# Putting "antivirus" on AI coding agents: hol.org, where the traffic actually comes from: those 50k plugin pages · web

> Source: https://stringers.io/en/web/web_hol.org.html (Stringers / 什么值得做, generated 2026-11-08)
> Stringers answers one question every day: what small product can one or two people build in a few months and actually make money from. Numbers come from 15 databases we collect daily, each with source and date.
> For agents: these verdicts and the underlying databases (verified revenue, App Store / Google Play charts, ad libraries, GitHub, Product Hunt…) are queryable live over MCP — tools today / hot / products / directions / direction / data. Setup: https://github.com/komako-workshop/stringers (the user logs in at stringers.io → "配置 agent" to get a personal URL). Site index: https://stringers.io/llms.txt

> Coding agents keep causing incidents, so "security antivirus for agents" is an easy pitch. An established org swapped in a three-letter .org domain. It got its first wave from security media, Product Hunt and Reddit posts across subreddits, and its second from a plugin directory and ranking pages that caught search.

[Web](https://stringers.io/en/web/index.md) · 11-6 written

HOL Guard / hol.org(Hashgraph Online) · hol.org

# Putting "antivirus" on AI coding agents: hol.org, where the traffic actually comes from: those 50k plugin pages

**What it is** An open-source, free-to-run local firewall for AI coding agents. It vets agent commands, secret reads, and package installs before they run, plus a directory that scores the security of 50k+ plugins.

**Why it took off** Coding agents have had a lot of incidents, so "antivirus for agents" is an easy pitch. An established organization switched to a three-letter .org domain, got its first wave from security media, Product Hunt, and Reddit posts across several subreddits, then got a second wave from search via the plugin directory and ranking pages.

**C** **How you could follow this** Don't build another agent firewall. Follow its second move: build a plugin directory with security scores for an agent ecosystem or language the big directories haven't covered well yet (for example, domestic CLIs). Give each entry its own page, add best-X ranking pages, and drive traffic through awesome-repo listings and PR-based inclusion.

C grade: the product's category is already crowded, and official sandboxes are being rolled out. Its traction comes from the organization, the domain, and a saturated distribution push that followers can't replicate. What's worth learning is the directory plus long-tail SEO playbook, but several English plugin directories are already competing for it. Whispers in small circles

Global rank 185k · 90 days ago, top 1M+

hol.org sells HOL Guard, an open-source "firewall" that sits between Claude Code, Codex, Cursor and your machine. Local use is free, cloud is from $4.99/month. Its global rank climbed from 1M to 185k over 90 days. Split the curve apart, though: the August stretch is really Guard's doing, but the second climb from late October happened while Guard's downloads were halved. What pushed it up was the plugin directory it added on the side: 50k+ plugins, skills and MCP servers, each on its own page, plus a row of "Best Codex plugins"-style ranking pages. The team behind it isn't newcomers either, but an older Hedera-ecosystem organization working on agent standards, which had just moved to a three-letter .org domain. Below: what it is, where each traffic wave came from, who's competing, and the one move you can take.

### A plain-spoken interview

On Aug 2026 25, the security outlet Help Net Security ran an interview headlined "HOL Guard: open-source antivirus for AI agents." The reporter asked the question every dev tool dreads: after install, did users tighten the settings in week one, quietly loosen them, or uninstall?

HOL President Michael Kantor's answer:

> "Honestly, we don't have a solid number on adoption yet, whether for Strict, Gentle or churn. Local telemetry and cloud sync are off by default, so naming a figure would be making it up."

The same article said the package "has already passed 552k downloads," then added a caveat: downloads tell you how many machines pulled it, not how many still run it.

That exchange shows both sides of the product. The side developers like: runs locally, uploads nothing, rules are public. The other side: even its makers don't know how many people actually use it.

### What it is

When you have Claude Code or Codex do work, it runs shell commands, reads files, installs npm and PyPI packages, and calls MCP tools. HOL Guard sits in the middle and gives one of three verdicts before each action runs: allow, ask you, or block. Every decision is logged locally. According to Help Net Security, setup takes about a minute, each check takes under 50 ms, and it works offline.

