Vaikora › Blog › Product Updates

Checking AI agent tool calls against policy before they execute: what the Vaikora MCP proxy does

Product Updates · Oct 21, 2026 · 4 min read

Publishing a policy enforcement proxy as open-source code is a specific claim. Here is exactly what ships, how the enforcement works, and what you need to do to run it.

The problem it solves

An AI agent calling a tool, a file read, a database query, an API write, does not pause for review. It executes. By the time your SIEM sees the log entry, the action has already completed. If the action exfiltrated a file, deleted a record, or escalated a privilege, detection after the fact does not undo it.

The only control point that matters is before execution. That means sitting inline between the agent and the tool, inspecting the call, and returning allow, block, modify, or require-approval before the underlying action runs.

What Vaikora Guard MCP is

Vaikora Guard MCP is an open-source, MIT-licensed MCP-compatible proxy written in Python. It ships on PyPI under the package name `vaikora-guard-mcp`. Self-hosted, no call-home required, no vendor dependency for the core enforcement path.

It sits between any MCP-compatible AI agent and the LLM or tools that agent calls. Every tool call passes through the proxy before execution. The proxy evaluates the call against a policy set and returns a deterministic decision.

Deterministic here has a precise meaning. Identical input always produces identical output. There is no probabilistic scoring that might pass a call on Tuesday and block it on Wednesday. If a call matches a block rule, it is blocked. Every time.

What the six inspection modules check

The gateway ships six content inspection modules. Depending on your configuration, a tool call can be checked against:

• Data classification rules (does the payload contain PII, PHI, card data, secrets)
• Prompt injection signatures (is the input attempting to redirect the agent)
• Scope boundaries (is this tool call within the declared agent permissions)
• Sensitive action patterns (file deletion, external egress, privilege changes)
• Compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001
• Custom policy expressions you write yourself

A worked example: an agent is configured to read from a specific S3 bucket and summarize documents. A user feeds it a prompt that tries to redirect it to write results to an external webhook. The scope boundary module sees a write-to-external-URL call that falls outside the declared permission set. The proxy blocks it before the write executes. The agent receives a block response. The user receives nothing.

Enforcement latency

The enforcement path adds P50 8ms and P99 45ms to each tool call. At throughput, the proxy handles over 10,000 actions per second. For most agentic workflows, the latency is invisible to the operator and irrelevant to the user.

The audit chain

Every decision, allow, block, modify, require-approval, is written to a SHA-256 hash-chained, tamper-evident audit log. Each entry is signed into an ordered chain. If a log entry is altered or deleted, the chain breaks, which is detectable.

This matters for compliance and for investigation. When an auditor asks "what did this agent do, and what did your controls decide about each action," you have a signed, ordered, verifiable record. Not application logs, not SIEM events that can be suppressed. A chain where tampering is structurally visible.

How it connects to the enterprise control plane

The open-source proxy is the enforcement component. The Vaikora Control Plane, hosted by Data443, is where you manage policy centrally across multiple agents, view the audit chain, and push AI agent threat signals into your existing security stack.

The Control Plane integrates natively with Microsoft Sentinel, Microsoft Defender, SentinelOne, CrowdStrike Falcon, and AWS Security Hub. High-severity findings promote directly into Azure Security Center as native incidents. Threat Intelligence indicators push into SentinelOne with severity mapped numerically: Critical at 100, High at 75, Medium at 50, Low at 25.

The proxy also supports 12 LLM providers with no SDK migration. You point it at your existing model API calls.

What to check next

Clone the repo or install via `pip install vaikora-guard-mcp`. Review the default policy set before enabling enforcement: the out-of-box rules are conservative, and you will likely want to tune scope boundaries to match your specific agent permissions. If you run regulated workloads, activate the relevant compliance preset first and treat the custom policy layer as an addition on top, not a replacement.

Check whether your agents are MCP-compatible. If they are, the proxy is a configuration change, not an architecture change.

More from the Vaikora blog