Policy checks on agent tools, before the command runs.
HOL Guard is a local-first runtime firewall: coding agents still work, but shell, secrets, MCP, and package installs are checked first. Apache-2.0. pipx install hol-guard && hol-guard init. Scan is not a safety guarantee. Maker: HOL.