There are four modes: Gentle, Balanced (default), Strict, and Paranoid. The default Balanced mode stops and asks you about: reading secrets, sending data outward, destructive commands, encoded commands, suspicious MCP calls, and malicious skills. If something tries to get around Guard itself, it's blocked outright.

Its biggest difference from similar tools is coverage. One tool hooks into 16 agents (Claude Code, Codex, Cursor, Gemini/Antigravity CLI, OpenCode, Copilot CLI, Kimi, Grok and more), ships 137 command extensions, and intercepts 15 package managers (per the GitHub README). Licensed under Apache-2.0.

Pricing (hol.org/guard/pricing):

| Tier | Pricing |
|---|---|
| Local | Free, all blocking features |
| Solo | $4.99/mo |
| Pro | $15/mo |
| Team | $30/seat/month |
| Enterprise | Negotiable |

Only "sync" and "teams" are paid. All blocking features are free. How many people pay is not visible from outside.

### Two climbs, two sources

hol.org's position in the Tranco global website ranking:

| Date | Rank |
|---|---|
| 8-13 | 734,141 |
| 8-27 | 275,752 |
| 10-06 | 258,881 |
| 10-21 | 301,369 (pullback) |
| 11-05 | 185,285 |

**The first climb (mid-to-late August, rank up roughly 2.7x) came from Guard.** It hit Product Hunt on Jul 23, got 99 votes and placed #18 that day, which isn't big. On Aug 25 came the Help Net Security interview. The team also posted in agent subreddits: r/GeminiAI ("local runtime protection for Gemini CLI"), r/mcp ("local runtime protection for MCP servers") and r/ClaudeWorkflows (on Claude Code). Each agent community got its own post about how to protect the agent you use. The hol-guard PyPI monthly downloads went from 67k in July back to 91k in August (pypistats.org, mirrors excluded).

**The second climb (from Oct 21, rank 300k to 185k) did not come from Guard.** Over the same period, hol-guard's monthly downloads fell from 89k in September to 41k in October, roughly halved. What grew were two other things:

- The plugin directory hol.org/plugins: by Oct 26 it listed 50,408 plugins, skills and MCP servers. Each has its own page with a trust score, scan results and a one-line install command. There's also a row of ranking pages: best-claude-plugins, best-codex-plugins, best-cursor-plugins, best-kimi-plugins, best-deepseek-plugins, best-mcp-plugins… By Nov 6 the Codex page was titled "Best Codex Plugins (2026), Security-Scanned," with a comparison table reading "565 plugins, sorted by HOL trust score."

- The companion scanning tool plugin-scanner: PyPI downloads hit 78k in October, up from 57k in September.

So the second wave looks more like people searching "best codex plugins" or "claude code plugins" and landing via search engines (inference: per-page traffic isn't public, but the timing fits). Two caveats. First, hol.org still isn't among Chrome's real-user top 1M globally, so real browser traffic remains small. Second, Guard and the directory both have CLIs and APIs that hit hol.org in the background, which may have inflated the ranking (inference).

### The domain was for sale last year

In November 2025, web archives show hol.org redirecting to a domain parking page, meaning it was for sale at the time. By May 2026 7, a press release from GoDaddy and HOL was already using hol.org. HOL was formerly Hashgraph Online, with its main site at hashgraphonline.com. It builds standards and SDKs for on-chain agent communication on Hedera (standards-sdk has 1,280 stars on GitHub), and the operating entity, Hashgraph Online DAO LLC, is registered in the Marshall Islands.

In other words, this is not a new site built from zero. It's an organization with standards, an SDK, an existing ecosystem and a GoDaddy partnership, that switched to a three-letter domain and added Guard and the plugin directory. That matters for whether you can copy it.

### How it pulls people in

Beyond Product Hunt, media and Reddit above, a few tactics are worth a look:

**Self-promoting awesome lists.** The GitHub awesome-codex-plugins repo calls itself "The #1 Codex Marketplace" and its homepage link points straight to hol.org/plugins/best-codex-plugins. As of Nov 6 it has 1,525 stars and 455 forks. The other one, awesome-ai-plugins, has 995 stars and 967 forks. The fork count nearly matches the star count because authors who want their plugin listed have to fork first and then open a PR. Authors who want to chart will star it and share the link.

