Vaikora › Blog › Product Updates

vaikora-guard-mcp is MIT-licensed and on PyPI: here is what it actually does before a tool call runs

Product Updates · Nov 12, 2026 · 3 min read

The gap in most AI agent deployments is not detection. It is the interval between when an agent decides to call a tool and when that call executes. Nothing sits there. The agent sends the request, the tool runs, and any policy check happens afterward, if at all.

vaikora-guard-mcp closes that interval by sitting inline as a proxy between the MCP client and the tools it reaches. Every tool call passes through a policy decision before execution. The result is allow, block, modify, or require-approval. If the call is blocked, the tool never runs.

What "inline" means in practice

An MCP server normally receives a tool call, runs it, and returns the result. vaikora-guard-mcp wraps that flow. The proxy intercepts the incoming tool call, extracts the action and its parameters, evaluates them against a policy definition, and either forwards the call or returns a policy-enforcement response to the client.

The client sees a standard MCP response either way. No SDK change is required on the agent side. You point the agent at the proxy instead of the tool server directly.

A concrete example: an agent calls `write_file` with a path that falls outside an approved directory. The proxy reads the path parameter, matches it against the policy rule, and returns a block decision. The file is never written. The agent receives the enforcement response and can handle it according to its own error logic.

What the policy layer looks like

Policy is defined in YAML. Each rule specifies a tool name, a condition on the parameters, and an action. Rules are evaluated in order. The first match wins.

```yaml
rules:
- tool: write_file
condition:
param: path
not_starts_with: /approved/outputs/
action: block
- tool: http_request
condition:
param: url
domain_not_in: allowlist.txt
action: require_approval
```

The enforcement is deterministic: identical input always produces the same decision. There is no model involved in the policy check itself, so the result does not drift between evaluations.

Six content inspection modules ship with the proxy. They cover path traversal patterns, outbound URL destination checks, PII patterns in parameters, secret or credential patterns, prompt injection signatures in tool input strings, and size or rate thresholds. You can use them individually or compose them into a rule.

Audit trail

Every decision is written to a SHA-256 hash-chained, tamper-evident audit log. Each entry records the tool name, the full parameter set, the matched rule, the decision, and the timestamp. The hash chain links each entry to the previous one, so any modification of a past record breaks the chain at that point.

This matters for compliance review. If an auditor asks why a specific tool call was blocked or approved, the log entry gives the exact rule that applied and the parameter values that triggered it. You are not reconstructing the decision from inference, you are reading the record of what actually happened.

Running it

The package is published on PyPI as `vaikora-guard-mcp`. Install it, provide a policy YAML file, and start the proxy pointed at your existing MCP tool server. The proxy speaks MCP on both sides, so the agent and the tool server do not need modification.

```
pip install vaikora-guard-mcp
vaikora-guard-mcp --policy policy.yaml --upstream http://localhost:8080/?utm_source=vaikora&utm_medium=social&utm_campaign=content_agent&utm_content=draft_10593
```

The source is MIT-licensed and self-hostable. If your environment requires that nothing leaves your network, you run the proxy in your own infrastructure and no call touches external services.

For teams that want centralized policy management across multiple agents, Vaikora's commercial control plane handles policy distribution, real-time decision telemetry, and integration with Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub. But the open-source proxy works as a standalone enforcement point without the control plane.

What to check next

Start with the tools your agents call most frequently and map what happens if each one runs with no guardrail. For any tool that writes, deletes, posts, or calls an external endpoint, write a rule. Run the proxy in audit-only mode first, review the log to see what would have been blocked, then switch enforcement on.

The PyPI page and the GitHub repository have the full rule reference and examples for each inspection module.

More from the Vaikora blog