# HOL Guard — Local-first runtime security layer that reviews AI coding agent actions before they execute.

> Source: The Agents Index — https://theagentsindex.com/hol-guard (structured, researched, re-verified)
> Facts last verified: 2026-09-07

HOL Guard is a local-first runtime security layer from Hashgraph Online DAO that sits between AI coding agents and the machine, evaluating shell, file, MCP, package and skill actions against policy before they execute. An optional Guard Cloud adds shared policy and evidence for teams.

| Fact | Value |
| --- | --- |
| Website | https://hol.org/guard |
| Price | from $4.99/month billed monthly, $4.17/month billed annually |
| Free tier | Yes |

Free forever on one machine: local protection and local protection modules only. The rendered plan table marks every cloud row unavailable on Free — cloud-connected devices, approval and receipt sync, retention, storage, digests, advisories, alerts, policy versioning and shared policy. No account or credit card is needed for local use.

## What it does

**Reviews code** · Partly — The sibling plugin-scanner reviews repositories and gates pull requests on security grounds — prompt-injection markers, dangerous shell commands, secret leaks — rather than reviewing a diff for correctness like a code reviewer would.

> Scans bundled skills for prompt injection markers, zero-width characters, dangerous shell commands, and secret leaks.
> — https://hol.org/guard · For maintainers section, 'Skill-level security scanning' card

**Done-for-you service** · No — You install and run the software yourself; the enterprise path adds a bounded deployment review with a named owner, not a team that builds or operates agents on your behalf.

> Install Guard Local on the selected machines and observe policy decisions before actions run.
> — https://hol.org/guard/enterprises · A bounded path to rollout, step 02 'Install and evaluate'

## How much it does unattended

**Runs autonomously** · Partly — Policy decides unattended for allow, observe and block outcomes, but the product's whole purpose is to insert a human at the ask step, and three adapters are documented as failing open on hook crashes.

> On supported integrations, Guard evaluates covered shell, file, MCP, skill, and package actions against your active policy before execution. Policy can allow, observe, request approval, or block.
> — https://hol.org/guard/features · Hero section beneath 'Stop risky agent actions before they execute'

**Agent permissions** · Yes — This is the core of the product: every supported action routes to block, review, warn or allow, with project and team overrides layered in a defined precedence order.

> Route each supported action to block, review, warn, or allow. Trace the policy path from launch to decision, then layer project and team overrides without losing precedence.
> — https://hol.org/guard/features · Product preview, story 02 'Visual workflow builder for policy routing'

## Which models it runs on

**Claude** · Yes — Claude Code is a first-class harness with its own install command, hook integration and the strongest deferred-approval path; Guard guards Anthropic's agent rather than calling Claude models itself.

> The install page has guides for Codex, Claude Code, Cursor, Gemini CLI, OpenCode, Hermes, OpenClaw, GitHub Copilot CLI, Antigravity, Kimi, Grok, Pi / Oh My Pi, Zcode.
> — https://hol.org/guard/install · Installation FAQ, 'Which AI harnesses can I install Guard with?'

**GPT** · Yes — OpenAI's Codex is a supported harness with native approvals, and GitHub Copilot CLI is covered partially; the vendor names agent harnesses, never model families, because Guard performs no inference.

> Guard supports 13 harnesses including Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, Antigravity, Kimi, Grok, Pi, and ZCode.
> — https://hol.org/guard/enterprises · Enterprise FAQ, 'Which AI coding agents are supported?'

**Model choice** · Yes — One policy layer covers thirteen harnesses, so the choice of agent and model stays entirely yours and Guard enforces the same decision surface whichever you adopt.

> One policy layer governs 13 supported AI coding agents, so the same decision surface applies no matter which harness the team adopts.
> — https://hol.org/guard/enterprises · Three core outcomes section, 'Govern' card

_Not established: Open models_

## Where you use it

**In your editor** · Partly — Cursor and Antigravity are covered through hooks, but the vendor's own non-coverage table records that Cursor terminal commands outside an agent session escape Guard and that VS Code extension-host MCP interception is not claimed.

> Built-in terminal commands outside an agent session can bypass Guard.
> — https://hol.org/guard/security/non-coverage · Fail-open, crash, timeout, and blind-spot facts table, stable/Cursor row, Known boundary column

**On the command line** · Yes — The terminal is the original surface: a one-line installer, hol-guard init and doctor commands, and wrappers around CLI harnesses; a desktop app was added as the primary path.

