, Pi / oh-my-pi, and ZCode.
These developer agents are Guard's deepest integrations today, but the product boundary is broader: the same policy, supply-chain, approval, and evidence layers are designed to protect AI agents and their local tool ecosystems as new adapters are added.
Why HOL Guard
Most security tools see only one part of an AI agent's attack surface. Code scanners run after files change. Sandboxes constrain a process but do not understand agent intent. MCP gateways see MCP traffic but not local shell commands, package installs, skills, hooks, or agent configuration.
HOL Guard combines those signals at the local runtime boundary. It discovers the agent and its tools, evaluates supported actions against one policy, requests human approval only when needed, and records the resulting decision. The goal is practical protection without turning ordinary AI-assisted work into a stream of prompts.
Choose the Right Package
| If you want to... | Install | Start with |
|---|---|---|
| protect AI agents and their local runtime | hol-guard | hol-guard init |
| lint and verify plugins, skills, MCP servers, and marketplace packages in CI | plugin-scanner | plugin-scanner verify . |
hol-guard is the end-user antivirus and runtime protection product. plugin-scanner is the maintainer and CI companion for analyzing agent ecosystem packages before release.
Guard Operations
To update an existing pipx install from PyPI:
If you installed Guard with pipx, verify the active user command before testing local flows:
For a local wheel build, install into the pipx-managed hol-guard environment. Do not test with PYTHONPATH=src; that bypasses the same package path users run.
hol-guard update --wheel accepts either a specific .whl file or a directory and picks the newest matching hol_guard-*.whl.
To force a specific release, use Python package specifier syntax:
Do not use hol-guard@<version>; pipx treats that as a separate app name, not a package version.
hol-guard init is the first-run guided setup. It shows a progressive plan first, then gates each side effect: approve dashboard, Guard completes it, then approve app protection, Guard completes it, then approve Cloud connect and notifications. Nothing opens or changes until you approve that checkpoint. Use hol-guard init --yes only for automation when you already trust the plan.
Manual and follow-up commands:
What you get from Guard:
- Detects supported AI agent configuration on your machine
- Records a baseline before you trust a tool
- Pauses cleanly on new or changed artifacts before launch
- Queues blocked changes in a localhost approval center when the harness cannot prompt inline
- Stores receipts locally so you can review decisions later
- Keeps sync optional until you actually want shared history
See docs/guard/get-started.md for the full local flow.
Inspect command protection without running it
Command safety extensions make Guard's shell, Git, filesystem, system, Windows, data-protection, container, Kubernetes, encoded-execution, and self-protection behavior inspectable. Required core extensions cannot be mistaken for optional integrations. They are built-in capability boundaries over the same parser used by harness hooks, not downloadable regex bundles.
Related MCP Servers
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about HOL Guard
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/hol-guard)HTML Embed
<a href="https://allmcps.com/mcp/hol-guard"><img src="https://allmcps.com/api/badge/hol-guard?style=directory" alt="HOL Guard on AllMCPs" /></a>Technical Specs & Signals
CategoryDeveloper Tools
28Quality signal: Emerging · 28/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership8/20
Documentation & tools12/30
Adoption & activity1/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.