Your antivirus has never heard of the things that actually reach your machine.
Hound refuses a malicious binary at launch and reads your lockfiles against 235,577 packages that exist only to attack you — the poisoned dependency, the model file that runs code when it loads, the install script that fires before you have imported a line. Built for the machines you ship software from.
What compromises a Linux dev machine is not a Windows virus.
Every other scanner is looking for the wrong thing. Their databases are overwhelmingly Windows malware — useful on a file server relaying infections, irrelevant to the laptop you write code on. What actually reaches a developer machine arrives through a dependency, a model file, or a repository you cloned. That is what Hound is built to catch.
Dependencies that are malware
A typosquat one keystroke off a real package. A name your AI assistant hallucinated that an attacker then registered and filled with a payload. Hound reads the lockfile, so it catches what will be installed — before the install script ever runs.
Stopped at launch, not flagged after
Most tools tell you about the malware that already ran. Hound denies the execve itself, in about two milliseconds, built on fanotify. A watchdog fails the gate open — a bug in your antivirus must never be the thing that freezes your machine.
Weights that are really programs
A pickle-based .pt or .ckpt runs arbitrary code the moment you load it — torch.load is a code-execution decision most people make by reflex. Hound reads the pickle opcodes and tells you before you find out the hard way.
What changed since last time
Half of a Linux compromise is a line added to a startup file, not a file on disk. Hound keeps a hashed ledger of systemd units, cron, autostart, shell profiles and authorized_keys, and reports what moved.
Code that runs on npm install
A postinstall hook that pipes a remote script into a shell, decodes something scrambled and runs it, or reaches for your SSH keys. It executes before you have used a line of the package.
Questions with factual answers
A process the kernel has but /proc does not list. A setuid binary no installed package claims. Not guesswork against a list of names that only holds on one distribution.
Your coding assistant can ask Hound before it trusts anything.
You have handed an AI agent the keys to your machine and pointed it at the open internet. Hound ships an MCP server, so Claude, Cursor, VS Code — anything that speaks MCP — can check a repository, a package or a model file before it installs or runs a thing.
{
"mcpServers": {
"hound": {
"command": "/usr/bin/hound-mcp"
}
}
}
// No npx — nothing fetched at launch.
// No env — no secret handed over.
// No path — no directory granted.
//
// Hound flags all three in other
// people's configs. Ours passes its
// own audit.
Four read-only tools
check_project, check_package, check_file, check_mcp_config. There is no quarantine tool and never will be — an assistant that can be persuaded by the repository it is reading must not be able to make your antivirus delete things.
It audits the tools you already trust
Every MCP server in your config runs with your permissions and gets called without asking you. Hound tells you which ones download their code fresh on every launch, and which ones you handed a token.
Written to be read twice
Once by the model, once by you. No rule identifiers, no jargon, and a clean result says what it did not check — because "nothing wrong" that reads as a blanket endorsement is worse than no answer.
The scanner is free. The blocking and the feed are not.
Everything that runs on your own machine — scanning, quarantine, the supply-chain and agent-era checks, the MCP server — is free forever, no account and no expiry. What you pay for is the part that costs real money to build and serve: refusing execution at launch, and the full malicious-package feed.
Free
Everyone. No account, no telemetry, no expiry.
- On-demand scanning, CLI and desktop app
- Recent malicious-package feed — the latest known-bad packages, plus typosquat, install-script and model-file checks
- Real-time file protection and quarantine vault
- MCP server for your coding assistant
- Rootkit and persistence checks
Apache-2.0. Yours to read and to fork.
Pro
One machine, for someone who builds software on it.
- Everything in Free
- Execution gate — a malicious binary is refused before it runs, in 2 ms
- The full feed — all 235,577 indicators, refreshed daily, new threats within hours of disclosure
- Hound Linux threat pack — miners, backdoors, rootkits, webshells
- Signed definitions, delivered as incremental updates
Annual only. Billed once, cancel any time.
Fleet
3-seat minimum. Annual billing at 10 months' price.
