docs: add optional HOL Guard protection for Cursor MCP calls - #389
Open
kantorcodes wants to merge 1 commit into
Open
docs: add optional HOL Guard protection for Cursor MCP calls#389kantorcodes wants to merge 1 commit into
kantorcodes wants to merge 1 commit into
Conversation
kantorcodes
force-pushed
the
docs/hol-guard-protected-windows-mcp
branch
from
August 27, 2026 13:09
8b78ecc to
3fc491a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Documents an optional HOL Guard pre-execution protection path for Windows-MCP when it is used from Cursor.
The SECURITY.md addition:
pipx install hol-guard;uvx windows-mcp serveconfiguration in.cursor/mcp.json;hol-guard install cursorand verifies it withhol-guard doctor cursor;beforeMCPExecutionpath blocks the MCP invocation before the corresponding Windows-MCP tool call executes;Motivation
Windows-MCP's security policy correctly emphasizes that its tools perform real OS actions and are not sandboxed. This adds a concrete, optional defense-in-depth setup for users who want local pre-execution policy on MCP calls without changing Windows-MCP itself.
Testing
Documentation-only change. The branch is based directly on current upstream
main(c3b59aeaf7fce6ef1793fec936e2713a70249272) and differs by one file, +36/-0. The Windows-MCP command/config matches the current README, and the HOL Guard commands andbeforeMCPExecutionbehavior were cross-checked against HOL Guard's current Cursor protection contract and setup guide.No runtime code is changed.