HOL Guard MCP Server

What the code does

We read the source, 23 h ago · rules 995398eba69f

A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.

    let mut command = Command::new(&program);

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

        "xargs sh -c 'rm -rf \"$1\"' _ < list.txt",

            | "doas"

        "https://169.254.169.254/mcp",

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

        (r"~/Library/LaunchAgents/", "i"),

            r#"(?i)\b(?:send|post|upload|transfer|paste|sync)\b.{0,120}(?:(?<![\w-])\.env(?:\.[\w.-]+)?\b|(?:^|[\s'\"`])~?/.ssh(?:/|\b)|(?:^|[\s'\"`])~?/.aws/(?:credentials|config)\b|(?:^|[\s'\"`])~?/.kube/config\b|(?:^|[\s'\"`])~?/.docker/config\.json\b|(?<![\w-])\.npmrc\b|(?<![…

    completed = subprocess.run(

            candidates = {posixpath.normpath(posixpath.join(base, target)) for base in bases}

  /\.npmrc/i,

    "default *       Current DOCKER_HOST based configuration   unix:///var/run/docker.sock",

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add hol-guard -- uvx hol-guard

{
  "mcpServers": {
    "hol-guard": {
      "command": "uvx",
      "args": [
        "hol-guard"
      ]
    }
  }
}

[mcp_servers.hol-guard]
command = "uvx"
args = ["hol-guard"]

{
  "mcpServers": {
    "hol-guard": {
      "command": "uvx",
      "args": [
        "hol-guard"
      ]
    }
  }
}

{
  "servers": {
    "hol-guard": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "hol-guard"
      ]
    }
  }
}