Vaikora › Blog › Product Updates

vaikora-guard-mcp: a self-hosted MCP proxy that blocks tool calls before they run, not after

Product Updates · Oct 22, 2026 · 3 min read

Policy enforcement that runs after a tool call completes is not enforcement. It is logging. The problem with most MCP server designs is that they pass the call through first and apply any checks on the response side, which means the action already happened.

vaikora-guard-mcp is an open-source, MIT-licensed MCP-compatible proxy, published on PyPI, that sits inline between an AI agent and the tools it calls. Every tool call goes through a policy check before execution. If the call is blocked, it never reaches the downstream service.

What "inline" actually means here

When an AI agent issues a tool call through an MCP interface, the request hits vaikora-guard-mcp first. The proxy runs six content inspection modules against the call: checking the action type, parameters, data content, and the calling context. It then issues one of four decisions: allow, block, modify, or require-approval.

Only after that decision resolves does the call proceed. A block means the downstream tool never sees the request. A require-approval decision holds the call until a human or an automated policy authority responds. The agent gets a structured response in either case, so it does not hang.

This is deterministic enforcement: identical input produces identical output every time. There is no probabilistic filtering, no model-based scoring that shifts with temperature. The policy is a policy, not a classifier.

Concrete scenario: an agent calling an external API with sensitive parameters

Say you have an agent that searches a customer database and then formats results into a report. The search tool call includes a filter parameter. Your policy says: no customer PII leaves this agent context without approval.

Without an inline gate, the call goes out, PII is included in the tool response, and it surfaces in whatever the agent does next. By the time a log entry records it, the data has already moved.

With vaikora-guard-mcp in the path, the inspection module flags the parameter set as matching a PII pattern. The call is held for approval or blocked outright, depending on how the policy is written. The downstream API receives nothing. Every decision writes to a SHA-256 hash-chained audit log, so the record of what was blocked, when, and why is tamper-evident.

How to run it

vaikora-guard-mcp is written in Python and available on PyPI as `vaikora-guard-mcp`. Installation is:

```
pip install vaikora-guard-mcp
```

It runs as a self-hosted proxy, so your tool call traffic does not leave your environment to be checked. You configure policy rules locally. For teams that want centralized policy management, multi-agent visibility, and the audit infrastructure at scale, that is where the Vaikora Control Plane connects. But the proxy works standalone.

The MIT license means you can read the enforcement logic, fork it, and run it in any environment. There are no call-home requirements in the open-source layer.

Audit trail and compliance presets

Every allow, block, modify, and require-approval decision is signed into the hash chain. This gives you an ordered, tamper-evident record of every tool call an agent attempted and what the policy did with it.

Compliance presets ship for SOC 2, HIPAA, GDPR, PCI DSS, and ISO 27001. These are pre-written policy configurations for each framework's relevant controls around data handling and access. You load the preset, adjust for your environment, and the relevant guardrails apply to every tool call from that point forward.

Enforcement latency sits at P50 8ms and P99 45ms. At 10,000+ actions per second throughput, the proxy is not the bottleneck in any realistic agentic workflow.

What to check next

If you are running MCP-connected agents in any environment where data classification or access control matters, pull the package and read the policy configuration documentation before you wire up production tool calls. Specifically, check:

• Which content inspection modules apply to your tool call patterns
• Whether your agent framework passes enough calling context for the policy to distinguish between legitimate and risky requests
• How you want to handle require-approval decisions in your workflow: human queue, automated policy authority, or hard block fallback

The source is on PyPI. Policy is enforced before execution, or it is not enforcement.

More from the Vaikora blog