Command and MCP coverage with source, activation model, maintainer identity, and stated limitations for every entry — so a listing never reads like a security guarantee.
Reviews AgentBridge CLI commands that can overwrite generated plugin files or execute with an attached app tool registry.
Reviews AgenticJobs listing posts and publishes, application submits and applicant decisions.
Reviews agi-memory commands that rewrite the canonical memory vault, permanently delete a memory across every synced machine, attach a remot
Pre-action protection for agents
SponsoredIntercepts shell commands, secret reads, and MCP changes before they execute. Free local tier.
Detects sensitive ai-dev CLI operations and provides structured evidence for policy review.
Reviews AWS Route 53 hosted-zone, record, health-check, traffic-policy, DNSSEC, and Resolver deletions.
Reviews AWS CLI high-level S3 commands and S3 API object, bucket, access-control, and configuration operations including copy, list, sync, w
Reviews answerLoops CLI commands that start a self-hosted instance with Docker Compose or download agent skill files into ./.claude/skills/.
Reviews API and gateway deletion through supported cloud CLIs.
Conservative operation knowledge compiled from a contributor inventory.
Reviews a validated AWS CLI operation matrix for permanent resource deletion and service termination across identity, compute, data, deliver
Reviews Azure CLI storage commands including upload, list, copy, and deletion.
Reviews a validated Azure CLI operation matrix for permanent resource deletion across subscription, identity, network, compute, application,
Reviews Azure public DNS, private DNS, virtual-network link, and DNS resolver deletion through Azure CLI.
Reviews blitcp copies that leave the host, elevate privileges, or skip verification.
Reviews blkcp commands that write directly to raw block devices or bypass safety guards with --force.
Reviews Borg operations that delete, prune, or recreate archives.
Reviews distribution, VPC origin, key-value-store, profile, and endpoint deletion through supported cloud CLIs.
Reviews remote pipeline execution through CircleCI CLI.
Reviews claude-tmux-cleanup runs that kill agent-team sessions or Claude Code processes.
Reviews cloud credential use, security scanner execution, and Terraform file generation through the CloudG CLI.
Reviews CodeSage commands that install Git hooks or change MCP server registration. doctor, status, and search are outside these rules.
Reviews Codex Migrate commands that enable destination-changing migration or recovery operations.
Reviewed HOL Guard coverage for COGEXT commitment-changing CLI commands.
Detects shell flows that can send credentials or local file contents to a network destination.
Reviews container lifecycle, cleanup, execution, network, and persistent-data operations that can expose credentials or mutate host state.
Reviews crisp-tui shell commands that change a Crisp support inbox. `crisp-tui ctl draft` writes a reply or internal note into the composer
Reviews cs (Claude Sessions) commands that launch Claude Code in another folder, write pin or archive files, or send session text to a model
Reviews ctty remote execution (batch exec and bare-host SSH), file transfers (put/get/scp), SFTP/FTP/WebDAV mutations, and local inventory w
Reviews state-mutating DataMan CLI commands that initialize projects, scaffold tables or databases, generate/apply migrations, modify creden
Reviews dearmour commands that can overwrite or merge into an existing destination directory.
Reviews destructive, disruptive, access-changing, credential-exposing and remote-execution doctl operations, while Guard's read proof keeps
Reviews digline commands that spend model calls, write under .digline/, or can promote a baseline.
Reviews Dispat release starts while leaving status previews quiet.
Reviews explicit DELETE requests to recognizable Elasticsearch API targets.
Reviews email identity, template, configuration-set, and contact-list deletion through AWS CLI.
Reviews decode-and-execute flows whose effective program is hidden from normal command inspection.
Reviews essh host group execution and removal of cached hosts, keys, and workspaces.
faf-cli works with HOL Guard: commands that write files or reach the network are reviewed; other commands follow Guard default policy.
Reviews permanent feature-flag deletion through LaunchDarkly CLI.
Reviews recursive deletion and access-control changes across filesystem trees.
Reviews Formicx mutation lifecycle commands (register, start, stop, restart) while leaving read-only queries (list, status, resources) autom
Reviews destructive mutations, policy changes, and session unlocks for the gEnclave security vault CLI.
Reviews everyday Git porcelain plus local and remote operations that can discard work, replace history, refresh a remote Guard cannot verify
Reviews workflow-run cancellation, deletion, and workflow disabling through GitHub CLI.
Reviews distinct GitHub maintenance, content, merge, publication, workflow, and control effects.
Reviews remote pipeline cancellation through GitLab CLI.
Reviews gitsync's live mirror sync, server-side webhook rewrites, and service install/uninstall. `check`, `status`, and plain `hooks` do not
Routes Go module and tool installation requests through Guard's package firewall.
Reviews a validated gcloud operation matrix for permanent resource deletion across stable and supported release tracks.
Reviews gcloud Cloud DNS managed-zone, record-set, policy, and response-policy deletions and updates.
Reviews Google CLI storage commands including copy, list, sync, and deletion.
Opt-in review of finite pinned gog CLI delivery, sharing, event, export, generic API and identity-override routes. This does not authenticat
Reviews consequential Gmail, Drive, Calendar and authentication/credential-export CLI operations. This opt-in compatibility extension does n
Prevents commands from authorizing their own Guard approval or weakening protected Guard state.
Reviews HashDup commands, approval-gating permanent --delete operations with read-only scans and --trash staging staying under review.
Reviews app destruction, pipeline promotion, and release rollback.
Reviews infrastructure teardown through Terraform, OpenTofu, and Pulumi.
Routes Maven and Gradle dependency operations through Guard's package firewall.
Reviews Kafka topic, group, offset, and record deletion operations.
Reviews kd commands that share a local file with a peer, write a peer's file to local disk, or set which peer identity the session accepts.
HOL Guard coverage for Kelados CLI commands that synthesize audio or start a local TTS server.
Reviews kim commands that mutate the local reminder config, daemon state, or notification settings; read-only inspection stays automatic.
Reviews kindling's `kling` CLI (Firecracker/Virtualization.framework microVMs with a docker-style interface) and the `kling-db`, `kling-mcp`
Reviews Kintsua CLI commands that rewrite the committed MCP/OpenAPI tool lockfile or push captured tool schemas to a hosted service. Read-on
Contributions marked “Community contribution” entered this directory through public pull requests with a recorded merge, digest, and source path. A verified publisher profile attributes the contributor; it is not an upstream endorsement or a HOL safety certification.
No. Every entry documents source, activation model, maintainer identity, and stated limitations so you can evaluate coverage before enabling it. A listing is documentation, not a certification, and a maintainer profile is not an upstream endorsement.
The directory is generated from the canonical extension catalog in the hol-guard repository and checked on every page load. Each entry page links to the exact source tree it was reviewed at.
Enablement is managed through your workspace Guard policy, never from this directory. Built-in and required coverage run whenever Guard runs; external coverage waits for a deliberate opt-in through Guard controls. Setup starts at https://hol.org/guard/install
The action is stopped at Guard’s pre-action boundary before it executes, and the decision is recorded with evidence your workspace can review in decision memory. Exact behavior follows your Guard policy combined with the entry’s reviewed rules.
No. Guard is local-first: interception, decisions, and evidence stay on your machine unless your workspace explicitly enables cloud features. This directory is documentation only and never executes commands.
Community extensions are merged through public pull requests with recorded provenance. Open the Publisher Studio to claim a publisher page for a contribution you maintain.
Install the CLI, connect your agents, and review each entry’s limits here before it ever intercepts a command.
Explore more of Guard
