HOL Guard 3.58.0 Tightens Pre-Execution Checks on AI Coding Agents

HOL has shipped HOL Guard 3.58.0, a stable release that folds 231 merged pull requests into tighter local checks on the actions AI coding agents attempt to take. The release, dated 13 November 2026, covers 48 additions, 104 improvements, 86 fixes and 25 other documented changes, according to the project's release notes.

HOL Guard is an open-source security tool that sits between an AI coding agent and the machine it runs on. Its local checks intercept actions such as executing shell commands, reading local files, installing software packages and invoking Model Context Protocol tools (MCP, an open standard that lets AI systems call external tools and data sources). The stakes are straightforward: as developers delegate more execution to agents, the boundary between what the agent wants and what the machine allows becomes the last line of defense.

What does the new command control actually change?

The headline technical change is signed command envelopes in the native runtime, paired with authentication of adapter state. HOL said this is intended "to make the boundary between an agent integration and the component making security decisions more explicit." In plain terms, the component deciding whether a command is safe can now verify where that command came from.

The release also adds runtime verification of command capabilities and supply-chain policy information. The stated aim is to strengthen checks on operations requested by supported agents before they are allowed, blocked, or referred for approval under a user's policy.

That last clause carries weight. The project does not present the tool as a guarantee that every attack or unsafe action will be detected. Coverage depends on the hooks and controls exposed by each supported agent integration, and the project maintains a support matrix documenting those differences. Buyers and adopters should read that matrix before assuming uniform protection across agent platforms.

How are plugin installations now handled?

The update changes the plugin installation flow in two consequential ways. First, installation can evaluate a listing against a recorded scan result and pin installation to the scanned commit, rather than assuming a later version carries the same security profile. That closes a familiar supply-chain gap: a clean scan of version N says nothing about version N+1.

Second, the flow hardens how risk is accepted. If a listing is blocked, the process stops before the runtime starts. If a listing requires confirmation, users are shown a risk decision, and the automated '--yes' option alone does not override that step, because acceptance also requires an explicit '--accept-risk' choice. Users can review installation plans before they are applied.

The design intent, per the release notes, is to add scrutiny to packages or agent plugins before they land in a working environment. The two-flag confirmation structure means CI pipelines and scripts cannot silently accept risk on a user's behalf — a deliberate friction point.

What is 'process evidence' and why does it matter?

HOL Guard 3.58.0 also changes how the tool reports running processes. It can now report visible running processes alongside the build they are demonstrably associated with — a shift from naming software to proving which artifact is actually executing.

The conservative edge of this feature is the notable part. If the executable on disk cannot be reliably tied to the process that started, the result keeps an unknown assurance state rather than clearing a security advisory on the basis of an uncertain version. The release notes explain why the distinction matters: responders trying to determine which installed software is actually running after a file has changed or an update has taken place need to know whether the linkage is proven or presumed. The tool declines to guess.

What do the expanded workspace checks cover?

Workspace assessments grew in this release. The checks now cover:

• configured MCP servers;
• AI agent skills;
• project-level hooks;
• plugin hooks;
• GitHub Actions workflow configurations.

These checks review instructions and configuration that agent tooling is about to load — the layer where prompt-injection payloads and hostile build steps typically hide. Findings retain supporting evidence and limitations, the release notes state, rather than asserting that every flagged configuration is malicious. That evidentiary framing is a hedge against false positives, and a signal that the project treats findings as leads for review, not verdicts.

How is it deployed, and what is not included?

HOL Guard runs locally and does not require an account for its core command-line interface and dashboard workflows. Shared history and team policy functions live in Guard Cloud, an optional separate cloud service. Current installation guidance recommends Python 3.10 or newer, pipx (a tool for installing Python applications in isolated environments) and a supported native runtime.

Users evaluating the software can inspect protection status with the command 'hol-guard status' and consult the support matrix to see what each agent integration can enforce — the practical first step for anyone measuring the tool against their own agent stack.

Version 3.58.0 is the project's current stable track. Later 3.59 prereleases are presented as preview builds rather than generally recommended installations. The public release page also documents where attribution verification remains in progress — a transparency note worth checking before relying on specific component claims.

The through-line of this release is provable linkage: signed envelopes tie commands to sources, pinned scans tie installs to reviewed commits, and build association ties running processes to known artifacts. Each mechanism is bounded by an honest caveat — integration-dependent coverage, unknown assurance states, findings that carry limitations — which is how a security tool should describe itself in a market that rarely does.