---
name: HOL Guard
slug: hol-guard
url: https://hol.org/guard
category: Coding agent guard
bestFor: "Making a coding agent such as Cursor, Claude Code, or Codex ask or stop before a covered risky action runs on your own machine."
freeTier: yes
price: "$0"
checks:
  - secrets
freeTierNote: "The pricing page lists Free at $0 forever on one machine and says local leaked-secret scanning, runtime protection, approvals, and receipts do not require an account or cloud connection. Its FAQ says the free tier needs no credit card. The product page FAQ says the core Guard Local runtime is open source under Apache-2.0 and runs on the developer machine without a cloud account, and the GitHub repository lists the same license. Guard Cloud is a separate, optional paid plan for sync, shared policy, and team features: Solo is $4.99 a month, Pro is $15 a month, and Team is $30 per seat a month. Enterprise is contact sales."
verifiedOn: "2026-11-02"
sources:
  - https://hol.org/guard
  - https://hol.org/guard/security/coverage
  - https://hol.org/guard/pricing
  - https://github.com/hashgraph-online/hol-guard
unknowns:
  - "Whether the coverage matrix is current. It covers stable channel 3.0.1, and its assertions say they were verified on 2026-09-09 and expire on 2026-10-09, a date that had passed when this page was checked."
  - "Which secret types the local leaked-secret scan finds, and whether it reads git history or only the current files. The pricing page names the feature without those details."
  - "The current version. The product page and its structured data name different versions."
  - "A scored Guard Gauntlet run. The pricing FAQ says the site publishes the catalog and rules rather than a scored run, and describes the July 2026 export as a separate fixture model."
---

HOL Guard runs on your computer. On supported integrations it can allow, ask, or block before an action runs, and it keeps a record of what happened. The product page lists Codex, Claude Code, Cursor, OpenCode, Antigravity CLI, Hermes, and OpenClaw. Its FAQ names secret and credential exposure, destructive commands, prompt-injection-driven actions, malicious or changed packages, risky MCP configuration, and unsafe plugins, skills, hooks, and agent settings, and says enforcement depth varies by agent and event type.

The coverage page lists those limits per agent. For Cursor, it says shell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session, and prompt submission is not surfaced through native Cursor hooks.