HOL Guard 3.58.0 adds tighter checks for AI agents

HOL has released HOL Guard 3.58.0, adding new checks for AI coding agents.

The stable release includes signed command envelopes, tighter controls on plugin installation, and new process reporting tied to software builds.

HOL Guard is an open-source security tool that places local checks in front of actions taken by AI coding agents. Those actions can include executing shell commands, reading local files, installing software packages, and invoking Model Context Protocol tools.

Version 3.58.0 expands checks around tool execution, workspace configuration, and evidence about running processes. The release notes list 231 merged pull requests: 48 additions, 104 improvements, 86 fixes, and 25 other documented changes.

Command controls

A key change is the addition of signed command envelopes in the native runtime, along with authentication of adapter state. HOL said this is intended to make the boundary between an agent integration and the component making security decisions more explicit.

The release also adds runtime verification of command capabilities and supply-chain policy information. The aim is to strengthen checks on operations requested by supported agents before they are allowed, blocked, or referred for approval under a user's policy.

The project does not present the tool as a guarantee that every attack or unsafe action will be detected. Coverage depends on the hooks and controls exposed by each supported agent integration, and the project maintains a support matrix showing those differences.

Plugin checks

The update also changes how plugin installation is handled. The installation flow can evaluate a listing against a recorded scan result and pin installation to the scanned commit, rather than assuming a later version has the same security profile.

If a listing is blocked, the process stops before the runtime starts. If a listing requires confirmation, users are shown a risk decision, and the automated '--yes' option alone does not override that step because acceptance also requires an explicit '--accept-risk' choice.

Users can also review installation plans before they are applied. The changes are intended to add scrutiny to packages or agent plugins before they are installed into a working environment.

Process evidence

Another addition changes how HOL Guard reports running processes. The software can now report visible running processes alongside the build they are demonstrably associated with.

If the executable on disk cannot be reliably tied to the process that started, the result keeps an unknown assurance state rather than clearing a security advisory on the basis of an uncertain version. That distinction matters when responders are trying to determine which installed software is actually running after a file has changed or an update has taken place.

Workspace review

Workspace assessments have also been expanded. The release describes checks for configured MCP servers, AI agent skills, project-level hooks, plugin hooks, and GitHub Actions workflow configurations.

These checks review instructions and configuration that agent tooling is about to load. Findings retain supporting evidence and limitations rather than asserting that every flagged configuration is malicious.

HOL Guard runs locally and does not require an account for its core command-line interface and dashboard workflows. Separate shared history and team policy functions are available through an optional cloud service called Guard Cloud.

Current installation guidance recommends Python 3.10 or newer and pipx, along with a supported native runtime. Users evaluating the software can inspect protection status with the command 'hol-guard status' and consult the support matrix to see what each agent integration can enforce.

Version 3.58.0 is the project's current stable track, while later 3.59 prereleases are presented as preview builds rather than generally recommended installations. The public release page also documents where attribution verification remains in progress.