Policy enforcement for AI agent tool calls has a simple problem: most approaches catch bad actions after they happen. Vaikora Guard MCP sits inline between an agent and the tools it calls, evaluates each call against policy, and either allows, blocks, modifies, or holds it for approval before anything executes.
The proxy is MIT-licensed, self-hostable, and compatible with the Model Context Protocol (MCP). You can read the source, fork it, and run it inside your own infrastructure without calling home to a vendor.
What the Proxy Actually Intercepts
When an AI agent constructs a tool call, the request passes through Vaikora Guard MCP before it reaches the target: an LLM endpoint, a file system, a database, an external API. The proxy deserializes the call, evaluates it against the configured policy set, and returns one of four deterministic decisions.
- Allow: the call proceeds unchanged.
- Block: the call is rejected and the agent receives a structured error.
- Modify: the proxy rewrites parameters (for example, stripping a sensitive field from a payload) and forwards the sanitized version.
- Require approval: the call is queued and an out-of-band approval workflow fires before execution continues.
No action executes without a policy decision. That ordering is the point.
How Policy Is Defined
Policies are declarative configuration. You write rules that describe which agent, which tool, which parameter shape, and which conditions trigger which decision. A rule might say: any call to a file-write tool that targets a path outside `/tmp` requires approval. Another might say: any LLM call that includes a token matching a secrets pattern gets blocked outright.
The proxy ships with compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. Those presets are starting points, not black boxes. You can read exactly what they enforce and extend them.
Because the proxy is open source, your security team can audit every decision branch. There is no hidden logic.
Audit Log Design
Every decision the proxy makes is written to a SHA-256 hash-chained, tamper-evident audit log. Each entry records the agent identity, the tool called, the parameters, the policy that matched, and the decision taken, with a timestamp.
Hash chaining means you can verify that no entry was retroactively altered or deleted. If a compliance auditor asks what your AI agent did on a specific date, you have a verifiable answer, not a best-effort reconstruction from application logs.
This matters for regulated environments where auditability is a control requirement, not a nice-to-have.
Performance at Runtime
The proxy adds enforcement latency of 8ms at P50 and 45ms at P99. For the workflows where an agent is calling tools sequentially, that overhead is imperceptible. For high-throughput pipelines, the proxy handles more than 10,000 actions per second.
Detection accuracy in testing is 99.9%. That figure reflects the proxy’s policy evaluation engine, not probabilistic classification. Because decisions are deterministic against defined rules, there is no inherent false-positive/false-negative tradeoff the way there is with ML-based detection.
Fitting Into an Existing Stack
The proxy supports 12 LLM providers. You do not need to migrate SDKs or rewrite agent code. You configure the endpoint to route through the proxy and set your policy.
For teams already running a SIEM or EDR, Vaikora Guard MCP integrates with Microsoft Sentinel, Microsoft Defender, SentinelOne, CrowdStrike Falcon, and AWS Security Hub. Threats surfaced at the proxy get pushed into those platforms as native signals. High-severity AI agent risk promotes into Azure Security Center and Microsoft Defender for Cloud as incidents without custom engineering. Indicators go into SentinelOne with severity scores mapped to numeric values (Critical=100, High=75, Medium=50, Low=25).
That means the enforcement layer feeds directly into the investigation and response workflows your SOC already runs, rather than creating a parallel queue.
Worked Example: A Data Exfiltration Attempt
An agent is given a task that requires reading a customer record and summarizing it. Midway through execution, the agent constructs a second tool call to POST that record to an external webhook URL not in the allowlist.
Without enforcement, the call fires. With Vaikora Guard MCP in place, the proxy evaluates the call, matches it against a rule that blocks outbound data transfers to non-approved endpoints, records the decision to the audit log, and returns a block response to the agent. The agent logs an error and stops. The record never leaves the environment.
The audit entry captures the agent ID, the attempted tool call, the matched policy rule, and the timestamp, all in the tamper-evident chain.
What to Do Next
The open-source proxy and its documentation are the right place to start. Review the policy schema, run it locally against a test agent, and examine the audit log output before deploying to a production environment. Data443’s Vaikora page has links to the repository and the enterprise control plane for teams that need centralized policy management across multiple agents.
If you are already running one of the supported SIEM or EDR platforms, check whether your existing detection rules cover AI agent tool calls as a distinct event class. Most do not yet, and that gap is worth closing before agents go into production.