HOL Guard

What it is

hol-guard (pipx package hol-guard) plus a companion plugin-scanner CLI from hashgraph-online. Guard is a runtime gate for AI coding agents; plugin-scanner is a separate maintainer-facing tool for vetting agent plugins/skills/MCP integrations before publishing. Requires Python 3.10+.

How it works

Guard connects via native agent hooks, managed MCP proxies, and launch integrations — coverage depends on what events each agent exposes, documented in a per-integration support matrix (enforcement, approval delivery, failure behavior). For Codex specifically, Guard installs native pre-tool hooks and refuses a managed launch if those hooks are missing or disabled. You can inspect classification without executing or creating an approval:

hol-guard command test 'rm -rf ./build'
hol-guard command explain 'git clean -ndx'

Supported agents include Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Grok, Hermes, Kimi Code, Pi, oh-my-pi, OpenClaw, OpenCode, Antigravity, ZCode.

What to do

Managed launch flow (note the dry-run records artifact state before launch):

hol-guard install codex
hol-guard run codex --dry-run
hol-guard run codex

Supply-chain checks:

hol-guard supply-chain sync
hol-guard supply-chain scan
hol-guard supply-chain explain minimist@1.2.5 --ecosystem npm

Plugin-scanner (separate install) for CI/publishing gates, with SARIF and severity failure:

pipx install plugin-scanner
plugin-scanner scan . --format sarif --output plugin-scanner.sarif
plugin-scanner scan . --fail-on-severity high

It detects Codex, Claude Code, DeepSeek Harness, Gemini CLI, Kimi Code, and OpenCode formats; checks manifests, secrets, MCP transport/command config, approval defaults, skills, lockfiles, and GitHub Actions permissions. A pinned GitHub Action exists (hashgraph-online/ai-plugin-scanner-action, referenced as v1.2.631) with min_score and fail_on_severity inputs.

Optional Cisco skill/MCP analysis requires Python 3.11–3.14 and isolated installs:

pipx install 'plugin-scanner[cisco]'
uv sync --extra dev --extra cisco --group cisco-mcp --python 3.13
uv run plugin-scanner scan . --cisco-skill-scan on --cisco-mcp-scan on

Caveats

• Enforcement is not uniform: "coverage depends on the events each agent exposes" — check the support matrix per agent before relying on blocking. Paseo is covered only through provider integrations.
• The cisco extra provides skill scanning only; MCP analysis needs the separate cisco-mcp group or the repo Docker image.
• External command-coverage contributions are opt-in; only required core protections are enabled by default.
• Trust/quality scoring are distinct — quality grades normalize across applicable checks so optional surfaces don't inflate a grade; trust uses separate HCS-28 adapters and weights.