HOL Guard is a local-first runtime firewall for AI coding agents. It intercepts tool calls (shell, secrets, MCP, package installs) before they execute. Apache-2.0. Install: pipx install hol-guard && hol-guard init. Scan is not a safety guarantee. Maker: HOL. Free.