HOL Guard acts as an antivirus for AI harnesses, intercepting tool actions to protect against file changes and network contact. It also includes `plugin-scanner`, a complementary tool for linting and verifying AI plugins and packages in CI environments before release, ensuring quality and security.

Is hol-guard open source?

Yes, licensed under NOASSERTION.

hol-guard

Active·★ 963·NOASSERTION·Updated 2026-10-22

★ Trending★ Hidden Gem

HOL Guard, from the Hashgraph Online organisation, is described in its README as antivirus for AI harnesses. It intercepts tool actions before they change your files or contact the network and decides whether to allow them. The repository ships two packages: hol-guard, which protects a local harness such as Codex, Claude Code, Copilot CLI, Hermes, Cursor, Gemini or OpenCode, and plugin-scanner, which lints and verifies plugins, skills, MCP servers and marketplace packages for maintainers and CI (for example `plugin-scanner verify .`, with a configurable minimum score).

The Guard flow is `pipx install hol-guard` and then `hol-guard init`, a guided setup that gates each side effect behind an approval checkpoint (local dashboard, harness discovery and install, optional Guard Cloud connection, desktop notifications). It records a baseline before you trust a tool, pauses on new or changed artifacts before launch, queues blocked changes in a localhost approval centre when the harness cannot prompt inline, and stores receipts locally. Harness-specific strategies are described, for example Claude hooks first for Claude Code. The README also covers supply-chain scans and an optional Cisco MCP and skill-scanner integration.

Privacy is addressed directly: advisory sync is optional and pull-only from advisories.hol.org, sends no local file paths, harness configs, receipts or workspace identifiers, and needs a free HOL Guard Cloud account, otherwise Guard uses its bundled advisory database. It requires Python 3.10 or newer, and the badges show Apache-2.0 and an OpenSSF Scorecard. GitHub does not detect the licence automatically in our data, so confirm it in the repository. The last push was 2026-10-15. This review is based on the README and repository data; we have not run it ourselves.

#AI Security#Plugin Scanner#LLM Guardrail#Supply Chain Security#Runtime Protection#Dev Tooling#CI/CD#Code Analysis

Features

01Intercepts tool actions and provides an approval center for blocked changes before execution.

02Offers configurable protection levels ranging from Gentle to Paranoid security.

03Scans and verifies AI plugins and packages for security vulnerabilities and quality in CI/CD pipelines.

04Leverages an optional advisory database for comprehensive threat detection and supply chain scanning.

Why choose it

+Checks agent tool actions before they run, with a baseline, change detection and a localhost approval centre

+Covers many harnesses: Codex, Claude Code, Copilot CLI, Hermes, Cursor, Gemini and OpenCode

+Guided `hol-guard init` gates each side effect behind an approval checkpoint; receipts are stored locally

+plugin-scanner adds CI checks for plugins, skills and MCP servers; advisory sync is optional and sends no local paths

Trade-offs

!GitHub does not detect a licence in our data (the README badge says Apache-2.0), so confirm the terms in the repository

!The README is very long and mixes Guard, the scanner, Cisco integrations and release notes

!Gating tools adds approval prompts to your workflow, and some harnesses cannot prompt inline

!Advisory sync and shared history need a HOL Guard Cloud account; without one it uses the bundled advisory database

Maintenance check

ActiveChecked: 2026-10-20

Last commit: 2026-10-20
Commits, last 90 days: 100+
Releases, last 90 days: 30
Latest release: v3.51.0 (2026-10-20)
Open issues: 101
Recent issues with at least one comment: 0/3

Status rule: archived on GitHub = Archived; last commit within 90 days = Active; 91 to 365 days = Slowing; older = Stale. All figures come from the GitHub API on the date shown.

Most discussed open issues

#3838 [bug] "Allow just this once" can never unblock an agent, "Allow every time" is unavailable for git/python, and the page never points to exte13 comments · 2026-10-09

Issue titles are quoted from GitHub. Open the link to check whether a problem still applies to the version you use.

Who it fits

Pick it if

You run Codex, Claude Code, Copilot CLI, Cursor or similar and want a check before new or changed tools run.
You maintain plugins, skills or MCP servers and want a CI step such as `plugin-scanner verify .`.
You want local receipts of what was approved or blocked.

Look elsewhere if

You need a clear licence in GitHub's metadata today; our data shows none detected.
You want a minimal tool: the README covers a large surface of commands and integrations.
You cannot accept extra approval prompts in your agent workflow.

Compatibility

Python

Runtime

Verified via docs

AI Code Assistants

Integrates with

Verified via docs

Docker

Deployment

Verified via docs

GitHub Actions

CI/CD

Verified via docs

Quick start

$ pipx install hol-guard

Use cases

↳Real-time protection for AI coding assistants and LLM-powered developer tools on local machines.

↳Establishing a CI/CD quality and security gate for AI plugins and marketplace packages before release.

↳Detecting and mitigating AI supply-chain risks, hardcoded secrets, and prompt injections in AI components.

↳Implementing strict security policies for high-security AI development environments and auditing decisions.

Alternatives

⚡Top VS:

VShackmyagent★83→VSagent-security-scanner-mcp★124→VSagentshield★21→VSai-security-tool★1.0k→

hackmyagent★ 83

Metasploit for AI agents: scan, attack, and fix AI agents and MCP servers. Open source security toolkit.

Features

Why choose it

Trade-offs

Maintenance check

Most discussed open issues

Who it fits

Compatibility

Quick start

Use cases

Alternatives

Comments

Features

Why choose it

Trade-offs

Maintenance check

Most discussed open issues

Who it fits

Compatibility

Quick start

Use cases

Alternatives

Comments