Most MCP servers do exactly one thing: pass a tool call from an agent to the underlying function and return the result. There is no inspection step, no policy check, and no audit record. If the agent decides to call a tool that deletes records or exfiltrates data, the call runs.
vaikora-guard-mcp is an open-source proxy that sits between the agent and the tools and applies a deterministic policy decision before anything executes.
What the Proxy Actually Does
When an agent issues a tool call, vaikora-guard-mcp intercepts it before the target function receives it. It evaluates the call against a configured policy and returns one of four decisions: allow, block, modify, or require-approval. Only after an allow decision does the call proceed.
The decision is deterministic. Given identical input, the proxy always returns the same output. That matters for auditability: you can replay any decision later and confirm it matched the policy that was active at the time.
Every decision is written to a SHA-256 hash-chained audit log. Each entry is signed into the chain, so any post-hoc modification breaks the chain and is detectable. That record is what a compliance reviewer or incident investigator actually needs.
How to Run It
The package is published on PyPI as `vaikora-guard-mcp`. Install it with:
“`
pip install vaikora-guard-mcp
“`
It is written in Python and licensed MIT, so you can read the source, modify it, and self-host it without restriction. No data leaves your environment unless you connect it to the Vaikora Control Plane, which is a separate commercial product.
A minimal configuration tells the proxy which tools are in scope, what the default decision is for unconfigured calls, and whether require-approval decisions should block and wait or fail open. A worked example: you have an agent that can call `delete_record`, `read_record`, and `send_email`. You set the default to block, explicitly allow `read_record`, and set `delete_record` to require-approval. The agent can read freely. Any delete attempt pauses and waits for a human decision before continuing. `send_email` is blocked entirely until you explicitly add a policy entry for it.
That configuration takes about ten lines of YAML. The proxy handles the rest.
What Gets Logged
Each audit entry contains the tool name, the full input payload, the policy that matched, the decision, and a timestamp. The SHA-256 chain links entries in order, so you get a tamper-evident sequence of every tool call the agent attempted and what happened to it.
This is the record you need to answer the questions that come up in a security review or incident investigation:
- Which tools did this agent call during the window in question?
- Were any calls blocked or held for approval?
- Did the policy in effect at the time match what was documented?
Without a gate like this, those questions are answered by reconstructing logs from wherever they happen to exist, if they exist at all.
Connecting to the Control Plane
The open-source proxy enforces policy locally. If you want centralized policy management across multiple agents, real-time visibility into decisions across your environment, and integration with your existing security tooling, the Vaikora Control Plane adds those capabilities.
Data443’s Vaikora platform integrates natively with Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub. High-severity decisions can be promoted into those platforms as incidents or threat intelligence indicators without custom engineering. The open-source proxy is a valid standalone deployment for teams that want local enforcement and local audit storage. The control plane is for teams that need that signal to appear in their security operations tooling.
Compliance Presets
For teams working under specific regulatory requirements, the proxy ships with presets for SOC 2, HIPAA, GDPR, PCI DSS, and ISO 27001. A preset is a starting policy configuration aligned to the control requirements of that framework. You still need to review and adapt it to your environment, but it gives you a baseline that reflects the actual compliance controls rather than a blank file.
What to Check Next
Pull the vaikora-guard-mcp source on PyPI and read the policy configuration reference before you write your first config. The default-block approach (allow only what you explicitly permit) is safer than default-allow with block rules added over time. Start with the smallest set of tools your agent actually needs, write explicit policy entries for each, and let everything else block. Expand from there as you validate behavior in your environment.