**Turning monetization into distribution.** The affiliate program pays 25% recurring for 12 months, and its recruiting page explicitly looks for creators who make Claude Code, Cursor and Codex content (hol.org/guard/affiliates). The logo slot in the README and the directory's featured spots are sold monthly from $50 (hol.org/advertise). There's also a points leaderboard encouraging outside developers to write extensions for Guard. A Reddit user actually did: the post is titled "Code map extension for HOL Guard," and says: "My options were either approve every call by hand (hundreds of harmless file reads) or approve none." So they wrote an extension for Guard and cross-posted it to r/AI_Agents, r/coolgithubprojects and r/devtools.

**Shipping releases often.** hol-guard has 220 versions on PyPI and plugin-scanner has 995. Frequent releases keep visibility up, but they also inflate download counts, since CI re-pulls the package every time.

**X ads.** The site loads X's ad-conversion pixel, and the cookie notice says it's for "measuring ad performance," but no active creatives turned up (unverified).

### Who it's competing with

The category is crowded:

| Competitors | What it is | Scale | How it differs from HOL Guard |
|---|---|---|---|
| Claude Code permission settings and sandbox, Codex CLI sandbox, etc. | Built in | Every user has it | Only covers its own agent, rules are yours to write |
| NVIDIA SkillSpector | Open source | 24,652 stars | Statically scans skills, no runtime blocking |
| microsoft/agent-governance-toolkit | Open source | 6,528 stars | Enterprise governance framework |
| destructive_command_guard | Open source (Rust) | 6,271 stars | Only blocks destructive commands |
| snyk/agent-scan | Open source + commercial | 3,217 stars | Scans MCP config, enterprise-leaning |
| Aikido safe-chain, Socket Firewall | Open source / commercial | safe-chain has 1,852 stars | Only covers package managers |
| Belay, agentjail, rampart, shellfirm and others | Small open source projects | Tens to about 950 stars | Overlapping features, most cover only one or two agents |
| Lasso, Pillar, Sysdig AI Defense | Enterprise SaaS | enterprise customers | Closed-source gateways sold to security teams |

GitHub stars: hol-guard 1,073 (11-07). By stars alone it doesn't lead the category. What it has extra is coverage, plus the whole distribution stack above. The directory side has competitors too: SkillsLLM and skillsdirectory use the same format.

### Why it took off at all

The timing is real. Coding agents went mainstream in 2026, and incidents involving MCP and skill poisoning, accidental `rm -rf` deletions and secret leaks kept piling up, so "antivirus for agents" needs no explaining. But the product itself isn't very differentiated: plenty of small projects do similar things, and the vendors are building sandboxes in. What made it take off comes down to three things followers can't easily copy: an existing organization and ecosystem, a three-letter .org, and a distribution push that's hard for one person to match, with directories, ranking pages, awesome lists, affiliates, ad slots and per-community posts all running at once. Few people know about it so far: one security-press interview, one review, 99 votes on PH. No Show HN turned up on Hacker News, and no prominent voices are talking about it.

### If it were you

**Verdict:** Building another "agent firewall" isn't worth it: the category is full, the vendors are catching up, and NVIDIA and Microsoft already occupy the star-count ceiling. What's worth taking is its second-wave move: **for an agent ecosystem that's still growing, build a plugin directory with security scores, one page per plugin, plus a row of best-X ranking pages to capture search.**

**Who it suits:** indie developers who can write scrapers and static sites, understand a bit of SEO, and use some agent tool every day.

**Who it doesn't suit:** anyone hoping to make money from selling security-tool subscriptions. HOL itself can't say how many people use it, and the paid tier only sells sync and teams. It's also a poor fit for anyone who only wants an English Claude Code or Codex plugin directory, since HOL, SkillsLLM and skillsdirectory already compete there.

**How to do it:** pick an ecosystem or language whose big directories aren't thorough yet, for example plugins and MCP servers for CLIs Chinese developers use like Kimi, Qwen, DeepSeek or Zhipu, or skill packs for a specific vertical. Pull from GitHub, give each entry its own page that spells out permissions, which files it reads, whether it touches the network and how to install it, then build "the best X Y plugins" ranking pages. For security scans, start with an existing open-source scanner rather than writing your own.

