Twelve lines of Python configuration stand between an AI agent and an irreversible action on a production system. That is what vaikora-guard-mcp is designed to enforce: a policy gate that runs before a tool call executes, not a log entry written after the fact.
The package is MIT-licensed, written in Python, and published on PyPI as `vaikora-guard-mcp`. You can install it, point it at your MCP-compatible agent, and start enforcing policy in a single session. The source is public, the license is permissive, and the control plane is optional.
What the Proxy Actually Does
vaikora-guard-mcp sits inline between an AI agent and the tools it calls. Every tool invocation passes through the proxy before execution. The proxy evaluates each call against a configured policy set and returns one of four decisions: allow, block, modify, or require-approval. Only allowed calls proceed. Everything else stops at the gate.
The decision is deterministic. Identical input always produces an identical decision. There is no probabilistic scoring that might let the same call through twice. That property matters for auditability: you can replay a sequence of calls and get the same result every time.
Every decision is written into a SHA-256 hash-chained audit log. The chain is tamper-evident: altering an earlier record breaks the chain, and the break is detectable. That audit trail is what makes the proxy useful for compliance teams, not just security engineers.
What "Inline" Means in Practice
Consider a scenario where an agent is tasked with reading customer records and summarising them. Without a policy gate, the agent can read any record its token permits. With vaikora-guard-mcp inline, the proxy evaluates each read request before it reaches the data store.
If the policy says "block any call that references a field tagged as PII when the agent role is ‘summarisation’", that call stops. The agent receives a block response and, depending on your configuration, either halts or falls through to a require-approval path where a human sees the request before it runs.
The agent never touches the data. The action never executes. That ordering matters because some tool calls, including writes, deletes, and external API calls, cannot be undone once they have run.
Six Content Inspection Modules
The gateway ships six content inspection modules. You configure which modules apply to which tool categories:
- Schema validation: checks that the call matches the expected parameter shape before it reaches the tool
- PII detection: flags calls that pass personal data in arguments or expected return values
- Secret scanning: catches credential patterns such as API keys or tokens in call payloads
- Prompt injection detection: identifies attempts to override or bypass the agent’s system prompt through tool responses
- Data exfiltration signals: flags patterns consistent with bulk extraction, such as unbounded queries or calls to external endpoints
- Policy preset enforcement: applies a named compliance baseline, currently covering SOC 2, HIPAA, GDPR, PCI DSS, and ISO 27001
You do not need all six active for every tool. A module that adds latency to a low-risk read call and adds no policy value is noise. Configure at the tool level.
Latency and Throughput at the Gate
A policy gate that adds seconds to every tool call breaks agent workflows. vaikora-guard-mcp enforces policy at a P50 of 8ms and P99 of 45ms. The gateway handles more than 10,000 actions per second. For most agent architectures, enforcement is not the bottleneck.
Detection accuracy in testing is 99.9%. That figure reflects the deterministic evaluation model: the proxy does not estimate whether a call is risky, it evaluates it against explicit rules.
Running It Without the Control Plane
The proxy is fully functional as a self-hosted component. You do not need the Vaikora Control Plane to use vaikora-guard-mcp. Install from PyPI, write a policy file, and start the proxy. The control plane adds centralised policy management, cross-agent audit aggregation, SIEM integrations, and the enterprise compliance presets, but the core enforcement runs without it.
If your environment requires that no call data leaves your network, self-hosting is the right configuration. The MIT license means you can inspect every line, fork it, and modify it for your deployment.
For teams that want to push enforcement decisions into a broader security operations workflow, Vaikora’s enterprise control plane integrates natively with Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub, without custom engineering on your end.
What to Check Before You Deploy
Before you put the proxy in front of a production agent, verify three things. First, map every tool call the agent makes today, including calls you did not explicitly configure, because agents in agentic chains often call tools you did not expect. Second, write your block policy before your allow policy: start from deny-all and open exceptions, rather than allow-all and trying to enumerate what to block. Third, confirm that your audit log destination is append-only and access-controlled: a tamper-evident log stored somewhere that an agent can write to defeats the purpose.
The PyPI package page and the source repository both include a working configuration example. Start there, run the proxy against a test agent, and review the audit output before you point it at anything production-facing.