HOL Guard Review (2026): Pricing, Features & Honest Verdict

What is HOL Guard?

HOL Guard sits between your AI coding agent and your machine. Before the agent runs a shell command, reads a file, or installs a package, Guard evaluates the action against hundreds of security heuristics and either allows it, blocks it, or pauses for your approval. Think antivirus, except the thing it is watching is the agent you invited in yourself.

It is built by HOL, the Hashgraph Online consortium, which authors open standards on Hedera’s Consensus Service and has contributed more than twenty specifications through LF Decentralized Trust. Guard started as an internal tool. The team says they built it after watching their own agents try to bypass safeguards, reach for secrets, and send data they should never have touched. That origin story matters, because the detection rules read like someone who has actually been bitten wrote them rather than someone brainstorming threat categories in a doc. The repository sits at 417 GitHub stars and over 2,100 commits, and the project claims more than 400,000 downloads.

The timing is not an accident. Agent tooling in 2026 has normalised something that would have been unthinkable three years ago: a language model with a shell, running on the same laptop that holds your production SSH keys. The industry response so far has been per-tool approval prompts, which are better than nothing and worse than a policy. Guard is the first serious attempt at a layer that sits underneath all of them and applies the same rules regardless of which agent is asking.

What Are HOL Guard’s Key Features?

Six detection categories at the runtime boundary

Guard checks for secrets and credential exposure, prompt injection, unsafe shell and git and filesystem commands, malicious packages, risky MCP servers, and agent supply-chain problems in config files. The important word is “combines”. Most security tooling sees one slice: a package scanner watches npm, a secrets scanner watches commits. Guard evaluates all of it at the same local boundary under one policy, which is how it catches the chain where a prompt injection tells an agent to install a package that reads your .env and posts it somewhere.

Four policy modes you can actually live with

Gentle, Balanced, Strict, and Paranoid. Balanced is the default and is tuned to let ordinary work through, block clear threats, and ask you about ambiguous high-impact actions. Strict pulls in low-confidence signals, and Paranoid is for machines where a mistake is expensive. Decisions are local and deterministic, with evidence logged so you can see why something was flagged. The tiering is the difference between a tool you keep and a tool you disable in week two, and it is the single best design decision in the product.

Thirteen supported agent harnesses

Guard integrates directly with Codex, Claude Code, GitHub Copilot CLI, Cursor, Gemini CLI, Hermes, OpenClaw, OpenCode, Antigravity, Kimi Code, Grok, Pi, and ZCode. Running hol-guard bootstrap auto-detects what you have installed and wires up the protection. That coverage is wider than anything else in the category, and it means you are not picking your agent based on what your security tool supports.

Plugin scanner with a 147-point rubric

A companion tool called plugin-scanner grades packages, plugins, skills, MCP servers, and hooks across more than 147 quality and security metrics before you trust them. It covers manifest validation, security, operational hardening, and code quality, and returns a score and a letter grade. It also ships as a GitHub Action, so you can fail a build on fail_on_severity: high or a minimum score of 80. This is the piece that makes Guard useful to a team and not just an individual.

Receipts and a local approval centre

Every decision Guard makes is stored as a receipt with the evidence that triggered it. When something gets blocked you can read exactly which heuristic fired and on what input, which matters because the alternative is a security tool that says “no” and leaves you guessing. The approval centre collects the pending asks so you handle them in one place instead of being interrupted mid-task. This is also the debugging path when Guard gets it wrong: you can see the false positive, understand it, and adjust your mode rather than uninstalling in frustration.

How Much Does HOL Guard Cost?

HOL Guard is free and Apache 2.0 licensed. Install it with pipx install hol-guard then hol-guard init. Everything that protects your machine runs locally with no cloud account: all runtime protection, the approval centre, receipt storage, and the bundled advisory database.

There is an optional Guard Cloud tier for synchronised evidence, team policies, fleet visibility, and shared approval workflows. HOL has not published pricing for it, which is our main complaint about the commercial side. You are adopting a tool whose team features have an unknown future price. For comparison, Snyk Team starts around $25 per developer per month and enterprise AI-security platforms routinely quote five figures a year. Even if Guard Cloud lands in that range, the free local tier already does the thing most individual developers need.

Who is HOL Guard Best For?

Use HOL Guard if you run coding agents on a machine that has production credentials, SSH keys, or a .env file with anything real in it. That is most working developers in 2026. The install is two commands and the Balanced default will not fight you.

Use HOL Guard if you have ever let an agent run unattended. The category of failure it is built for is not the agent being malicious, it is the agent being confidently wrong at 2am with a shell it trusts. Guard’s unsafe-command detection covers shell, git, filesystem, and system operations, which is the exact surface where an unattended run turns expensive.

Use HOL Guard if your team installs MCP servers and agent plugins from places other than a vetted internal registry. The plugin scanner and its GitHub Action are the cheapest supply-chain control you will find, and wiring the action into CI takes about five minutes.

Skip HOL Guard if you only use agents inside a throwaway container or a Codespace with no secrets attached, because the blast radius you are protecting is already near zero and you will just be adding prompts. Skip it if your stack is Python-hostile, since it needs Python 3.10 or newer via pipx. And be honest about the failure mode: this is heuristic detection, not a proof. Strict and Paranoid modes will produce false positives, and a determined prompt injection may still find a path Guard has not seen. Treat it as a seatbelt, not a locked door.

Best HOL Guard Alternatives

LlamaFirewall

Meta’s open-source guardrail system for AI agents, free under its own licence. It is stronger on model-level guardrails and prompt-injection classification, and it is designed to be embedded in an agent framework you are building. Guard is stronger at the local developer machine boundary: shell commands, file reads, package installs. If you are shipping an agent product, LlamaFirewall. If you are running agents on your laptop, Guard.

Snyk

The mature option for supply chain and dependency scanning, with a free tier and Team plans from roughly $25 per developer per month. Snyk is better at vulnerability data depth and has years of enterprise reporting behind it. It does not watch what your agent does at runtime, so it covers maybe half the surface Guard does. Plenty of teams will end up running both.

Native agent permission prompts

Claude Code, Codex, and Cursor all ship their own approval prompts, and they are free with the tool. If your usage is light, this may be enough. The gap is that each one only sees its own actions, the policies do not follow you between agents, and none of them scan the plugins and MCP servers you install. Guard gives you one policy across all thirteen harnesses, which is the whole argument for a separate layer.

Final Verdict: Is HOL Guard Worth It?

Yes, and the decision is close to free. Two commands, a sensible default policy, and thirteen supported harnesses means the cost of trying HOL Guard is an afternoon at most. The design is right too: local, deterministic, logged, and tiered so you can dial the friction to something you will tolerate. Combining shell, filesystem, package, and config signals in one policy is the correct architecture for this problem, and nobody else is doing it as completely.

Two caveats keep this at 8 rather than 9. Guard Cloud pricing is unpublished, so teams adopting this for shared policies are signing up for an unknown number later. And heuristics are heuristics: this reduces your risk, it does not eliminate it, and anyone selling agent security as a solved problem is lying. Install it on Balanced today, put the plugin scanner in CI this week, and do not let it make you careless about what credentials sit on the machine in the first place.