HOL Guard is a local-first runtime control plane for AI coding agents. Before shell commands, secret access, MCP calls, or package installs reach your OS, Guard reviews them. Open source (Apache-2.0) — install with pipx install hol-guard && hol-guard init. Teams can add the optional hosted Guard Cloud (freemium). Guard is not a gateway or network firewall, and scans are not a safety guarantee.