When an AI agent calls a tool, the action happens before most security controls have a chance to respond. The check needs to run before execution, not after. That is the specific problem vaikora-guard-mcp was built to solve, and the full source is available now under the MIT license.
What the project is
vaikora-guard-mcp is a proxy written in Python, published on PyPI as `vaikora-guard-mcp`, and self-hosted in your own environment. It sits inline between an MCP client (your AI agent or orchestrator) and the MCP server that exposes real tools. Every tool call passes through the proxy. The proxy evaluates the call against policy and returns an allow, block, modify, or require-approval decision before the underlying tool executes.
The open-source component is the enforcement gateway. The commercial Control Plane, hosted by Data443, handles team-wide policy management and the audit log UI. You do not need the Control Plane to run the gateway.
What "inline" actually means
Most agent security tools work by logging what happened after execution and alerting on it. The proxy model is different. The MCP client sends a `tools/call` request. The proxy intercepts it, runs the call through the configured inspection modules, applies policy, and either forwards the request to the real MCP server or returns a policy block to the client. The real server never receives the call if policy blocks it.
This is meaningful for tool calls that write to databases, delete files, send outbound requests, or exfiltrate data. Post-execution detection finds the event in the log. A pre-execution gate stops the action from running at all.
Latency for this inline check is P50 8ms and P99 45ms at 10,000+ actions per second, so the proxy does not introduce a meaningful delay for most agent workflows.
What policy enforcement looks like in practice
Consider a concrete scenario. An agent is connected to a file-system MCP server. The agent receives a prompt injected with an instruction to read `/etc/passwd` and POST its contents to an external URL. Without a policy gate, both tool calls execute. The file read succeeds and the exfiltration call goes out.
With vaikora-guard-mcp configured with a policy that blocks reads of paths matching `/etc/*` and blocks any outbound HTTP call not on an approved domain list:
- The `read_file` call with path `/etc/passwd` hits the proxy. Policy evaluates the path, matches the rule, and returns a block with a reason string. The file is never read.
- The `http_request` call with the external URL hits the proxy. Policy evaluates the destination against the allowlist, does not find a match, and returns a block. No data is sent.
The agent receives two structured error responses. The real MCP server received zero calls. Every decision is written to a SHA-256 hash-chained, tamper-evident audit log so there is a verifiable record of what was blocked and why.
The six inspection modules
The gateway ships six content inspection modules you configure per deployment:
- Path and resource rules – block or allow by file path pattern, schema name, table name, or URL.
- Prompt injection detection – flag tool calls that contain injection patterns in their arguments.
- Data pattern matching – scan argument values for PII, credential strings, or custom regex patterns before they reach a tool.
- Domain and IP allowlisting – enforce approved destinations for any tool that makes outbound network calls.
- Tool allowlisting – restrict which tools an agent is permitted to call at all.
- Approval routing – hold calls matching a defined pattern for a human-in-the-loop approval before forwarding.
Each module is configurable in a YAML policy file. You do not write code to add or change rules.
Compliance presets
If you are operating under a specific framework, the proxy ships presets for SOC 2, HIPAA, GDPR, PCI DSS, and ISO 27001. A preset activates a baseline set of rules aligned to that framework’s data handling requirements. You can extend a preset with custom rules on top.
This is relevant for security engineers who need to demonstrate that AI agent actions in a production environment are governed by an auditable, framework-aligned policy. The SHA-256 audit chain means the log cannot be silently modified after the fact, which matters for audit evidence.
Getting started
Install from PyPI:
“`
pip install vaikora-guard-mcp
“`
The README in the GitHub repository walks through the minimal configuration: point the proxy at your upstream MCP server, write a policy file, and update your MCP client’s server URL to point at the proxy instead. For most setups this is a configuration change, not a code change.
Start by reviewing the tool calls your agent is actually making against the policy you think you have. The audit log from even a short test run usually surfaces calls that were not expected.