Open-source HOL Guard blocks risky actions by AI coding agents

The Hashgraph Online organization has released HOL Guard as open source software, designed to act as a guardian standing between an AI coding agent and the computer on which that agent runs. The program checks every command, file access, and external tool call before it actually happens, and if it detects a suspicious action, it pauses it and asks the user for confirmation.

The idea behind HOL Guard grew out of a specific problem facing development teams that use AI agents today. Tools like Claude Code and Cursor can independently run terminal commands, install packages, read configuration files, and connect to external services via the MCP protocol. That's convenient, but it also means a model error, a malicious package, or a hidden instruction injected into a prompt can lead to leaked secrets, deleted data, or a hijacked development environment.

How the program works

HOL Guard runs locally, with no need to set up a cloud account, and analyzes security signals at the intersection of the operating system and the AI agent. The program checks shell commands, manifests of packages being installed, MCP server configuration, and attempts to access environment variables and API keys before any of these operations are carried out.

The tool offers four operating modes with increasing levels of vigilance. Gentle mode minimizes the number of interruptions and only steps in for obvious cases. The default Balanced mode stops the agent when it tries to reach for secrets, execute a destructive or encoded command, or when a prompt injection, a suspicious MCP call, or an attempt to install itself persistently on the system is detected. Strict mode adds detection of lower-confidence signals, and Paranoid mode requires the user to approve every unfamiliar action that reaches for external tools.

Why this matters now

The release of HOL Guard comes amid a wave of incidents involving coding agents that have repeatedly made headlines in recent months for exactly the reasons this program is meant to curb. Security researchers have already shown that AI agents can be tricked by splitting a malicious command into pieces, hiding instructions in symlinks, or disguising a real intrusion as a legitimate security test to get the model to carry it out.

The creator of HOL Guard describes the project's goal explicitly as striking a balance between protection and usability. In materials accompanying the launch, Michael Kantor stresses that the priority was building a safeguard that wouldn't discourage developers from using agents in their everyday work.

Protect me without making the agent useless - Michael Kantor, president of HOL

Reach and ecosystem

HOL Guard is distributed as a package for Python 3.10 and later, and is also available as a container image. The project already has nearly 3,500 commits on its main repository branch, reflecting intensive development since launch. Alongside the guard itself, a related tool called plugin-scanner analyzes the quality and security of plugins, skills, and MCP servers before they're deployed, checking manifests, safeguards, and adherence to best practices.

For companies that need shared rules across entire teams, an optional Guard Cloud service is available, offering security policy synchronization, visibility into an agent fleet, and shared approval workflows for risky actions. The basic local version, however, remains fully free, works offline, and never uploads user files to external servers.

What this means for Polish teams

Research previously cited across the industry shows that more than 91 percent of Polish developers already use AI tools, while trust concerns around AI-generated code keep growing. A free, local tool that reduces the risks tied to coding agents could therefore meet a real need for teams that want to use automation without giving up control over what happens on company machines and in their repositories.

HOL Guard doesn't eliminate risk entirely and doesn't replace security audits or permission segmentation in production environments. It functions more as an additional layer of control in day-to-day work with a coding assistant, especially on developer machines where the agent has broad access to the file system and credentials.