Tool calls are the moment AI agents do real things: write files, query databases, call APIs, delete records. The default MCP behavior is to pass those calls straight through to the target. vaikora-guard-mcp sits in that path and forces a policy decision first.
The project is MIT-licensed, written in Python, and published on PyPI as `vaikora-guard-mcp`. You can read every line, run it locally, and modify it without restriction.
What the proxy actually does
The server positions itself as a standard MCP proxy. An MCP-compatible agent connects to it the same way it would connect to any MCP server. When the agent issues a tool call, the proxy intercepts it before forwarding.
At that interception point, the proxy evaluates the call against a policy definition. The decision is deterministic: identical input always produces identical output. There is no probabilistic scoring here. The proxy returns one of four outcomes:
- allow: the call forwards to the target server unchanged
- block: the call stops, and the agent receives a rejection
- modify: the proxy rewrites the call (stripping a disallowed parameter, for example) before forwarding
- require-approval: the call holds until a human confirms or rejects it
Every decision is written to a SHA-256 hash-chained audit log, so the record of what was allowed or blocked cannot be altered after the fact.
A concrete scenario
An AI agent is running inside a development environment. Its MCP configuration points at vaikora-guard-mcp rather than directly at a filesystem tool server. A developer asks the agent to clean up temporary files. The agent constructs a `delete_file` tool call targeting `/tmp/build-artifacts`. Policy allows it.
The same agent, in the same session, receives a prompt injection through a malicious document it was asked to summarize. The injected instruction tells the agent to call `delete_file` on `/etc/passwd`. Policy evaluates the call: the target path matches a blocked pattern. The call stops before it reaches the filesystem server. The agent gets a rejection. The audit log records the blocked call, the policy rule that matched, and the timestamp.
The developer sees the block in the log. The filesystem server never received the request.
What you configure
Policy definitions are written in a structured format that maps tool names, parameter patterns, and caller context to the four outcomes above. You can write rules that:
- Block specific tool names entirely
- Block calls where a parameter value matches a pattern (path prefix, domain, keyword)
- Route calls to require-approval when the tool is sensitive but not categorically blocked
- Modify a call by removing or replacing a parameter value before forwarding
The proxy ships with compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. Each preset activates a set of default rules appropriate to that control framework. You can extend or override any preset rule.
Enforcement latency
A policy gate adds latency. For an agent making tool calls in real time, that matters. Vaikora’s P50 latency is 8ms and P99 is 45ms. For most tool calls, which themselves involve network round-trips measured in hundreds of milliseconds, that overhead is not the bottleneck.
The proxy is designed for self-hosting, so the latency you see in production depends on where you run it relative to the agent and the target server. Keeping all three in the same network zone (same region, same VPC) minimizes that variable.
Connecting to a control plane
The open-source proxy runs standalone. If you need centralized policy management across multiple agents or environments, Vaikora’s commercial control plane connects to the proxy and lets you manage rules, review the audit log, and push policy updates from one place. The enterprise integration layer also connects to Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub so that blocked calls appear as incidents in the security tools your team already monitors.
What to check before deploying
Before running the proxy in a production agent environment, verify three things:
- Your agent’s MCP configuration points to the proxy endpoint, not the target server directly. A misconfigured agent bypasses enforcement entirely.
- Policy rules cover the tool names your agent actually uses. An allow-by-default configuration with no rules for a given tool name will pass every call for that tool through.
- The audit log destination is write-protected from the agent process. If the agent can modify or delete the log, the tamper-evident chain has no value.
The source is on PyPI. Install it, read the policy format documentation, and write rules for the specific tools your agent can reach before enabling it in any environment where those tools have real effects.