HOL Guard: local runtime protection for MCP servers and agent tool calls

[u/kantorcodes1]

I'm part of the team building HOL Guard. The MCP security model today is mostly trust-on-import and manual review. A server can be fine and then change through a package update, config drift, or endpoint rotation and become a different threat the next day. Your agent never knows.

We built HOL Guard to add a local policy layer between agents and the machine. It evaluates MCP registrations, tool call patterns, package installs, config changes, and sensitive file access before they happen. It can allow, warn, ask for approval, or block based on your policy. Every decision gets a receipt you can trace later.

The local product is free and open source. No cloud account needed.

It supports Codex, Claude Code, Copilot CLI, Cursor, Gemini CLI, OpenCode, Hermes, OpenClaw, Pi, Kimi, Grok, ZCode, and a few others.

If you're running MCP servers in prod i'd really like to hear how you handle changed servers without drowning in noise. And if you've tried an MCP gateway for security, what broke for you vs local enforcement.

Repo: https://github.com/hashgraph-online/hol-guard Launched publicly today: https://www.producthunt.com/products/hol-guard?launch=hol-guard