An agent guard that runs on your laptop, and cannot tell you whether anyone keeps it on

Locality is the choice the rest of the design follows from. Nothing is uploaded, no internet connection is required, and a typical check finishes in under 50 milliseconds ^[2]. On a session that fires 200 tool calls, that is under ten seconds of added time across the whole run ^[1], which is less than the agent spends waiting on one model response. So the constraint is not overhead. It is prompt count, because what kills a local interceptor is fatigue, not latency.

That makes the default line the whole product. Michael Kantor, president of HOL, gives the design goal as "protect me without making the agent unusable" ^[5], and Balanced re-asks on secret and exfiltration access, destructive or encoded execution, prompt injection, dangerous MCP calls, malicious skills and persistence, warns on network egress and package scripts, and blocks attempts to bypass the guard itself ^[6]. Read the middle clause the other way: on the shipped setting, a package install script that opens a network connection is a warning a hurried developer scrolls past. Strict layers on low-confidence signals and Paranoid interrupts on any unfamiliar action from an external tool server, and neither is on out of the box ^[7].

Then the gap HOL is candid about. The package has passed 552,000 downloads, and the company notes that a download count measures machines that fetched it, not machines still running it ^[13]. Asked whether first-week users tighten to Strict or fall back to Gentle, Kantor told Help Net Security there is no defensible number, because local telemetry and cloud sync are off by default and anything quoted would be invented ^[11]. Nothing is collected without opt-in, so the vendor cannot observe its own install base ^[12]. That is a consistent trade rather than an evasion, and it also means no one outside a given machine can say whether this class of control survives a week of real work. What does exist is a local record of every allowed and blocked action, with a bad block reversible in one approval ^[14].

The published-signature question is the least of it. The trigger list is public deliberately, and Kantor argues that hiding detector signatures is not a real security boundary ^[8]. Behind the simple checks sits parsing of actual command structure across wrappers, pipelines, redirects and embedded commands, plus executable and provenance checks, sensitive-path access, network destinations and artifact hash changes ^[9]. He also says pattern matching has not been eliminated and is one input among several ^[10]. Help Net Security's own read is that someone who reads the source can probably reword a command past the simple checks, and that fooling the layer watching what a command does is harder ^[17].

HOL calls the tool "not a complete prompt-injection preventer" and attaches no safety promise to the scores from its companion plugin scanner ^[15]. Those disclaimers are the useful part of the pitch. A free, locally run approval boundary at the command layer ^[1] is a reasonable thing to put in front of an agent that already has shell access. Whether it earns its interruptions is a question with exactly one place to be answered, and it is not on the vendor's side of the wire.