Vaikora › Blog › Product Updates

How to enforce policy on AI agent tool calls before they execute, using an open-source MCP proxy

Product Updates · Nov 12, 2026 · 3 min read

An AI agent can call a tool that deletes files, exfiltrates data, or posts to an external API in the same way it calls a tool that reads a local file. Without a check that runs before execution, the only signal you get is after the action has already happened.

Vaikora Guard MCP is a self-hosted, MIT-licensed Python package that sits inline between an MCP-compatible AI agent and the tools it calls. Every tool call passes through the proxy. The proxy applies a policy decision. The action runs only if the decision is allow.

What the proxy actually does

The package is published on PyPI as `vaikora-guard-mcp`. Once it is running, it intercepts each tool call, inspects the request against your configured policy, and returns one of four outcomes: allow, block, modify, or require-approval.

Identical input always produces an identical output. There is no probabilistic scoring that lets the same call through twice and blocks it once. This is deterministic enforcement, which matters for auditability: if a call was blocked, you can point to exactly which policy rule matched.

Every decision is written to a SHA-256 hash-chained audit log. Each entry is signed into the chain, so the log is tamper-evident. If you need to show a regulator or an internal audit team what an agent did and when, you have an ordered record that cannot be silently edited.

How to run it in practice

A concrete setup looks like this. You have an AI agent using Claude or another hosted model through an MCP interface. You install `vaikora-guard-mcp` via pip, write a policy file that specifies which tool calls are permitted (by tool name, parameter pattern, or data classification), and point your agent at the proxy instead of the tool server directly.

A policy rule might say: block any tool call where the destination parameter is an external domain not in the allowlist. The agent calls the tool. The proxy inspects the destination. If it is not on the list, the call is blocked before it reaches the tool server. The agent receives a structured error. The decision is logged.

You can also set a rule that routes high-risk calls to a require-approval queue. A human reviewer sees the pending action, approves or rejects it, and the proxy completes or discards the call accordingly. The agent waits.

What you need to configure

Policy is defined in a YAML file. The core fields are:

• tool_name: which MCP tool or tools the rule applies to
• condition: the parameter check (string match, regex, data class label, or a combination)
• action: allow, block, modify, or require-approval
• severity: used to map findings to downstream systems

The proxy ships with compliance presets for SOC 2, HIPAA, GDPR, PCI-DSS, and ISO 27001. Each preset loads a default ruleset matched to that standard's requirements. You can extend or override any rule.

Where findings go

Vaikora Guard MCP is the open-source gateway. The commercial Vaikora Control Plane, hosted by Data443, connects the proxy to your existing security tooling. Decisions and alerts flow into Microsoft Sentinel, SentinelOne, CrowdStrike Falcon, Microsoft Defender, and AWS Security Hub through native integrations, with no custom connector work.

Threat indicators pushed to SentinelOne are severity-mapped: Critical at 100, High at 75, Medium at 50, Low at 25. High-severity findings promote into Azure Security Center as native incidents. Your SOC sees AI agent risk in the same interface where it handles everything else.

The proxy supports twelve LLM providers. You do not need to change your SDK or rewrite your agent to add this layer.

What to check next

Start by installing `vaikora-guard-mcp` from PyPI and running it against a test agent with a minimal policy file. Check whether your highest-risk tool calls (anything that writes, deletes, posts externally, or touches credentials) are covered by a named rule. Review the audit log format and confirm it meets your retention requirements before you use the proxy in production.

The source is on GitHub under the MIT license, so you can read the enforcement logic directly rather than trusting a black box.

More from the Vaikora blog