hashgraph-online/hol-guard

Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

HOL Guard – Open‑Source Antivirus for AI Agents

What it is – A Python‑based, local‑first security layer that watches AI agents (e.g., Codex, Claude Code, GitHub Copilot CLI, Gemini CLI, etc.) before they run shell commands, touch files, install packages, or call external tools. It flags secret leaks, destructive actions, prompt‑injection attempts, and supply‑chain risks, then lets you allow, block, or request approval.

Installation

pipx install hol-guard      # installs the CLI in an isolated environment
hol-guard init             # runs a wizard that discovers agents and configures protection

You can check the version with hol-guard --version and update via hol-guard update.

Core capabilities

Area What HOL Guard does
Shell / file access Scans commands and file reads for destructive patterns, credential exposure, and suspicious outbound calls.
Package installs Intercepts pip, npm, etc. and checks against a supply‑chain intelligence database before allowing the install.
Plugins, skills, agent config Inventories local plugins and reviews any new or changed tool before the agent launches it.
MCP servers & tools Inspects MCP server configuration and proxies tool calls through managed hooks.
Prompt & tool results Detects prompt‑injection and filters sensitive content in agent‑generated text.
Approvals & evidence Routes risky actions to a native prompt or a dashboard, records a receipt for later audit.

Typical workflow

# see current protection state
hol-guard status

# diagnose a specific agent integration
hol-guard doctor codex

# preview what would happen without executing
hol-guard diff codex

# handle a pending approval request
hol-guard approvals            # list
hol-guard approvals approve <id>

# view the decision history
hol-guard receipts

A dry‑run (hol-guard run codex --dry-run) records the artifact state without actually launching the agent, useful for safety checks.

Supported agents – Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Grok, Hermes, Kimi Code, Pi, oh‑my‑pi, OpenClaw, OpenCode, Antigravity, ZCode, Devin, and Paseo (via native provider adapters). The README links to a detailed support matrix.

Plugin Scanner – The same repository also ships plugin‑scanner, a CLI for plugin/skill authors and CI pipelines. It can:

  • scan for security findings,
  • lint rule‑level authoring feedback,
  • verify install‑time readiness,
  • submit a packaged artifact for marketplace submission,
  • doctor collect diagnostics. It supports many ecosystems (Codex, Claude Code, DeepSeek Harness, Gemini CLI, Kimi Code, OpenCode) and outputs text, json, markdown, or sarif for CI integration. A ready‑made GitHub Action (hashgraph-online/ai-plugin-scanner-action) lets you gate PRs on a minimum score.

Optional Guard Cloud – A SaaS add‑on (not required) that syncs approval history, shares policies across a team, and provides fleet‑wide management.

Why it matters – As AI agents gain the ability to run arbitrary commands and install dependencies, they become a new attack surface. HOL Guard gives developers a familiar “antivirus” experience for these agents, keeping the machine safe while still allowing the productivity benefits of AI‑augmented tooling.

Links

Related

  • Project
    karanb192/claude-code-hooks

    A marketplace of 22 safety‑and‑automation plugins (hooks) for Claude Code, letting you block dangerous commands, protect secrets, audit sessions, auto‑format code, and more, all installed via simple Claude commands.

  • Project
    GoPlusSecurity/agentguard

    A real-time security layer for AI agents that blocks destructive commands, scans plugins for malicious code, and performs daily security audits to prevent data theft and system damage.

  • Project
    Dicklesworthstone/destructive_command_guard

    Destructive Command Guard (dcg) is a Rust‑based hook that protects developers from accidental destructive commands issued by AI coding agents (Claude, Codex, Gemini, Copilot, etc.). It matches commands against 50+ rule packs (filesystem, Git, cloud, databases, containers, etc.) and blocks them with clear explanations, offering per‑agent profiles, CI scanning, and fast SIMD‑accelerated filtering.

  • Project
    manuelschipper/nah

    nah is a Rust‑based guard that intercepts tool calls from AI coding agents, parses them into structured effects, and deterministically blocks any call that matches one of its 48 built‑in disaster‑prevention guards (e.g., executing network‑fetched code, leaking secrets, destructive Git or filesystem actions). It works as a hook for many agents (Claude, Codex, Copilot, etc.), logs decisions, and can be extended with custom guard programs.

  • Project
    iamfakeguru/agent-md

    agent‑md is a lightweight framework that installs rule files, git‑hooks, and helper scripts to turn AI coding assistants (Claude Code, Codex, Cursor, Windsurf) into contract‑driven agents. It provides a single source‑of‑truth markdown file (AGENT.md) plus enforceable checks (type‑check, lint, tests, visual screenshots, state updates) that block the model until the required evidence is present.