Policy enforcement that happens inside a vendor’s black box is difficult to audit, difficult to extend, and difficult to trust. Vaikora Guard MCP is MIT-licensed, self-hostable, and publicly available, which means you can read the enforcement logic, modify it for your environment, and run it entirely on infrastructure you control.
This article explains what the open-source release actually gives you, how the proxy works mechanically, and where the MIT license creates options that a closed runtime does not.
What Gets Released and Under What Terms
The MIT license places no restrictions on commercial use, modification, or redistribution. You can take the codebase, fork it, add your own policy modules, and run it in a private environment without any reporting obligation back to the project. That matters in regulated industries where running third-party code requires a thorough review process: the source is available for that review.
What ships in the open-source package is Vaikora Guard MCP, an MCP-compatible proxy that sits inline between an AI agent and the LLM or tools it calls. Every action the agent attempts passes through the proxy before execution. The proxy applies an allow, block, modify, or require-approval decision. Nothing executes unless a decision is made first.
The enterprise control plane (centralized policy management, SIEM integrations, compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001, and the SHA-256 hash-chained audit log) sits alongside the open-source core rather than replacing it.
The Proxy Mechanics in Practice
Consider a concrete scenario. An AI coding agent is configured to call a file-write tool to update a configuration file. Without a policy layer, the agent resolves which tool to call, constructs the parameters, and the call executes. The operator has no pre-execution control point.
With Vaikora Guard MCP in the path, the sequence changes:
- The agent issues the tool call request.
- The request reaches the proxy before it reaches the tool.
- The proxy evaluates the request against the active policy set (tool name, parameters, caller identity, any data classification signals attached to the session).
- The proxy returns allow, block, modify, or require-approval.
- Only an allow decision lets the call proceed to the tool.
The enforcement decision happens at P50 in 8ms and at P99 in 45ms. For most agent workflows, that latency is not perceptible. The proxy handles more than 10,000 actions per second, so it scales to high-volume pipelines without batching or queuing at the enforcement layer.
Detection accuracy in testing is 99.9%. Because decisions are deterministic rather than probabilistic, the policy outcome for a given request is the same every time the same inputs are presented.
What the MCP Compatibility Actually Enables
MCP (Model Context Protocol) is the mechanism many agent frameworks use to expose tools. Because the proxy is MCP-compatible, it inserts into that layer without requiring a custom integration per framework. The open-source server works with 12 LLM providers without requiring an SDK migration on the agent side.
That means a team running one agent framework today and evaluating a second framework next quarter does not need to re-implement the policy layer. The proxy sits between the agent and the tools regardless of which LLM the agent is calling.
Writing and Reading the Audit Log
The open-source release includes the audit log writer. Every enforcement decision is written to a SHA-256 hash-chained, tamper-evident log. Each log entry contains the decision (allow, block, modify, require-approval), the inputs that drove it, and the hash linking it to the previous entry. Tampering with any entry breaks the chain.
For security teams that need to demonstrate what an AI agent did or did not do during an incident, that log is the primary evidence source. Because the log format is part of the open-source codebase, you can build your own readers, exporters, or integrations without waiting on an API update.
Self-Hosting and the Control Plane
Self-hosting means the proxy runs inside your own network. No action payload leaves your environment for a policy decision. For organizations handling sensitive data under HIPAA, GDPR, or similar frameworks, keeping enforcement in-network removes a data egress question entirely.
The enterprise control plane that Data443 offers on top of the open-source core adds centralized policy management, native integrations with Microsoft Sentinel, Microsoft Defender, SentinelOne, CrowdStrike Falcon, and AWS Security Hub, plus the compliance presets. Teams that want those integrations without building them maintain the self-hosted proxy and connect it to the control plane.
What to Check Next
If you want to evaluate the enforcement logic before adopting the full platform, start with the open-source repository. Read the policy evaluation module directly. Run it against a test agent in a non-production environment and examine the audit log output for a set of known-good and known-bad tool calls. That exercise will show you exactly what gets logged, what gets blocked, and whether the policy language fits your threat model before any production commitment is made.