# HOL Guard — Local-first runtime security layer that allows, asks or blocks risky AI coding-agent actions before they run.

> Source: The Agents Index — https://theagentsindex.com/hol-guard (structured, researched, re-verified)
> Facts last verified: 2026-09-29

HOL Guard is a local-first runtime security layer for AI coding agents that evaluates supported shell, file, MCP and package actions before they execute. An optional Guard Cloud service adds synced receipts, shared policy and team dashboards.

| Fact | Value |
| --- | --- |
| Website | https://hol.org/guard |
| Price | from $4.99/month billed monthly, $4.17/month billed annually |
| Free tier | Yes |

Free forever on one machine: local runtime, approval prompts, local audit log and all supported harnesses, with no credit card. Excludes cloud-connected devices, receipt sync, alerts, retention and shared policy. A separate free trial is offered on Pro.

## What it does

**Reviews code** · Partly — It does not review a human's diff, but the companion plugin-scanner inspects plugin and skill code in CI for maintainers.

> Scans bundled skills for prompt injection markers, zero-width characters, dangerous shell commands, and secret leaks.
> — https://hol.org/guard · For maintainers section, 'Skill-level security scanning' card

**Done-for-you service** · No — You install and run the software yourself; only an Enterprise security review is people-delivered, not an operated service.

> Download Guard Desktop, choose your AI harness, and connect Cloud later if you want shared history.
> — https://hol.org/guard/install · Install page hero, subheading under 'Get runtime security in under a minute.'

## How much it does unattended

**Runs autonomously** · Partly — Policy decides allow or block automatically on covered events, but ambiguous actions are deliberately paused for a human approval.

> evaluates supported tool calls and local artifacts, blocks known threats, pauses ambiguous actions for approval, and records security receipts
> — https://hol.org/guard/pricing · Pricing FAQ / site FAQ answer 'What is HOL Guard?'

**Agent permissions** · Yes — This is the product's core job: a pre-action checkpoint with allow, ask or block outcomes on supported events.

> Guard gives you a checkpoint before risky actions on supported integrations. It can allow, ask, or block before a covered action runs, and it records activity so you can review what happened later.
> — https://hol.org/guard · 'How Guard protects you' section, body paragraph

## Which models it runs on

**Claude** · Yes — Claude Code is a stable supported harness with native approval, browser fallback and resume, though prompt events are not surfaced.

> Prompt events and background agent sessions that run without an active terminal do not surface hook events to Guard.
> — https://hol.org/guard/security/coverage · Coverage matrix, stable 3.0.1 Claude Code row, Limitations cell

**GPT** · Yes — OpenAI's Codex harness is listed as supported on the stable channel across shell, prompt, MCP, file-read and tool-result events.

> Inline file edits applied directly by the model without a tool call are not visible to Guard.
> — https://hol.org/guard/security/coverage · Coverage matrix, stable 3.0.1 Codex row, Limitations cell

**Model choice** · Yes — Guard sits in front of whichever harness and model you already use, applying one cross-agent policy rather than choosing a model.

> HOL Guard is the open-source local-runtime option for cross-agent policy, pre-execution review on supported events, approvals, and local evidence.
> — https://hol.org/guard · FAQ answer 'What are the best alternatives to HOL Guard?'

_Not established: Open models_

## Where you use it

**In your editor** · Yes — Cursor and Cline are supported harnesses, though Cursor's built-in terminal escapes Guard unless it runs inside an agent session.

> Shell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session.
> — https://hol.org/guard/security/coverage · Coverage matrix, stable 3.0.1 Cursor row, Limitations cell

**On the command line** · Yes — A Python CLI installs, initialises and health-checks Guard, and remains the documented alternative to the desktop app.

> Guard detects your harnesses, installs managed commands, and sets up notifications. `$ hol-guard init`
> — https://hol.org/guard/install · 'From download to protected in three steps', step 2

**In your pipeline** · Partly — Runtime Guard is local only; CI gating comes from the separate plugin-scanner GitHub Action for maintainers, not the runtime layer.

> Use plugin-scanner verify in CI, or the published ai-plugin-scanner action, to gate PRs before release.
> — https://hol.org/guard · For maintainers section, 'GitHub Action for CI' card

**In a browser** · Partly — A hosted Guard Cloud console exists for dashboards and history, but it requires a paid plan and adds no enforcement.

> Adds shared policy, org-wide telemetry, and team dashboards on top of the local enforcement layer. Cloud connectivity is for visibility and coordination, not for enforcement.
> — https://hol.org/guard · 'Guard Local vs Guard Cloud' section, Guard Cloud card

## Whose machine it runs on

**Self-hosted** · Partly — Enforcement already runs entirely on your own machine, but a self-hosted or VPC control plane is only an Enterprise review item.

> This packet does not claim a supported self-hosted or VPC control plane. Confirm deployment prerequisites, ownership, and evidence paths during review.
> — https://hol.org/guard/security/trust · Architecture section, 'Self-hosted and VPC scope remains under review' card

**Open source** · Partly — The Guard Local runtime is Apache-2.0 and inspectable, while Guard Cloud is a separately scoped proprietary service.

> HOL Guard's core Guard Local runtime is open source under Apache-2.0. It can be installed, inspected, and used without a paid plan or cloud account
> — https://hol.org/guard · FAQ answer 'Is HOL Guard open source?'

## What it costs to run

**How it meters** · Yes — Paid plans are flat per-month subscriptions, with Team charged per seat and each tier capping connected devices and storage.

> Free$0forever | Solo$4.99/mo | Pro$15/mo | Team$30/seat/mo
> — https://hol.org/guard/pricing · Plan comparison table, header row

**Free tier** · Yes — A permanent free tier covers the whole local runtime with no account, no card and no sales call required.

