Publishing a security component as open source under the MIT licence does something a closed binary cannot: every security engineer, AI platform team, and compliance reviewer can read exactly what the enforcement logic does before deploying it. Vaikora Guard MCP is now available on PyPI as `vaikora-guard-mcp`, written in Python, self-hosted, and free to inspect, fork, and run.
This post explains what the package does mechanically, where it sits in an agentic system, and how to get it running.
What Problem This Solves
AI agents built on the Model Context Protocol call tools. Those tool calls can read files, query databases, send HTTP requests, write records, or trigger downstream processes. The hosting process passes its permissions through to each call, so an agent that has database read access can query any table that permission covers, not just the tables the developer intended.
A policy gate that runs after the tool call has already executed is not a gate. The only meaningful control point is before execution: inspect the proposed action, apply policy, and return allow, block, modify, or require-approval before the call goes through.
That is what Vaikora Guard MCP does. It sits inline as an MCP-compatible proxy. Every tool call the agent wants to make passes through the proxy first.
How the Proxy Works
The proxy intercepts the tool call payload, runs it through six content inspection modules, and applies the policy rules you have configured. The decision is deterministic: identical input always produces an identical decision. There is no probabilistic classification that might go one way today and another way tomorrow.
The six inspection modules cover categories like data exfiltration patterns, prompt injection attempts, sensitive content in payloads, and scope violations. You configure which modules are active and what thresholds trigger each action.
Enforcement latency at P50 is 8ms and at P99 is 45ms, so the proxy adds negligible round-trip time to a tool call that might itself take hundreds of milliseconds to execute.
Every decision is written to a SHA-256 hash-chained audit log. That chain is tamper-evident: any modification to a past record breaks the chain, which is detectable on verification. This matters for compliance reviews and incident investigations where you need to prove what the agent did or was blocked from doing, and in what order.
Running It
Installation is one line:
“`
pip install vaikora-guard-mcp
“`
From there you point your MCP client at the local proxy instead of directly at the tool server. The proxy config file is where you define your policy rules: which tool names are allowed, what payload patterns are blocked, what data classifications are permitted to leave, and whether any action category requires human approval before proceeding.
For teams that want prebuilt policy starting points, the package ships compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. Those presets are a starting point, not a finished compliance programme, but they give you something to audit and tighten rather than starting from a blank file.
What the Open-Source Component Is, and What It Is Not
The `vaikora-guard-mcp` package is the enforcement gateway. It is MIT-licensed and self-hosted. You own the runtime. The commercial product from Data443 is the Vaikora Control Plane: centralized policy management, team-level audit dashboards, SIEM integrations (Microsoft Sentinel, SentinelOne, CrowdStrike Falcon, AWS Security Hub), and the hosted infrastructure behind multi-agent deployments at scale.
That split matters for teams evaluating the technology. You can run the gateway in a development environment, inspect the decision logic, and confirm the audit chain behaves as expected before committing to a broader deployment. The open-source layer is not a stripped-down trial; it is the actual enforcement component.
Adding Approval Workflows
One decision type deserves specific attention: require-approval. When a tool call matches a rule that has this outcome rather than a hard block, the proxy holds the action and waits. A human reviewer sees the proposed call and approves or rejects it. This is useful for actions that are sometimes legitimate and sometimes not, where a blanket block would break valid workflows but an unchecked allow is too permissive.
Examples include an agent that is allowed to write records to a CRM but should not do so at bulk scale without review, or an agent that can call an external API but only after a human confirms the destination is expected.
The approval workflow is configurable per tool name, per payload pattern, or per classification label on the data in the payload.
What to Check Next
If you want to audit the enforcement logic before deploying:
- The source is on PyPI at `vaikora-guard-mcp` and the licence is MIT
- Review the six content inspection modules and their default thresholds in the package config
- Run the proxy locally against a test MCP tool server and verify the audit log chain after a mix of allowed and blocked calls
- Compare the hash-chained log output against your own verification script before trusting it in a production investigation
If you are already running MCP-based agents in a production environment, the first question to answer is whether tool calls are currently gated by any deterministic policy at all. If the answer is no, the gateway can be inserted without changing the agent code or the tool server.