- Everything in Pro, on every machine
- Central console, enrolment and policy push
- Compliance reports an auditor accepts
- Air-gapped definition mirrors
- Priority support and a named contact
Over 25 seats? Volume pricing available.
One command, then it is running.
Ubuntu, Debian and Linux Mint today. The execution gate ships switched off — it needs root and covers your whole filesystem, so turning it on is your decision rather than the installer's.
Debian, Ubuntu, Mint
curl -fsSL https://dl.houndav.com/deb/hound_latest_amd64.deb -o hound.deb && sudo apt install ./hound.debTry it without installing
curl -fsSL https://dl.houndav.com/appimage/Hound-latest-x86_64.AppImage -o hound && chmod +x hound && ./hound statusThe AppImage runs as your user and leaves nothing behind. It cannot do the execution gate — that needs privileges an uninstalled bundle does not have — and it will tell you so rather than failing quietly.
What people ask before installing it.
Is Hound an antivirus?
Partly, and the interesting part is not. Hound does scan files and quarantine malware, but traditional antivirus databases are overwhelmingly Windows malware, which is close to irrelevant on a Linux developer machine. What actually compromises those machines is a dependency, a model file or a repository, so most of Hound is supply-chain and agent-era detection rather than file signatures.
How is Hound different from ClamAV?
ClamAV's corpus is mostly Windows malware, useful if you are a file server passing infections along to Windows clients. Hound is Linux-native: it refuses a malicious binary at execve rather than reporting it afterwards, and its 235,577 indicators are packages that exist only to be malware, drawn from the OSSF malicious-packages feed. Hound can use clamd alongside it for the Windows-carrier case, but does not require it.
Does Hound slow my machine down?
The execution gate adds about 0.8 milliseconds to a program starting, and sustains over 4,000 executions per second. On a server running 21 containers, 16 Node processes and a web server, arming it did not move request latency or load average. A verdict cache means a program you have already run is answered from memory without re-reading it.
What happens if Hound crashes while it is blocking programs?
Nothing. The gate fails open: a watchdog releases any execution that has not been answered within 500 milliseconds, and if the daemon dies outright the kernel releases everything pending when its descriptor closes. A bug in an antivirus must never be able to freeze a machine, so that path is tested rather than assumed.
Is Hound open source?
The agent is Apache-2.0 and the source is public. You are being asked to run a root daemon that can block execution, so you should be able to read it. Definitions are signed with a key whose public half is compiled into the binary, so anyone can verify that the definitions they received are the ones that were published. What is paid for is the threat feed, the console and support.
Can my coding assistant use Hound?
Yes. Hound ships an MCP server with four read-only tools, so Claude, Cursor, VS Code or anything else that speaks MCP can check a project before installing its dependencies, check a single package or model file, and audit the MCP servers it is already trusting. There is deliberately no tool that can delete or quarantine anything: an assistant that can be persuaded by the repository it is reading must not be able to make your antivirus destroy files.
What does Hound detect that other scanners do not?
Packages whose install script pipes a remote script into a shell before you have used any of their code. Package names an AI invented that somebody then registered. Model files whose pickle stream calls os.system when loaded. Instructions in CLAUDE.md or .cursorrules aimed at your assistant rather than at you. MCP servers downloaded fresh from the internet on every launch and handed an API token. Setuid binaries no installed package claims.
Does Hound phone home?
No telemetry by default, and it can run fully offline with definitions imported from a file, which is how it works in air-gapped and regulated environments. The only network request it makes is fetching signed definition packs, and you can point that at your own mirror.
Which Linux distributions does Hound support?
Ubuntu, Debian and Linux Mint have packages today. An AppImage runs anywhere without installing, though it cannot provide the execution gate, which needs privileges an uninstalled bundle does not have. RPM and Arch packaging exists but is not yet built and published.
You are installing a root daemon that can block execution.
So you should be able to read it. The agent is Apache-2.0 and the definitions are signed with a key whose public half is compiled into the binary — anyone can verify that what they received is what we published. What you pay for is the threat feed, the console and support, not permission to look.