A tool call with no policy check is a loaded question with no answer process. The MCP protocol is good at routing calls between agents and tools. It was not designed to decide whether a call should run at all.
Vaikora Guard MCP is an MIT-licensed, self-hostable proxy that sits inline between an AI agent and its tools and enforces a policy decision before each call executes. It is published on PyPI as `vaikora-guard-mcp`, written in Python, and open-source under terms that let you inspect, fork, and self-host without restriction.
What Problem It Solves
The MCP protocol routes. That is what it is good at. When an agent calls `read_file("/etc/passwd")` or `send_email(to="external@competitor.com", body=<draft>)`, something has to decide whether that call is allowed before the underlying function fires.
Without a gate, the decision defaults to "allowed unless the tool itself refuses," which puts enforcement logic inside every tool implementation. That approach does not scale, is not auditable across tools, and breaks when a new tool is added without the same internal checks.
Vaikora Guard MCP moves that decision to a single inspection point. Every tool call passes through the proxy. The proxy evaluates it against policy. The outcome is allow, block, modify, or require-approval. Only after that decision does execution proceed or stop.
How the Proxy Works
The proxy is MCP-compatible, so no SDK migration is required on the agent side. You configure it, point your agent’s MCP transport at the proxy endpoint, and the proxy forwards calls to the real MCP server only if policy permits.
The gateway ships six content inspection modules. These check the call arguments, tool identity, data sensitivity signals, and context before returning a decision. The inspection happens synchronously, inline, so the agent receives a structured response either way.
A concrete example: an agent is configured to summarize documents and email the results. The policy rule says external email recipients are blocked for documents tagged as confidential. The agent calls `send_email` with a confidential document in the body. The proxy inspects the call, matches the recipient pattern against the external-recipient rule, and returns a block decision. The email tool never fires. The agent receives the block response and can surface it to the user or halt the workflow.
Every decision, whether allow, block, modify, or require-approval, gets written to a SHA-256 hash-chained, tamper-evident audit log. The chain ordering means any deletion or modification of a prior entry breaks the chain at that point, which is detectable on verification.
Deterministic Policy Enforcement
The enforcement model is deterministic. Identical input always produces an identical decision. There is no probabilistic scoring that might allow a call one time and block it the next. This matters for compliance workflows where an auditor needs to trace why a specific call was or was not executed.
Vaikora ships compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. The presets give you a starting policy baseline for regulated environments without writing every rule from scratch.
Self-Hosting and the Enterprise Control Plane
The proxy is self-hosted. You run it in your own infrastructure, which means call arguments and document content never leave your environment for policy evaluation. The Vaikora Control Plane, the commercial product hosted by Data443, adds centralized policy management, dashboard visibility, and integrations with Microsoft Sentinel, Microsoft Defender, SentinelOne, CrowdStrike Falcon, and AWS Security Hub.
For teams that only need the open-source proxy, the self-hosted path gives you the enforcement gate and the audit log. For security operations teams that need those AI agent decisions pushed into their existing detection and response stack, the Control Plane handles that without custom engineering.
What to Check Before Deploying
Before you put the proxy in front of a production agent workflow, verify three things.
- Policy scope: Which tool calls are in scope for enforcement? Unscoped proxies that apply rules inconsistently create gaps.
- Audit log retention: The hash-chained log is only useful if it is retained long enough to satisfy your compliance obligations and stored where it cannot be overwritten by the agent runtime.
- Require-approval routing: If you use the require-approval decision class, decide in advance where approval requests go and what the timeout behavior is. An agent that hangs waiting for approval can block downstream workflows.
The `vaikora-guard-mcp` package is on PyPI. The source is available under the MIT license. Start with the documentation on allowed and blocked decision classes before writing custom rules, since the default presets cover most common enforcement patterns for regulated data environments.