> The free plan includes the local Guard runtime, real-time approval prompts, local audit log, and support for all supported AI agents. No credit card required.
> — https://hol.org/guard/pricing · Pricing FAQ, 'What is included in the free Guard plan?'

**API access** · Partly — Outbound webhooks with HMAC verification are documented for alert routing, but no public Guard REST API is published.

> Webhook Configure webhook endpoints, verify HMAC signatures, and handle retry logic.
> — https://hol.org/guard/docs · Docs hub, Integrations section, Webhook entry

**MCP server** · Yes — HOL publishes a Guard Cloud MCP endpoint over Streamable HTTP with OAuth metadata, so another agent can query it.

> the HOL Guard Cloud MCP endpoint uses Streamable HTTP at https://hol.org/api/guard/mcp and advertises OAuth metadata through the well-known resources above
> — https://hol.org/ · 'Calling HOL programmatically' section

**Bring your own key** · Partly — Enforcement already runs on hardware you own, and Enterprise can place the shared control plane inside your own network boundary; no bring-your-own model key applies because Guard calls no model.

> Keep the shared control plane inside the network and operating boundary your team chooses.
> — https://hol.org/guard/enterprises · Enterprise controls, 'On-premises Guard Cloud option' card

## Buying it for a team

**A company can buy it** · Yes — A Team plan with shared policy and an Enterprise contact-sales path are both published, so an organisation can buy directly.

> Team adds shared policy across multiple developers, fleet dashboards, and centralized approval workflows.
> — https://hol.org/guard/pricing · Pricing FAQ, 'What do Pro and Team plans add?'

**Seat model** · Yes — Only Team is priced per seat, at $30 per seat per month, and it ceilings cloud-connected devices at twenty-five.

> Cloud-connected devices |  | 2 | 5 | Up to 25
> — https://hol.org/guard/pricing · Plan comparison table, 'Cloud-connected devices' row

**Pooled budget** · Partly — Team storage pools a shared base plus a per-seat allowance, but no shared spend or credit balance is described.

> Included cloud storage |  | 1 GB | 5 GB | 25 GB + 5 GB/seat
> — https://hol.org/guard/pricing · Plan comparison table, 'Included cloud storage' row

**Admin controls** · Partly — Organisation policy that local devices cannot weaken is a Team-tier feature; free and Solo users govern only their own machine.

> Organization module policy local devices cannot weaken
> — https://hol.org/guard · 'Guard Local vs Guard Cloud' section, Guard Cloud bullet list

**Audit log** · Yes — A local audit log of approvals and changes ships free, while searchable cloud decision history is reserved for paid tiers.

> Local decision trail for approvals and changes
> — https://hol.org/guard · 'Guard Local vs Guard Cloud' section, Guard Local bullet list

**Single sign-on** · Partly — SAML federation is real but sits outside the self-serve tiers: the trust packet routes SSO, SAML and SCIM requests to Enterprise billing assistance, and no price is published for it.

> SSO, SAML, SCIM, SIEM routing, custom retention, and custom feeds should route to Enterprise billing assistance without blocking local self-serve protection.
> — https://hol.org/guard/security/trust · Architecture section, 'SSO, SAML, and SIEM are sales-assist signals' card

## What happens to your code

**Opt out of training** · Partly — The vendor states local evaluation uploads nothing and cloud sync carries only redacted summaries, but publishes no explicit model-training clause.

> No for Guard Local. It evaluates actions on the machine. If you enable Guard Cloud, sync stores redacted decision summaries, not your source code or secret material.
> — https://hol.org/guard/pricing · Pricing FAQ, 'Does Guard upload source code or secrets?'

**Data residency** · Partly — Nothing has to leave the machine, which sidesteps the question for local use, but anything synced is processed in the United States with no region choice offered short of the Enterprise on-premises option.

> If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United States and process it there.
> — https://hol.org/points/legal/privacy · Transfer of Data section

**Getting out** · Partly — Downgrading keeps local functionality and evidence export exists on Team, but no data-export format or credit-expiry terms are published.

> Plans can be changed or cancelled at any time. Downgrading from Pro or Team to the free tier retains local functionality; cloud features are disabled at the end of the billing period.
> — https://hol.org/guard/pricing · Pricing FAQ, 'Can I cancel or change my Guard plan?'

**Certifications** · Partly — GDPR and CCPA handling is documented in detail with lawful bases, retention periods and self-serve rights, but no SOC 2 or ISO 27001 attestation is claimed on the pricing, enterprise or security trust pages.

> If you are a resident of the European Union (EU) and European Economic Area (EEA), you have certain data protection rights covered by the GDPR
> — https://hol.org/points/legal/privacy · Your Data Protection Rights Under the General Data Protection Regulation (GDPR) section

## Provenance

Every fact above comes from the vendor. Nothing here is independently corroborated yet.

## Coverage elsewhere

None recorded. Every fact above comes from the vendor and is not independently corroborated yet.

## What changed

- 2026-09-29 — Capabilities · Commercial terms · Free tier
- 2026-09-07 — Capabilities · Commercial terms · Free tier · Price

## Correcting this record

Anything marked "Not established" is a question we have not answered — it is not a No. If you represent HOL Guard, or anything here is wrong or out of date, you can supply it with a source: the operations this site accepts from an agent are listed at https://theagentsindex.com/.well-known/agents.json — that catalogue needs no key to read, and each entry states its own auth.

Supplying evidence is free. Nothing that can be bought here changes what a field says, whether a gap is closed, or how this record is scored.