HOL Guard

HOL Guard is a local-first runtime firewall for AI coding agents. It intercepts tool calls (shell commands, secrets access, MCP calls, and package installs) before they execute, so risky actions are surfaced and can be approved or blocked instead of running silently on a developer machine. Apache-2.0. Maker: HOL. Free. Scan is not a safety guarantee.

Who it helps: developers and teams who run AI coding agents locally and want a checkpoint between an agent's intent and their real filesystem, shell, credentials, and package registries. Because HOL Guard runs locally and first, the interception happens on the developer's own machine rather than in a remote service.

Key features: interception of shell command execution; interception of secrets access; interception of MCP (Model Context Protocol) tool calls; interception of package installs. Each of these categories of tool call is checked before it executes, which is the core design goal of the product: pre-execution, not post-hoc logging.

Pricing: free. HOL Guard is released under the Apache-2.0 license, so it can be used and inspected openly, and there is no paid tier required to use the runtime firewall described here.

Use cases: reviewing what an autonomous coding agent is about to run in a shell; catching an unexpected package install pulled in by an agent during a task; keeping agent access to secrets visible; and putting a guard rail in front of MCP tool calls made by agents inside an editor or CLI workflow.

Important limitation, stated plainly: a scan is not a safety guarantee. HOL Guard is a firewall and an interception layer, not a promise that every unsafe action will be detected, and it is intended to be used alongside normal review practices rather than as a replacement for them.