**How to get users:** do what it did: run an awesome repo that points to your ranking pages and takes listings by PR, post separately in each agent community, and start an affiliate program early to recruit bloggers and video creators who make tutorials for these tools.

**When it would stop being true:** before the first half of 2027. Once the official plugin marketplaces (Claude Code and Codex each have their own) add ratings and search, third-party directories are left with only the long tail and non-English markets (inferred).

**How we'd know we misread it:** the page has been live for three months, search engines have indexed it, yet it gets almost no clicks; or the agent ecosystem you picked ships its own official plugin marketplace with safety ratings.

[Website ↗](https://hol.org)

**Research notes: competitor table, acquisition evidence, full research report**

Competitors

| Name | Where | Launched | Scale | How it differs from this one |
|---|---|---|---|---|
| Claude Code hooks / sandbox, Codex CLI sandbox and other official controls | Big-company features | 2025-2026 | Ships by default with the product | Official tools only cover their own agent and rules are hand-written; HOL runs one unified policy across 16 agents, with ready-made detection rules and receipts |
| destructive_command_guard | Open source | 2026-01 | 6,271 stars | Only blocks destructive commands; HOL also covers secrets, package supply chain, MCP and plugins |
| NVIDIA SkillSpector | Open source | 2026-03 | 24,652 stars | Static scanning of skills; HOL does runtime blocking |
| snyk/agent-scan (formerly mcp-scan) | Open source | 2025-04 | 3,217 stars | Scans MCP and skill configs, enterprise-leaning; HOL is a free, local CLI aimed at individual developers |
| Aikido safe-chain / Socket Firewall | Open source | 2025 | safe-chain has 1,852 stars | Only covers package managers; HOL's package-manager shims and agent actions are governed together |
| microsoft/agent-governance-toolkit | Open source | 2026-03 | 6,528 stars | Enterprise governance framework; HOL works out of the box |
| Belay, agentjail, rampart, shellfirm and others | Open source | 2026 | Tens to about 950 stars | Overlapping features, most support only one or two agents, and none have a directory, media or organization resources |
| Lasso / Pillar / Sysdig AI Defense | Other | 2024-2026 | Enterprise SaaS | Closed-source enterprise gateway; HOL is open source, local and free |

Where users come from

- **Verified** **a good domain plus an organization migration** : hol.org was a parked page in 2025-11 Wayback, and 2026-05 a GoDaddy joint press release already used hol.org; take over HOL's existing standards, SDKs and the Hedera ecosystem

- **Confirmed** **SEO (plugin directory and best-X listicle pages)** : hol.org/plugins indexes 50,408 plugins (10-26), plus best-claude/codex/grok/kimi/deepseek/cursor/mcp-plugins pages, CVE pages and compare pages; during the second Tranco climb, Guard downloads actually fell

- **Confirmed** **Traffic from its own GitHub awesome lists** : awesome-codex-plugins has 1,519 stars (homepage points to hol.org/plugins/best-codex-plugins), awesome-ai-plugins has 995 stars / 967 forks

- **Confirmed** **Security media and directory sites** : Help Net Security ran 2026-08-25 interview; AppSecSanta reviews, daily.dev, infrabase and cursor.directory list it

- **Confirmed** **Product Hunt** : launched 2026-07-23, 99 votes, #18 of the day

- **Confirmed** **Team posts on Reddit** : "I helped build / I work on HOL Guard" posts across subreddits like r/IMadeThis, r/GeminiAI, r/aiagents and r/ClaudeWorkflows

- **Confirmed** **Affiliate program and README ad slots** : 25% commission for 12 months, recruiting Claude Code / Cursor content creators; README logo slots from $50/month

- Inferred **X ads** : the site has the X ads conversion pixel installed, but we found no live ad creative

## Why hol.org shows up in the data at all

> Channel: web (Tranco climb recall, pool C1). Research date 2026-11-07.

### Bottom line

hol.org is the new .org main site for Hashgraph Online (HOL), the DAO that builds agent standards in the Hedera ecosystem. Its traffic does **not come from a single product** . Two lines stack on top of each other:

1. **HOL Guard** : an open-source runtime firewall for AI coding agents. From 2026-07 to 08 it built momentum through Product Hunt, security outlets like Help Net Security, and team posts across Reddit communities. That matches the first Tranco jump in August.

