Vaikora › Blog › Product Updates

vaikora-guard-mcp is MIT-licensed and on PyPI: here is what it actually enforces and how

Product Updates · Nov 8, 2026 · 3 min read

Most policy enforcement on AI agents happens after something goes wrong. A tool call completes, a file gets written, a secret gets sent somewhere it should not go, and the response arrives in a log three minutes later. By that point the action already executed. vaikora-guard-mcp inverts that order: policy runs before the tool call leaves the agent.

The package is published on PyPI as `vaikora-guard-mcp`, MIT-licensed, written in Python, and self-hostable. No vendor lock-in, no required cloud dependency for the gateway itself.

What sits inline and what it checks

The proxy inserts itself between an AI agent and the tools it calls via MCP. When the agent requests a tool call, the request hits the gateway first. The gateway applies a deterministic policy decision: allow, block, modify, or require approval. The tool only executes if the decision is "allow" or the modified version passes. Identical input always produces an identical decision, which matters for audit reproducibility.

Six content inspection modules run at the gateway layer. They check the payload of each tool call for things like credential patterns, PII, prompt injection attempts, and out-of-scope data references. The inspection does not require training or model fine-tuning. The rules are configuration, not inference.

Latency at P50 is 8ms. At P99 it is 45ms. At 10,000 or more actions per second, the gateway does not become the bottleneck in an agentic pipeline.

A concrete scenario: an agent that can read and write files

Say you have an agent connected to a filesystem tool. The policy says the agent may read from `/data/reports/` but may not write anywhere outside `/tmp/agent-scratch/`. A user prompt, through prompt injection in a loaded document, tells the agent to write its output to `/etc/cron.d/`. Without a policy gate, that instruction reaches the tool and executes. With vaikora-guard-mcp in place, the write call is evaluated before it fires. The destination path fails the policy check, the action is blocked, and the decision is logged with a SHA-256 hash-chained entry. The agent gets a structured rejection it can report back; the file system is never touched.

Compliance presets and audit output

The gateway ships presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. A preset is a starting-point policy configuration aligned to the relevant control requirements for that framework, not a certification claim. Teams adjust the preset to match their actual data environment.

Every decision, whether allow, block, modify, or require approval, is written into a tamper-evident audit log. Each entry is signed into a SHA-256 hash chain, so any modification to a historical record is detectable. This matters when an auditor or incident responder asks what the agent was permitted to do at a specific time. The log answers that question with an ordered, verifiable record rather than reconstructed inference from application logs.

How the open-source layer relates to the control plane

The MIT-licensed gateway is the enforcement engine. It runs in your environment. The Vaikora Control Plane, the commercial product hosted by Data443, adds centralized policy management, cross-agent visibility, and the integrations with Microsoft Sentinel, Microsoft Defender for Cloud, CrowdStrike Falcon, SentinelOne, and AWS Security Hub. Teams can run the gateway standalone, then add the control plane when they need fleet-level governance across multiple agents.

The gateway supports 12 LLM providers with no SDK migration. It is MCP-compatible by design, so it works with any tooling that speaks MCP without requiring changes to the tool servers or the LLM client.

What to check if you are evaluating this

Start with the actual policy file format. The question worth asking is whether the policy language is expressive enough to describe the real boundaries your agents need: not just URL allowlists but data type restrictions, destination constraints, and conditional approval triggers. Then run the content inspection modules against a sample of real tool calls from your environment and verify that the detection accuracy holds for your specific payloads. The published detection accuracy in testing is 99.9%, but your data distribution is what matters for your deployment.

Install with `pip install vaikora-guard-mcp`, read the configuration reference before writing your first policy, and test block decisions explicitly rather than inferring they work from allow-side behavior.

More from the Vaikora blog