Building an AI agent that calls tools is straightforward. Deciding which tool calls are allowed, by whom, under what conditions, and with a record that survives an audit is the harder problem. Vaikora Guard MCP is an open-source, MIT-licensed proxy that sits between an agent and its tools and makes that decision before execution.
What the proxy actually does
Vaikora Guard MCP intercepts every tool call an agent attempts through the Model Context Protocol. Before the call reaches the target tool, the proxy evaluates it against a policy ruleset and returns one of four decisions: allow, block, modify, or require-approval. The tool either runs, does not run, runs with a sanitized payload, or waits for a human to approve it.
That interception happens inline. The agent does not call the tool directly. It calls the proxy, which enforces policy and then (if allowed) forwards the call. From the agent’s perspective the tool is still reachable. From the security team’s perspective, every call now has a gate.
Enforcement latency at the proxy is P50 8ms, P99 45ms. At 10,000+ actions per second throughput, the proxy is not a meaningful bottleneck for production agent workloads.
Why "before execution" matters in this context
A tool call that has already run has already produced its effect. If an agent writes to a database, sends a message, or calls an external API, logging that it happened does not undo it. Policy applied after the fact is an audit trail, not a control.
Consider a concrete case: an agent working a support queue is given a tool that can send email. Without a policy gate, the agent can be prompted or chained into sending email to addresses outside the organization, or at volumes that look like abuse. With Vaikora Guard MCP in the path, a policy rule can block any send-email call where the recipient domain is not on an approved list, or where the volume within a session exceeds a threshold. The call never reaches the tool. No email is sent. The block is logged.
That decision happens at the proxy, in real time, before any side effect exists.
What the audit log looks like
Every decision the proxy makes is written to a SHA-256 hash-chained, tamper-evident audit log. Hash chaining means each log entry includes the hash of the prior entry. If any record is modified or deleted after the fact, the chain breaks and the tampering is detectable.
For compliance purposes, this matters. Regulations like HIPAA, PCI-DSS, and GDPR require evidence that controls were operating, not just that controls existed. A log that shows every tool call, the policy that evaluated it, and the decision returned is the kind of evidence that satisfies an auditor. Vaikora Guard MCP ships with compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001, so the relevant policy guardrails for each regime are available without writing them from scratch.
How to run it
The proxy is self-hostable. You pull the repository, configure your policy rules in a YAML file, point the proxy at your MCP-compatible LLM or tool endpoint, and point your agent at the proxy. There is no vendor dependency required to run the open-source version.
Vaikora Guard MCP supports 12 LLM providers with no SDK migration. If your agent already calls one of those providers, you change the endpoint to the proxy. The agent code does not change.
Policy rules are written as conditions against the tool call payload: tool name, argument keys and values, session metadata, calling identity. A rule that blocks any call to a file-write tool where the target path starts with `/etc/` takes one line. A rule that requires human approval for any database-delete call takes one line. The approval workflow holds the call in a queue and resumes or rejects it based on the reviewer’s response.
Where to go from here
The repository is the right starting point. Read the policy rule schema before writing any rules. If you have existing MCP-compatible agents, the integration path is a one-line endpoint change. If you are running in a regulated environment, start with one of the built-in compliance presets and then layer organization-specific rules on top.
For teams that need the enterprise control plane, Data443 ships Vaikora as a managed offering with native integration into Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub, and with the same enforcement and audit guarantees as the open-source version.
The immediate check after deployment: look at the audit log after your first agent session. Every tool call should have an entry. If any calls are missing, the proxy is not fully in the path.