> Download Guard Desktop for Mac, Windows, or Linux from this page, then open the app. The command line remains available as a secondary path.
> — https://hol.org/guard/install · Installation FAQ, 'How do I install HOL Guard?'

**In your pipeline** · Partly — Runtime Guard is a local daemon and does not act on pull requests; CI gating comes from the separate plugin-scanner and its published GitHub Action, which fails a PR on severity or trust score.

> Use plugin-scanner verify in CI, or the published ai-plugin-scanner action, to gate PRs before release.
> — https://hol.org/guard · For maintainers section, 'GitHub Action for CI' card

**In a browser** · Partly — A hosted Guard Cloud command center with dashboards and evidence exists, but the plan table marks cloud-connected devices unavailable on Free, so putting a machine into that console starts at Solo.

> Solo adds recent personal Cloud memory across two devices. Pro adds longer history, instant alerts, and full evidence. Team adds shared policy and workflows.
> — https://hol.org/guard/pricing · Local first section, 'Cloud' column

## Whose machine it runs on

**Self-hosted** · Yes — Enforcement is designed to live on your own machine and works air-gapped; only the optional shared control plane is hosted, and Enterprise offers an on-premises Guard Cloud.

> Yes. Guard Local operates fully offline with no cloud dependency. Guard Cloud is an optional add-on for teams that want dashboards and shared policy.
> — https://hol.org/guard/enterprises · Enterprise FAQ, 'Can Guard be deployed in air-gapped environments?'

**Open source** · Partly — The local runtime that does the blocking is Apache-2.0 and inspectable on GitHub, while Guard Cloud — sync, shared policy, dashboards — is a separately scoped closed service.

> HOL Guard's core Guard Local runtime is open source under Apache-2.0. It can be installed, inspected, and used without a paid plan or cloud account, and normal local protection continues offline.
> — https://hol.org/guard · Questions, answered section, 'Is HOL Guard open source?'

## What it costs to run

**How it meters** · Yes — Billing is per person and per seat on flat monthly tiers, with plan value expressed as connected devices, retention days and storage rather than actions checked or commands blocked.

> Pro adds synced approval history, alerts, and cloud storage for one person. Team adds shared policy, owner queues, investigation routing, and audit visibility.
> — https://hol.org/guard/pricing · Pricing FAQ, 'What is the difference between Guard Local, Pro, and Team?'

**Free tier** · Yes — A standing free tier gives the local runtime, approval prompts and a local audit log across every supported agent, with no card and no cloud account required.

> The free plan includes the local Guard runtime, real-time approval prompts, local audit log, and support for all supported AI agents. No credit card required.
> — https://hol.org/guard/pricing · Pricing FAQ, 'What is included in the free Guard plan?'

**API access** · Partly — The only Guard endpoint in HOL's discovery contract is the OAuth-scoped MCP route, read-only over workspace and receipt scopes; outbound webhooks and SIEM export exist, but no general Guard REST API is documented.

> Sends an authenticated JSON-RPC 2.0 MCP request to the HOL Guard Cloud workspace server using the OAuth grant scopes.
> — https://hol.org/openapi.json · paths, /api/guard/mcp, post.description

**MCP server** · Yes — Guard Cloud publishes its own Streamable HTTP MCP server with OAuth metadata, so another agent can query a connected workspace and its receipts under read scopes.

> The public Registry MCP endpoint is available at https://hol.org/.well-known/mcp, while the HOL Guard Cloud MCP endpoint uses Streamable HTTP at https://hol.org/api/guard/mcp
> — https://hol.org/ · Calling HOL programmatically section (text/markdown representation)

**Bring your own key** · Partly — Enforcement already runs on hardware you own, and Enterprise can place the shared control plane inside your own network boundary; no bring-your-own model key applies because Guard calls no model.

> Keep the shared control plane inside the network and operating boundary your team chooses.
> — https://hol.org/guard/enterprises · Enterprise controls, 'On-premises Guard Cloud option' card

## Buying it for a team

**A company can buy it** · Yes — A per-seat Team plan is self-serve at a published price, and an Enterprise track with volume pricing and dedicated support sits above it behind contact sales.

