HOL and Vulkro: securing what your AI coding agent installs, runs and writes

An AI coding agent today does far more than suggest code. It reads files, runs shell commands, installs packages and calls MCP servers. That gives you three separate things to secure:

1. What you plug into the agent: plugins, skills and MCP servers.
2. What the agent does on your machine: commands, file reads, installs, tool calls.
3. What the agent writes: the code that ends up in your pull request.

HOL covers the first two. Vulkro covers the third. This post shows how they fit together.

#HOL Plugins: check before you install

HOL Plugins is a free, searchable registry of AI agent plugins, MCP servers and skills, with filters for Claude Code, Cursor, Codex and other agent runtimes.

• Trust ranking. The default order is a trust score built from identity, activity, verification and related signals.
• Scan results before install. Indexed plugins carry scanner-backed signals, including secret scanning and provenance checks where available, shown before you install anything.
• Clear limits. HOL describes the scan as static catalog scoring, not a live exploit test, and not a safety guarantee. Use it as a first filter, not as a sign-off.

#HOL Guard: review actions before they run

HOL Guard sits between the agent and your machine. On supported agents it can allow an action, ask you about it, or block it before it runs, and it keeps a local record of what happened. It covers destructive commands, secret access, package installs, data movement and MCP calls.

• Local first. Guard Local runs on your machine and works without a cloud account or an internet connection.
• Open source. The core runtime is Apache-2.0, on GitHub.
• Broad agent coverage. Claude Code, Codex, Cursor, OpenCode and GitHub Copilot CLI, among others. Enforcement depth varies by agent and event type.
• Optional cloud. Guard Cloud adds shared policy and dashboards for teams. Enforcement stays local.

#Vulkro: check the code the agent writes

Vulkro scans the code itself, offline, on your machine:

• The guard checks an agent's edits in Claude Code and Cursor before they land.
• The MCP server lets the agent call scan_diff on its own change, prove to get the data-flow behind a finding, and verify_fix to check a fix before applying it.
• MCP config checks flag risky servers and settings in the mcp.json files in your repository.
• CI runs the same scan again before merge.

#How they fit together

Each one misses what the others catch. An agent can write perfectly safe code and still run rm -rf on the wrong folder. It can behave well on the shell and still write an injection bug. A well-ranked MCP server can still be misconfigured in your repository.

#A practical setup

1. Look up every plugin and MCP server in HOL Plugins before you add it, and read the scan signals, not just the rank.
2. Run HOL Guard locally so destructive commands, secret reads and installs need a yes from you.
3. Run Vulkro's guard and MCP server so the agent checks its own code, and keep the scan in CI before merge.

#Further reading

• Audit your MCP configs, then give your agent a scanner it can call
• Agent guards: blocking insecure edits from Claude Code and Cursor before they land