HOL Guard

The description states that HOL Guard is a local-first execution firewall for AI agents. It sits between an agent and the environment it can act on, inspecting supported activity before execution such as:

• File access
• Shell commands
• Package installations
• MCP registrations
• Tool calls
• Configuration changes
• Potentially destructive operations

It can:

• Allow actions that match policy
• Automatically block known threats
• Route contextual actions to an Inbox for human approval
• Explain why an action was paused or blocked
• Produce an auditable receipt for each decision

The product is described as local-first, and enforcement decisions are independent from the model proposing the action. The agent recommends what should happen, but does not decide whether its own action is safe.

Inference HOL Guard appears to be a security layer that enforces policy at the execution boundary of AI agents, distinguishing between actions that are automatically allowed, blocked, or require human review.

The description states that HOL Guard was originally built as an internal tool due to concerns about how quickly AI agents were gaining access to devices and work environments. It evolved from a personal solution to a product intended for broader organizational deployment.

Key claims:

• The tool aims to protect against supply chain attacks
• It focuses on execution-level protection, not scanning code or detecting problems after they happen
• It is positioned as a firewall for AI agents that intercepts risky actions before execution

The authors emphasize that the product is designed to make autonomous AI feel safer, and that it can be used by any organization deploying agents with access to local files, credentials, tools, or business systems.

Inference HOL Guard positions itself as a security control for AI agents at the point of action execution, distinct from traditional code scanning or post-incident detection methods. It is intended to be a shared control layer across teams and workflows.

The description states that HOL Guard was built with the intent to protect any organization deploying agents with access to local files, credentials, tools, and business systems.

It mentions use cases across:

• Engineering
• Sales
• Business development
• Content
• Operations

The authors note that the underlying risk is consistent whether an agent is changing infrastructure, accessing CRM data, handling internal research, deleting content, or publishing externally.

Inference The target customer appears to be organizations using AI agents in roles that involve system access and interaction. The ICP likely includes engineering teams, DevOps, security teams, and any department where autonomous AI agents are used with elevated privileges.

Not evidenced.

The description does not contain information about pricing, monetization strategy, or business model. No mention of customers, revenue, or commercial arrangements is present.

The description states that HOL Guard:

• Uses local-first architecture
• Is built with bun, codex, python, sol, typescript
• Implements a structured command safety engine using Codex and GPT-5.6
• Parses shell commands into a canonical representation to evaluate actions accurately
• Supports structured rules that evaluate complete actions rather than flat strings

It also mentions:

• Use of Codex and GPT-5.6 in engineering loop for threat modeling, rule design, adversarial testing, and review
• The model is used to move faster, but not as the source of authority for enforcement decisions
• The system separates terminal policy decisions from contextual approval decisions

Inference The technical approach involves structured command parsing and evaluation using AI tools in a development loop, while maintaining explicit human control over enforcement. It supports multiple agent environments and actions including Git, cloud infrastructure, databases, CI/CD, package operations, and filesystem activity.

The description states:

• HOL Guard has been downloaded 400K+ times
• It is used everyday
• The authors also operate Awesome Codex Plugins, which has ~700 stars
• Many plugin maintainers use the Plugin Scanner from HOL Guard to reduce attack vectors

It also mentions:

• A demo showing a real Codex action being intercepted before execution
• Known threats being automatically blocked
• Contextual actions appearing in the HOL Guard Inbox
• Human decision preventing underlying files from being changed

Inference There is self-reported evidence of adoption and usage, but no independent confirmation or data on actual customer engagement. The download count and daily use are claims without verification.

Not evidenced.

The description does not mention any competitors or direct market context. No information is provided about existing products in the AI agent security space.

• Self-reported adoption: Claims of 400K+ downloads and daily use are unverified.
• No commercial evidence: No revenue, customers, or pricing data are provided.
• Unproven market traction: The product is described as a tool used internally before being expanded — no external validation of demand.
• Limited maturity signals: While the authors describe technical sophistication, there is no evidence of production deployment or scalability beyond internal use.
• No clear differentiation from other security tools: The description does not clearly articulate how HOL Guard differs from existing execution-level protections.

1. What specific types of AI agents are currently supported by HOL Guard?
2. How is the product being used in practice — what workflows or use cases drive adoption?
3. Are there any known false positives or bypasses that have been encountered?
4. What is the current user base — is it primarily individuals, teams, or organizations?
5. How does the product integrate with existing security tools or workflows?
6. What are the key challenges in scaling the product beyond internal use?
7. Is there a plan to monetize the product, and if so, what is the business model?