Vaikora › Blog › Product Updates

Building a policy gate for MCP tool calls: what vaikora-guard-mcp does and how to run it yourself

Product Updates · Nov 12, 2026 · 4 min read

Putting a policy check in front of an AI agent tool call requires intercepting the call before it executes, not logging it afterward. vaikora-guard-mcp is an MIT-licensed Python package, published on PyPI, that does exactly that for any agent using the Model Context Protocol.

This post explains what the proxy does mechanically, how to get it running, and what you can inspect once it is live.

What the problem actually looks like

An MCP server exposes tools. An AI agent calls those tools. Without a gate in the middle, the agent's decision to call a tool is also the decision to execute it. There is no enforcement layer. Audit trails, if any exist, are written after the fact.

The gap matters because tool calls can carry real consequences: writing to a database, posting to an API, reading sensitive files, or making external HTTP requests. By the time you detect a bad call in a log, the action has already run.

What vaikora-guard-mcp does

The package runs as a proxy between the agent and the MCP server. Every tool call passes through the proxy. Before forwarding the call, the proxy evaluates it against a policy definition and returns one of four decisions: allow, block, modify, or require-approval.

Identical input always produces an identical decision. The enforcement is deterministic, which matters for auditability: you can replay any call and get the same result, with no ambiguity about why a decision was made.

Every decision is written to a SHA-256 hash-chained audit log. The chain is tamper-evident, so a reviewer can verify that the record has not been altered after the fact.

The proxy runs at P50 8ms and P99 45ms, so the enforcement step does not materially change the agent's response time in normal operation.

Installing and running it

The package is on PyPI:

```
pip install vaikora-guard-mcp
```

A minimal local setup points the proxy at an existing MCP server and loads a policy file. The policy file defines which tools are permitted, which arguments are blocked, and what conditions trigger an approval gate. You write the policy once; the proxy enforces it on every call without any change to the agent code or the MCP server itself.

Because the proxy is MCP-compatible, it works with any agent that already speaks MCP. There is no SDK migration and no changes to the LLM provider configuration.

A concrete scenario

Suppose an agent has access to a file-system tool that accepts a path argument. Without a gate, the agent can pass any path, including paths outside the working directory. With vaikora-guard-mcp, you write a policy rule that blocks any call where the path argument starts with `/etc` or traverses upward with `..`. The proxy evaluates the argument before the call reaches the MCP server. A blocked call never executes; the agent receives a policy-denial response instead.

The same mechanism applies to calls that should require a human in the loop. A rule that sets a tool call to require-approval holds the call in a queue until a human approves or rejects it. The agent waits. Nothing executes until the decision is made.

What you can inspect

The audit log is the primary operational artifact. Each entry records the tool name, the arguments, the policy decision, and the timestamp. Because the log is hash-chained, you can present it as evidence during a compliance review without worrying about whether entries were modified.

For teams connecting this to a SIEM, Vaikora integrates natively with Microsoft Sentinel, SentinelOne, CrowdStrike Falcon, and AWS Security Hub. The open-source proxy produces the same decision telemetry that the enterprise control plane uses, so moving from self-hosted to managed does not change what you observe.

Compliance presets

The enterprise control plane ships presets for SOC 2, HIPAA, GDPR, PCI-DSS, and ISO 27001. If you are evaluating the open-source proxy to meet one of those frameworks, the preset gives you a starting policy definition that maps to the relevant controls, rather than building the rule set from scratch.

What to check next

Clone or install `vaikora-guard-mcp` from PyPI and run it against one of your existing MCP servers in a staging environment. Write a policy that blocks or gates the two or three tool calls that carry the most risk in your setup. Review the audit log after a session to confirm that decisions match what the policy says. That review is the fastest way to find gaps between the policy you wrote and the behavior you assumed.

The source is published under the MIT licence, so you can read the enforcement logic directly rather than taking the proxy's behavior on trust.

More from the Vaikora blog