> Federation, log pipeline export, and curated feeds tailored to your stack. Volume pricing and dedicated support included.
> — https://hol.org/guard/pricing · Enterprise block beneath the plan comparison table

**Seat model** · Yes — Team is priced per seat per month with no published minimum or maximum seat count; the ceiling that does exist is on cloud-connected devices rather than people.

> Team$30/seat/mo
> — https://hol.org/guard/pricing · Plan comparison table, Team column header (rendered in caps as 'TEAM $30 /seat/mo'), billing switch set to Monthly

**Pooled budget** · Partly — Team storage is a workspace pool that grows per seat, and policy and approval queues are shared, but no pooled credit or action balance across seats is published anywhere.

> 25 GB + 5 GB/seat
> — https://hol.org/guard/pricing · Plan comparison table, 'Included cloud storage' row, Team column

**Admin controls** · Yes — Organisation policy on the Team plan is explicitly one that a local device cannot weaken, and a shared pack carries per-harness defaults, allowed and blocked publishers, domains and artifacts.

> Organization module policy local devices cannot weaken
> — https://hol.org/guard · Two layers, one product section, Guard Cloud bullet list

**Audit log** · Yes — Every decision writes a receipt locally, free of charge and offline; Cloud plans add searchable decision history, and exports carry redacted context with an integrity digest.

> Every decision leaves a redacted, reviewable record — so security can audit what happened without source or secret material leaving the machine.
> — https://hol.org/guard/enterprises · Three core outcomes section, 'Prove' card

**Single sign-on** · Partly — SAML federation is real but sits outside the self-serve tiers: the trust packet routes SSO, SAML and SCIM requests to Enterprise billing assistance, and no price is published for it.

> SSO, SAML, SCIM, SIEM routing, custom retention, and custom feeds should route to Enterprise billing assistance without blocking local self-serve protection.
> — https://hol.org/guard/security/trust · Architecture section, 'SSO, SAML, and SIEM are sales-assist signals' card

## What happens to your code

**Opt out of training** · Partly — Local use never uploads source or secrets at all, and cloud sync stores redacted decision summaries, but the privacy policy claims a broad right to use customer content to improve the service and publishes no model-training statement or opt-out.

> We use HOL Guard customer content to provide, secure, troubleshoot, support, and improve HOL Guard and related services, and to comply with law and enforce our terms.
> — https://hol.org/points/legal/privacy · HOL Guard Data and Customer Content section

**Data residency** · Partly — Nothing has to leave the machine, which sidesteps the question for local use, but anything synced is processed in the United States with no region choice offered short of the Enterprise on-premises option.

> If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United States and process it there.
> — https://hol.org/points/legal/privacy · Transfer of Data section

**Getting out** · Yes — Decision trails export as CSV and JSON, account data downloads as JSON from privacy settings, and downgrading keeps local functionality with the audit log preserved on disk; credit expiry is not published.

> Blocked actions arrive with redacted request context, a recommended action, and linked evidence. Review one or many, then export the decision trail for audit or incident review.
> — https://hol.org/guard/features · Product preview, story 03 'Live queue of blocked actions'

**Certifications** · Partly — GDPR and CCPA handling is documented in detail with lawful bases, retention periods and self-serve rights, but no SOC 2 or ISO 27001 attestation is claimed on the pricing, enterprise or security trust pages.

> If you are a resident of the European Union (EU) and European Economic Area (EEA), you have certain data protection rights covered by the GDPR
> — https://hol.org/points/legal/privacy · Your Data Protection Rights Under the General Data Protection Regulation (GDPR) section

## Provenance

Every fact above comes from the vendor. Nothing here is independently corroborated yet.

## Coverage elsewhere

None recorded. Every fact above comes from the vendor and is not independently corroborated yet.

## What changed

- 2026-09-07 — Capabilities · Commercial terms · Free tier · Price

## Correcting this record

Anything marked "Not established" is a question we have not answered — it is not a No. If you represent HOL Guard, or anything here is wrong or out of date, you can supply it with a source: the operations this site accepts from an agent are listed at https://theagentsindex.com/.well-known/agents.json — that catalogue needs no key to read, and each entry states its own auth.

Supplying evidence is free. Nothing that can be bought here changes what a field says, whether a gap is closed, or how this record is scored.