A local antivirus layer for AI agents that touch your shell

What it does

HOL Guard is a local-first runtime security tool that wraps AI agents like Claude Code, Cursor, Codex, and Gemini CLI. It inspects agent tool calls, shell commands, file access, MCP server traffic, and package installs against a single policy, then allows safe actions, blocks known threats, or pauses ambiguous ones for human approval. Everything runs locally by default; an optional Guard Cloud tier adds team policies, fleet visibility, and synchronized evidence logs.

The interesting bit

Instead of sandboxing a process or scanning code after the fact, Guard hooks the agent’s own runtime boundary—using native harness integrations, managed proxies, or reversible launch overlays—so it can evaluate intent before a command executes. It also records attributable security receipts locally, turning “why did the agent delete that?” from a mystery into an auditable decision trail.

Key highlights

• Supports a wide roster of developer agents: Claude Code, Cursor, GitHub Copilot CLI, Codex, Gemini CLI, OpenClaw, OpenCode, and others.
• Covers multiple threat surfaces: secret exposure, prompt injection (where adapters expose prompt events), unsafe shell commands, malicious packages, and MCP server risks.
• Ships as two tools: hol-guard for end-user runtime protection and plugin-scanner for CI-side linting of plugins, skills, and marketplace packages.
• Includes side-effect-free command inspection with structured rule IDs and parse models, so automation can evaluate commands without executing them.
• Local approval center queues blocked changes when an agent harness cannot prompt inline.

Caveats

• Prompt injection screening is only available for adapters that expose prompt events; not all integrations get the same depth of visibility.
• Enforcement depth varies by agent and event type, so protection is not uniform across every supported harness.

Verdict

Developers who let AI agents run shell commands or install packages on their machines should look here; if your agent is strictly a chatbot that never touches the filesystem, you probably don’t need a guard.