Vaikora › Blog › Product Updates

MCP tool call enforcement from first principles: what the open-source proxy does and why it sits where it does

Product Updates · Nov 7, 2026 · 4 min read

Most policy enforcement for AI agents happens after the fact: logs reviewed, alerts triaged, damage already done. The problem with that approach is that a tool call that has already executed has already written to the database, sent the message, or deleted the file.

vaikora-guard-mcp is a small MCP-compatible proxy, MIT licensed and published on PyPI, that sits inline between an AI agent and the tools it wants to call. The proxy intercepts each tool call, checks it against a policy file, and returns an allow, block, modify, or require-approval decision before the action runs.

What "inline" means here and why the position matters

The proxy inserts itself into the MCP protocol layer. When an agent issues a `tools/call` request, that request reaches the proxy first. The proxy evaluates it against configured policy rules, then either forwards the call, rewrites it, holds it for a human, or returns a block decision. The underlying tool never sees the request if the decision is block.

This is different from a sidecar that watches traffic and fires alerts. A sidecar can tell you what happened. A proxy in this position can prevent it.

The enforcement decision is deterministic: identical input, identical output, every time. No probabilistic scoring that might go differently on a retry.

What the policy file controls

Policy is expressed in a declarative configuration. Rules can target:

• Specific tool names (block a file-deletion tool outside approved workflows)
• Argument patterns (flag any `SELECT *` passed to a database query tool)
• Calling context (require approval when the agent is operating on customer PII)
• Rate and sequence conditions (block the third credential lookup in sixty seconds)

A worked example: an agent is authorized to call a `send_email` tool, but policy requires that any outbound email containing a phrase matching a customer account number pattern is held for human approval before dispatch. The proxy inspects the argument payload against the pattern, holds the call, routes it to an approval queue, and the agent receives a pending response. If approval is granted, the proxy forwards the original call unchanged. If denied, the agent receives a rejection it can handle in its own logic.

No changes to the agent code are needed. No changes to the tool server. The proxy handles interception transparently.

Auditability built into the architecture

Every decision the proxy makes is written to a SHA-256 hash-chained, tamper-evident audit log. Each log entry records the tool name, the full argument payload, the policy rule that matched, the decision taken, and a timestamp. Because the entries are hash-chained, any deletion or modification of an earlier entry breaks the chain and is detectable.

This matters for compliance reviews. When an auditor asks what an AI agent did during a specific window, the log answers with a verifiable record, not a best-effort reconstruction from application logs.

Installing and running it

The package is on PyPI as `vaikora-guard-mcp`. Install with:

`pip install vaikora-guard-mcp`

From there, write a policy YAML, point the proxy at your MCP tool server, and start it. The proxy handles the MCP handshake and presents the same tool manifest to the agent. The agent calls tools normally. The proxy checks them.

Enforcement latency is P50 8ms and P99 45ms, which is low enough that it does not materially change the latency profile of a typical agentic workflow.

The proxy self-hosts. The source is on GitHub under the MIT license, so teams can read exactly what the inspection logic does, modify it for their environment, and contribute changes back.

Where the enterprise control plane fits in

For teams that need centralized policy management across multiple agents, audit log aggregation, real-time alerting, and integration with existing security tooling, the Vaikora Control Plane sits above the proxy layer. It connects to Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub, and ships compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001.

The open-source proxy and the control plane use the same enforcement engine. A policy that works in a local deployment carries over without rewriting.

What to check next

If you are running any MCP-compatible agent today without a policy gate on tool calls, the first thing worth doing is enumerating which tools that agent can call and what the worst-case outcome is if one of those calls executes without a check. Start there, write a policy rule for the highest-risk tool, and run the proxy in audit-only mode to see what it would have blocked in the last twenty-four hours before you switch it to enforce.

More from the Vaikora blog