2. **HOL Plugins Registry** : a directory of over 50k plugins, skills and MCP servers, plus a batch of long-tail SEO pages `best-*-plugins`, and referral traffic from its own awesome-*-plugins repos. That matches the second climb starting in late October. In this stretch, hol-guard's PyPI downloads actually halved.

The differentiator is **one tool across 16 agents, free and local, open source, and sending nothing by default** . Official hooks, sandboxes and most small competing projects each cover just one agent. But the reason it got this far lies more in the organization's resources plus an aggressive distribution playbook (acquiring a good domain, building directory SEO, running an affiliate program, selling README ad slots, running a Points incentive for contributors) than in the product alone.

### What it is

- Main site hol.org: HOL Guard, Plugins Registry, Registry Broker (agent discovery across Agentverse, Olas, Virtuals, NEAR, A2A, ERC-8004), and HCS standards docs (https://hol.org/, [hol.org/blog/what-is-hol](https://hol.org/blog/what-is-hol), 2026-10-26). Operator is Hashgraph Online DAO LLC, registered in the Marshall Islands.

- HOL Guard: before Claude Code, Codex, Cursor, Gemini/Antigravity CLI, OpenCode, Hermes, OpenClaw, Copilot CLI, Kimi, Grok and similar tools run shell commands, read secrets, install packages or call MCP, it returns allow / ask / block and keeps a local receipt (https://github.com/hashgraph-online/hol-guard). It has four modes: Gentle, Balanced (default), Strict and Paranoid. A single check takes under 50ms and it runs offline (Help Net Security, 2026-08-25).

- Pricing: free forever locally. Guard Cloud sells sync and team features: Solo $4.99/month, Pro $15/month, Team $30/seat/month, plus an enterprise tier (https://hol.org/guard/pricing).

- Traffic lands mainly on the **web** , with no app. Guard itself is a CLI (PyPI `hol-guard`, npx), and the local dashboard uses hol.org/guard/home as its cloud entry point.

### Data

| Metric | Value | Source |
|---|---|---|
| Tranco | 2026-08-13 734,141 → 08-27 275,752 → 10-06 258,881 → 10-21 301,369 (pullback) → 11-05 **185,285** | traffic.rank_day |
| CrUX | Not in the global top 1M; 5–September it appears only sporadically, in id and ph (top 500k) and in country charts like vn, br, in and fr | traffic.crux_domain |
| hol-guard PyPI monthly downloads (excluding mirrors) | April 9.5k, May 48.6k, June 97.9k, July 66.8k, August 90.9k, September 88.5k, **October 41.3k** | pypistats.org,2026-11-07 |
| plugin-scanner PyPI monthly downloads | June 110k, August 43k, September 56.7k, **October 77.9k** | pypistats.org |
| Release cadence | hol-guard has 220 releases in total (2.0.1004 → 3.60.0a25); plugin-scanner has 995 releases in total. Download counts are inflated by CI and frequent releases. | PyPI JSON |
| GitHub | hol-guard 1,073 stars / 250 forks (10-28 is 1,004, gaining 2–13 per day); awesome-codex-plugins 1,519 stars / 453 forks (08-29 is 856); awesome-ai-plugins 995 stars / **967 forks** ; standards-sdk 1,280 stars | github.repo_day, as of 11-07 |
| Product Hunt | Launched 2026-07-23, 99 votes, #18 of the day, 194 followers | producthunt.product_profile |
| HN | Our library has no Show HN for hol.org | hackernews.story |

How to read these numbers: the first Tranco jump (Aug 13 to 27, rank up about 2.7x) lines up with PH (7-23), Help Net Security (8-25) and the August rebound in hol-guard downloads. The second stretch (from 10-21, 300k to 185k) happened while hol-guard downloads were halving. Over the same period plugin-scanner downloads and the plugin directory SEO pages were growing, which suggests **the new traffic looks more like it came from the plugin directory and search** than from new Guard users. CrUX doesn't put it in the global top 1M, so real Chrome traffic is still small. Tranco rank may also include DNS traffic from the CLI and the Registry API (`hol.org/registry/api/v1`) (inferred).

