Vaikora › Blog › Product Updates

Putting a policy gate inside the MCP protocol: what the open-source Vaikora Guard MCP actually does

Product Updates · Nov 13, 2026 · 4 min read

Publishing an enforcement layer as open source changes what teams can audit, modify, and trust. Vaikora Guard MCP is MIT-licensed, written in Python, published on PyPI as `vaikora-guard-mcp`, and self-hostable. The source is there to read, not just to reference.

What problem this solves

An AI agent using the Model Context Protocol sends tool calls: structured requests to read a file, query a database, call an API, delete a record. The MCP protocol itself has no policy layer. It carries requests and responses. Whether a given request should be allowed, blocked, modified, or held for human approval is left entirely to the application layer.

Without an enforcement point in that layer, the only controls you have are whatever IAM policies or RBAC roles sit downstream. Those controls are coarse. They answer "does this identity have permission?" not "does this specific action, at this moment, with this payload, meet policy?"

Vaikora Guard MCP sits inline between the agent and the tools it calls. Every tool call passes through it before execution.

What happens at enforcement time

The gate applies a deterministic policy check to each action. Deterministic here means what it sounds like: identical input, identical decision, every time. There is no probabilistic scoring that produces a different answer on a second run.

The decision is one of four outcomes: allow, block, modify, or require-approval. If the action is blocked, it does not execute. If it requires approval, it holds. The agent does not proceed until the gate resolves the decision.

Enforcement latency is P50 8ms, P99 45ms, with throughput above 10,000 actions per second. Those numbers matter in agentic workflows where an agent might issue dozens of tool calls in a single task. A gate that adds meaningful latency to every hop breaks the workflow. One that adds single-digit milliseconds to most calls does not.

Every decision is written to a SHA-256 hash-chained, tamper-evident audit log. That means the record of what was allowed, blocked, or modified cannot be altered after the fact without breaking the chain. For compliance investigations or incident response, that property matters more than a plain log.

A concrete scenario

Consider an AI agent connected to a code execution tool and a file system tool. A user instructs the agent to summarize recent log files and send the summary to Slack.

Without a policy gate, the agent resolves that task however the LLM sees fit. It might read files outside the intended scope. It might call an external endpoint not on any approved list. The IAM role attached to the service account might permit both.

With Vaikora Guard MCP inline, each tool call is checked against policy before execution. A rule scoped to "file read, path prefix /logs/, read-only" blocks the agent from reading outside that prefix. A rule requiring that outbound HTTP targets match an approved list blocks the Slack call if that destination is not explicitly permitted, or routes it to an approval queue if the policy is set to require-approval rather than block.

The agent sees a policy decision. The audit log records which rule matched, what the action was, and what the outcome was. The human reviewing the incident the next morning sees an ordered, tamper-evident chain.

Compliance presets and SIEM integration

Vaikora ships presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. Each preset is a starting point, not a lock-in. Teams can extend or override rules against their specific environment.

For teams running security operations in a SIEM, the enterprise control plane integrates natively with Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub. High-severity AI agent threats surface as native incidents in Microsoft Defender for Cloud and as Threat Intelligence indicators in SentinelOne, severity-mapped at Critical=100, High=75, Medium=50, Low=25. No custom engineering is required for those integrations.

The open-source proxy supports 12 LLM providers with no SDK migration. If your stack moves from one provider to another, the policy layer does not change.

What to check next

If you want to test the gate in your own environment, install `vaikora-guard-mcp` from PyPI, point it at an existing MCP-compatible agent, and write a single policy rule against a tool call your agent makes in normal operation. Watch what the audit log produces. That is the fastest way to see how the enforcement chain behaves before you commit to a production configuration.

If your compliance requirement is SOC 2 or HIPAA, load the corresponding preset first. It gives you a baseline rule set to review and modify rather than starting from a blank policy file.

More from the Vaikora blog