Vaikora › Blog › Product Updates

Building a policy gate into MCP: the design decisions behind Vaikora Guard MCP going open source

Product Updates · Nov 6, 2026 · 4 min read

When we decided to open-source the MCP proxy layer, the first question from practitioners was predictable: what exactly does it block, and when? The short answer is that it blocks tool calls before they execute, based on deterministic policy, and every decision lands in a tamper-evident audit log.

That specificity matters. Vague "guardrail" claims are common. This post explains what the code actually does, why we licensed it the way we did, and what trade-offs we made in the design.

What Vaikora Guard MCP is, technically

vaikora-guard-mcp is a Python proxy, published on PyPI under the MIT license, that sits inline between an MCP agent and the tools it calls. When the agent issues a tool call, the proxy intercepts it, evaluates the call against a policy file, and returns an allow, block, modify, or require-approval decision before the tool runs.

The proxy ships with six content inspection modules. These cover things like sensitive data patterns, prompt injection signals, and tool scope violations. Policy files are declarative: you name a tool, specify conditions, and set a disposition. If the input is identical on two separate runs, the decision is identical. There is no probabilistic scoring that produces different answers on different days.

Enforcement latency runs at P50 8ms and P99 45ms. At the volumes most teams run today, that is not a meaningful addition to end-to-end agent latency.

Why MIT license, and why self-hosted

The proxy is self-hosted. That was a deliberate choice. Teams integrating AI agents into regulated environments often cannot route call traffic through a third-party SaaS endpoint. Self-hosting the enforcement layer means the policy check and the intercepted payload stay inside the customer's own infrastructure.

MIT licensing means you can read the inspection logic, audit it, modify it, and ship it inside your own tooling without negotiating a commercial agreement. For security teams doing due diligence on a component that sits inline on every agent action, that is worth more than a vendor's assurance document.

The commercial product is the Vaikora Control Plane, hosted by Data443. That is where you get centralized policy management, the hash-chained audit log, compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001, and integrations with Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub. The open-source proxy is the enforcement point. The control plane is where governance happens at scale.

A concrete scenario

Say you have an MCP agent authorized to query a database and send a Slack message. The agent receives a prompt that attempts to redirect it to call a file-deletion tool, a classic indirect prompt injection.

Without a policy gate, the agent evaluates the tool call in its context window, and the question of whether it runs depends entirely on the model's reasoning at that moment. That is non-deterministic.

With vaikora-guard-mcp in place, the proxy checks the tool call against a policy that lists `delete_file` as blocked for this agent. The call never reaches the tool. The decision is written to the audit log with a SHA-256 hash linking it to the previous entry in the chain, so the record cannot be modified after the fact.

That is the enforcement-before-execution pattern. Detection after the fact tells you what happened. Blocking before execution means the action never happened.

What you give up with the open-source layer alone

The proxy enforces policy locally. Without the control plane, you manage policy files per deployment, audit logs stay local, and you have no centralized view across agents, environments, or time.

For a single-agent proof of concept, that is fine. For an environment running multiple agents across production and staging, with compliance requirements that demand ordered audit records and policy version history, local policy files become a governance gap.

That gap is the design boundary between the open-source proxy and the enterprise control plane. It is not accidental.

What to check before you deploy

Before wiring vaikora-guard-mcp into an agent, review three things:

• Policy scope. List every tool the agent is authorized to call. Write an explicit allow or block rule for each. Implicit allow-by-default is a policy gap.
• Inspection modules. The proxy ships six modules. Confirm which ones apply to your agent's input domain. A coding agent and a data-retrieval agent have different risk profiles.
• Audit log destination. Decide before deployment where logs go and who can read them. If you need compliance preset coverage, that configuration lives in the control plane, not the proxy.

The PyPI package is `vaikora-guard-mcp`. The source is MIT-licensed. Start there, read the policy schema, and map it against your agent's actual tool surface before you write your first policy file.

More from the Vaikora blog