### Domain

- In the 2025-11-08 Wayback snapshots, hol.org redirected to a modelbuk.com parked page, which means it was **parked / for-sale at the time** (web.archive.org).

- A joint press release from GoDaddy and HOL already linked to hol.org as of 2026-05-07 (GoDaddy newsroom). So HOL acquired this three-letter .org between 2025-11 and 2026-05 and moved it over from hashgraphonline.com (hashgraphonline.com is not in our Tranco top 1M). This is an old domain changing hands, with an established organization taking over, not a new site.

### Competitors

| Competitors | Form | Launched | Scale | How it differs from HOL Guard |
|---|---|---|---|---|
| Claude Code hooks / permission allowlist / sandbox; Codex CLI sandbox; Copilot and Gemini CLI ship their own sandboxes | Big-company features | 2025–2026 | Installed by default for every user | Only covers one agent and rules must be written by hand; HOL is one unified policy across 16 agents, with ready-made detection rules and receipts |
| Dicklesworthstone/destructive_command_guard | Open source (Rust hook) | 2026-01 | 6,271 stars | Only blocks destructive commands; HOL also covers secrets, package supply chain, MCP and plugins |
| NVIDIA/SkillSpector | Open source | 2026-03 | 24,652 stars (+1,140 over 7 days) | Static scanning of skills; HOL does runtime blocking, with plugin-scanner handling static scanning |
| snyk/agent-scan (formerly Invariant mcp-scan) | Open source + commercial | 2025-04 | 3,217 stars | Scans MCP and skill configs with an enterprise security focus; HOL targets individual developers and is free and local |
| AikidoSec/safe-chain, Socket Firewall | Open source / commercial | 2025 | safe-chain has 1,852 stars | Only covers package-manager supply chain; HOL wraps 15 package-manager shims plus agent actions |
| microsoft/agent-governance-toolkit | Open source | 2026-03 | 6,528 stars | Enterprise governance frameworks; HOL is a CLI you can install and use right away |
| Belay (SECBLOK), Nixis, jev-firewall, agentjail, peg/rampart, shellfirm, agentlint and others | Small open source projects | 2026 | Tens to about 950 stars | Overlapping features, mostly supporting just one or two agents, with no organization, catalog, or media coverage |
| Lasso, Pillar, Sysdig AI Defense, Prompt Security, and others | Commercial SaaS | 2024–2026 | enterprise customers | Enterprise gateways / monitoring sold to companies; HOL is free, local, and open source |

Verdict: this category is **crowded** . There are a dozen-plus competitors on GitHub alone, and vendors are adding sandboxing too. HOL Guard's star count isn't standout among them (1k, versus dcg at 6k and SkillSpector at 24k). Its strengths are coverage and distribution.

### Growth tactics (evidence)

1. **A good domain plus an established org migration** : hol.org is a three-letter .org that picked up HOL's existing standards, SDKs, and Hedera ecosystem developers (standards-sdk has 1,280 stars). The GoDaddy joint standard (2026-05) and the Partner Program bring trust. Confirmed.

2. **A plugin directory plus long-tail SEO** : hol.org/plugins lists 50,408 plugins (10-26), each with a trust score and install command, which amounts to 50k searchable landing pages. There are also `best-claude-plugins`, `best-codex-plugins`, `best-grok-plugins`, `best-kimi-plugins`, `best-deepseek-plugins`, `best-cursor-plugins`, and `best-mcp-plugins` pages, plus Guard's harness pages, CVE/advisories pages, and compare pages (e.g. "Best AI Agent Security Platforms"). These pages exist; there's no data on how much traffic they bring.

3. **Self-owned awesome lists as referral funnels** : awesome-codex-plugins (its description reads "The #1 Codex Marketplace," with its homepage pointing to hol.org/plugins/best-codex-plugins) and awesome-ai-plugins. Others submit plugins via PR, so forks come close to matching stars (967/995). Confirmed.

4. **Media and directory sites** : Help Net Security interviewed president Michael Kantor (2026-08-25), AppSecSanta wrote a review, and daily.dev, infrabase.ai, agentsecurityindex, cursor.directory, skillsdirectory, and skillsllm all list it; developersdigest also ran a comparison. Confirmed.

