Getting an AI agent to call a tool is easy. Deciding whether it should call that tool, with those arguments, right now, is the part most implementations skip. That gap is what vaikora-guard-mcp is built to close, and the full source is on PyPI under the MIT licence.
What the Problem Looks Like in Practice
An AI agent running inside a customer support workflow gets a tool registered: `query_customer_records`. The agent receives a prompt, decides to call that tool, and passes a customer ID as an argument. Nothing in the standard MCP flow asks whether this particular agent, in this particular session, is allowed to query records outside its assigned account scope.
The tool executes. The data comes back. The agent uses it.
If the query was out of scope, you find out in a log review later, if at all. The enforcement window was open for a fraction of a second and nothing was watching it.
That is the specific scenario vaikora-guard-mcp is designed to prevent. The proxy sits between the agent and the tool. Before the tool call executes, the proxy evaluates it against policy and returns allow, block, modify, or require-approval. The tool only runs if the decision is allow.
How the Proxy Works
The architecture is straightforward. vaikora-guard-mcp implements the Model Context Protocol proxy pattern: it registers as an MCP server to the agent, and re-exposes the downstream tools after wrapping each one with a policy gate.
When the agent calls a tool:
- The call arrives at the proxy with the tool name and full argument payload
- The proxy evaluates the call against the configured policy rules
- The decision is written to the audit log before any downstream call is made
- If the decision is allow, the proxy forwards the call to the actual MCP server
- If the decision is block, the proxy returns a structured refusal to the agent
The policy engine is deterministic. Identical input always produces an identical decision. There is no model scoring or probabilistic threshold to tune. You write a rule, the rule fires or it does not.
The audit log uses SHA-256 hash chaining. Every entry is linked to the one before it, so the record is tamper-evident. If someone modifies an entry after the fact, the chain breaks at that point.
Installing and Running It
The package is published on PyPI as `vaikora-guard-mcp`. Installation:
“`
pip install vaikora-guard-mcp
“`
Point it at your downstream MCP server, configure a policy file, and start the proxy. The agent sees a standard MCP interface and does not need any SDK changes.
The MIT licence means you can self-host it, fork it, modify it, and ship it inside your own tooling. There are no telemetry callbacks, no licence checks, no call-home requirements. The source is what it appears to be.
What You Can Policy-Gate
The current content inspection layer covers the main categories that matter in production agent deployments:
- Tool name and argument matching: block calls to specific tools or calls that contain specific argument patterns (a regex on a file path, a blocked domain in a URL argument)
- Session-scoped rules: bind a rule to a session identifier so the same tool is allowed in one context and blocked in another
- Argument modification: rewrite an argument value before the call forwards, useful for stripping PII from payloads before they reach external tools
- Approval routing: hold the call and require a human decision before execution, appropriate for high-risk actions like sending email or writing to a production database
Where the Enterprise Control Plane Fits
The open-source proxy handles enforcement at the edge. What it does not include is centralized policy management, cross-agent audit aggregation, the SIEM integrations (Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, AWS Security Hub), or the compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. Those are part of the Vaikora control plane, which Data443 hosts as a commercial product and makes available on AWS Marketplace and the Azure Sentinel content hub.
The split is deliberate. If you want to evaluate the enforcement model, run the open-source proxy locally against a test MCP server. The policy engine and audit chain are the same code that runs under the control plane. You can inspect the enforcement logic before you decide whether the broader governance layer is worth your time.
What to Check Next
If you are running AI agents against MCP tools in any environment that handles sensitive data, check whether your current setup has an enforcement point before tool execution, not after. If the answer is no, or if the answer is "the model decides," pull the package, proxy one tool, write one block rule, and watch what the audit log produces.
The gap this closes is narrow but consequential. A tool that executes before policy runs is not a controlled tool.