Policy checks that run after a tool call has already executed are not really controls. They are incident reports. The whole point of putting a gate on AI agent tool calls is to stop the action, not log it.
vaikora-guard-mcp is a small, MIT-licensed Python package that sits inline between an MCP-compatible AI agent and the tools it wants to call. Before any tool executes, the proxy evaluates the call against a policy definition and returns allow, block, or modify. The agent never reaches the tool unless the proxy says yes.
What Problem This Solves
MCP (Model Context Protocol) lets AI agents call external tools: file systems, APIs, databases, shell commands. That is powerful and also the exact surface where policy enforcement matters most. If an agent can read any file or call any API without a gate, the blast radius of a prompt injection, a misconfigured model, or a runaway automation is bounded only by what the tool itself allows.
Standard IAM and RBAC controls set a floor, but they do not evaluate what the agent is trying to do in context. A database role might allow SELECT on a table. It cannot tell you whether that specific query, made by that agent, in response to that input, should be permitted right now.
vaikora-guard-mcp adds that evaluation layer without requiring you to modify your agent code or migrate to a new SDK.
How the Proxy Works
The package is published on PyPI as `vaikora-guard-mcp`. Once installed, it wraps your existing MCP server. The agent sends a tool call to the proxy. The proxy:
- Parses the tool name and arguments
- Runs them through the configured policy rules
- Returns allow, block, or a modified version of the call back to the agent
- Writes the decision to a local audit log
Identical inputs always produce identical decisions. The policy evaluation is deterministic, which matters for auditability: you can replay any log entry and get the same result the proxy returned at runtime.
The proxy is self-hosted. Your tool calls and their arguments do not leave your environment to reach a third-party policy service.
Writing a Policy
Policies are defined in a YAML file. A simple example: block any tool call to `write_file` where the destination path starts with `/etc/`. The rule names the tool, defines a condition on the arguments, and sets the enforcement action.
You can stack multiple rules. If a call matches a block rule, it stops there regardless of what other rules say. If it matches a modify rule, the proxy rewrites the argument before passing it on. If nothing matches, the default action applies, and you configure whether that default is allow or deny.
For teams connecting to Vaikora’s commercial control plane, the same policy format applies but rules are managed centrally and pushed to each proxy instance. The open-source package and the enterprise control plane share a policy model, so moving from local to centrally managed governance does not require rewriting your rules.
What Gets Logged
Every decision the proxy makes is written to an audit log. Each entry includes the tool name, the full arguments, the policy rule that matched (or the default), the decision, and a timestamp. Entries are SHA-256 hash-chained, so tampering with or deleting a record breaks the chain and is detectable.
That chain matters when you are answering a compliance question. "Did the agent ever call this tool with these arguments, and was it allowed?" has a provable answer, not an approximate one.
Realistic Scope
vaikora-guard-mcp is a proxy for MCP tool calls. It is not a full secrets scanner, a data loss prevention engine, or a network firewall. It evaluates what the agent asks to do and applies the rules you give it. The quality of your protection is proportional to how well you define your policies.
If you want to enforce against PII in arguments, your policy rules need to describe what PII looks like. The proxy has content inspection modules that can match patterns, but writing the right patterns is your work, not something the proxy invents for you.
For teams that want pre-built compliance presets covering HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001, those ship with Data443’s Vaikora platform, which uses this same proxy as its enforcement layer.
Getting Started
Install from PyPI:
“`
pip install vaikora-guard-mcp
“`
The repository includes a `config.yaml` template and example rules for common patterns: blocking writes to sensitive paths, blocking calls that include credential-shaped strings in arguments, and requiring a modified safe version of a call when the original exceeds a scope threshold.
Start by auditing before you enforce. Set the default action to allow, turn on logging, and run your agent workloads for a cycle. Review what the proxy would have blocked under a stricter policy before you flip the enforcement switch. That review is worth doing before production traffic hits a block rule you did not expect.
The source is on GitHub under the Data443 organization. Issues and pull requests are open.