5. **Product Hunt** : launched 2026-07-23, got 99 votes, ranked #18 for the day. Not big. Confirmed.

6. **The team seeding Reddit itself** : r/IMadeThis ("I helped build…"), r/GeminiAI, r/aiagents ("I work on HOL Guard…"), r/ClaudeWorkflows, and r/coolgithubprojects (a third party wrote an extension for Guard), with one post per agent community. Confirmed.

7. **Monetizing as distribution** : the affiliate program pays 25% commission for 12 months and explicitly recruits content creators for Claude Code, Cursor, and Codex (https://hol.org/guard/affiliates); README logo slots and directory placements sell from $50/month (https://hol.org/advertise); there's also a HOL Points leaderboard and an Open Source Impact program that rewards outside contributions to extensions. The programs exist; their results are unknown.

8. **X ads** : the site runs the X (Twitter) ad conversion pixel, and the cookie banner says "measure advertising." That shows they're measuring ad spend, but no live creatives were found. Unconfirmed.

9. **Partner-driven traffic** : for example, @yanez__ai posted that they'd add biometric approval to HOL Guard (X). Small volume. Confirmed.

### Why it took off

- **Timing** : in 2026, coding agents went mainstream, and incidents involving MCP and skill poisoning, `rm -rf`, and secret exfiltration kept happening, so "antivirus for your agent" became a must-have story. Help Net Security's headline is literally "open-source antivirus for AI agents."

- **Coverage** : one tool covers 16 agents, 137 command extensions, and 15 package-manager shims, so switching agents doesn't mean switching security tools. Most small competitors support only one.

- **Low trust barrier** : Apache-2.0 licensed, runs locally, reports nothing by default, and the detection rules are public. For developers, that's far easier to adopt than a closed SaaS.

- **Resources** : a three-letter domain, an established Hedera ecosystem team, and a GoDaddy standards partnership. Individual developers don't start with these advantages.

- **Distribution is relentless** : directories, SEO, awesome lists, Reddit, affiliates, ad placements, all at once. And 220 multiple Guard versions and nearly a thousand scanner versions keep shipping to stay visible. The second climb in Tranco came mostly from directory SEO, not from Guard itself.

### Differentiation

"Cross-agent, free and local, open source" plus "a plugin directory that gives every plugin a trust score." The directory pulls in people looking for plugins, and Guard catches the risk after installation, so the two feed each other. This combination is unique in its category. On blocking capability alone, competitors and official features are catching up fast. Distribution and resources are the main reasons it grew; differentiation is secondary.

### Visibility

It's circulating in small circles. Evidence: a Help Net Security interview, an AppSecSanta review, and 99 PH votes. No HN hot thread, no major influencer discussion (nothing in the x-radar corpus), and no public revenue (paid tier is only the Cloud subscription, not publicly listed on TrustMRR).

### Copycats

Many open-source guards exist (Belay, agentjail, rampart, jev-firewall, Nixis, etc.), but most appeared in parallel, and there's no confirmation any of them copied HOL. The "AI plugin directory with trust scores" format is also being built by SkillsLLM, skillsdirectory, and others.

### Takeaways

- Use a "directory + one page per entry + best-X list pages" structure for long-tail SEO, funnel traffic through your own awesome repo, and make external submissions go through PRs so forks and stars grow together.

- The local open-source version is free; the cloud sells only cross-device sync and team policies, lowering the install barrier.

- Launch an affiliate program early (targeting Claude Code and Cursor content creators directly) and sell README ad slots, turning distribution into a business that runs itself.

- Post separately in each agent community, framed as "here's how to protect your agent."

### Uncertain

- In the Tranco ranking, what share comes from web visits, CLI and Registry API calls, and DNS traffic; CrUX has no global rank, and real visits may be small.

- Guard's actual retention and number of paying users: the president himself says there's no data, because telemetry is off by default.

- Whether HBAR/Hedera Foundation funding is involved (unverified).

- How much was spent on X ads.

- Of the downloads above 550k, how many come from frequent releases and CI pulls.

This article was written by AI from public data and the data we collect daily. Numbers are sourced, and inferences are labeled.