Vaikora › Blog › Product Updates

Agent tool calls happen at machine speed. Here is how to put a policy gate in front of each one.

Product Updates · Nov 9, 2026 · 4 min read

Most security controls assume a human is in the loop somewhere, reviewing before acting. AI agents do not work that way. An agent can call dozens of tools in a single session, read files, write to APIs, query databases, send messages, and do it all in seconds with no human ever seeing the intermediate steps. The question is not whether you trust the model. The question is whether every individual action has been checked against policy before it executes.

That is what vaikora-guard-mcp is for.

What the MCP layer actually does

The Model Context Protocol defines how an AI agent discovers and calls external tools. When an agent wants to read a file or POST to an API, it issues a tool call through MCP. The agent does not call the tool directly. It asks the MCP server to handle it.

Vaikora Guard MCP sits between the agent and the tool. It intercepts the tool call, runs it through the policy engine, and returns a decision before any action executes. That decision is one of four: allow, block, modify, or require human approval. Only if the decision is allow does the tool call proceed.

The package is published on PyPI as `vaikora-guard-mcp`. It is written in Python, MIT-licensed, and self-hostable. Source is public. You can read exactly what the policy checks do, write your own, and run it inside your own perimeter without any data leaving.

What gets checked and when

The policy engine runs six content inspection modules. These examine the content of the tool call before execution: what is being sent, what resource is being targeted, what data may be returned. Configuration is deterministic. Identical input produces identical output every time.

A concrete example: an agent is processing customer support tickets and has access to a CRM tool. A prompt injection attempt in a ticket tells the agent to export all contact records. Without a policy gate, the agent calls the CRM export endpoint. With vaikora-guard-mcp in place, the tool call is intercepted. The policy engine sees an export action targeting a data scope outside the declared task context. The action is blocked and logged before any data moves.

The latency for that check is P50 at 8ms and P99 at 45ms. At that speed, enforcement does not change the perceived performance of the agent.

The audit record

Every decision writes to a SHA-256 hash-chained audit log. Each entry is signed into the chain, so any tampering is detectable. For compliance purposes this matters: you get an ordered, tamper-evident record of what every agent attempted, what the policy engine decided, and why.

Vaikora ships compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. These are starting configurations, not marketing badges. Each preset defines the specific policy rules that apply to data types and actions in scope for that framework.

Connecting to the broader security stack

Running enforcement at the MCP layer is only useful if the decisions surface somewhere your security team already works. The enterprise control plane (hosted by Data443) connects to Microsoft Sentinel, Microsoft Defender, SentinelOne, CrowdStrike Falcon, and AWS Security Hub natively. Threat indicators from AI agent activity push into SentinelOne with severity values mapped as Critical=100, High=75, Medium=50, Low=25. High-severity risk promotes into Azure Security Center as native incidents, with no custom engineering.

This means a blocked prompt injection attempt from an AI agent can appear in the same SOC workflow as any other high-severity alert, with the full audit chain attached.

Who should look at this

If you run AI agents that call tools through MCP, the open-source proxy is worth reviewing on its own terms, independent of the enterprise platform. Install from PyPI, read the inspection modules, and test it against your own agent workflows.

The specific things to check: does your current deployment have any visibility into what tool calls agents are making? Do you know what happens when an agent receives a prompt that attempts to redirect it toward a tool it should not be calling? Is there a record of those decisions that you could produce in an audit?

If the answer to any of those is no, start with the vaikora-guard-mcp source and the policy configuration documentation before you think about the enterprise layer.

More from the Vaikora blog