Vaikora › Blog › Product Updates

What happens inside Vaikora Guard MCP when an agent makes a tool call: a technical walkthrough

Product Updates · Nov 5, 2026 · 4 min read

Every agent tool call is a decision point. Before Vaikora Guard MCP runs, that decision defaults to "execute." The proxy changes the default to "evaluate first, then decide."

This post covers what the proxy does technically, how to get it running, and what policy enforcement looks like at each step.

What the proxy is and where it sits

Vaikora Guard MCP is an open-source, MIT-licensed Python proxy published on PyPI as `vaikora-guard-mcp`. It sits inline between an MCP-compatible AI agent and the LLM or tools that agent calls. Every tool call passes through it before execution.

The enforcement model is deterministic: identical input always produces an identical decision. That is intentional. It means you can reason about what the proxy will do, write tests against it, and audit the results without ambiguity.

The proxy ships six content inspection modules and adapters for major hosted model APIs. It supports 12 LLM providers with no SDK migration required. If you are already running an MCP-based workflow, the proxy inserts without rewriting your agent code.

The decision cycle for each action

When an agent issues a tool call, the proxy intercepts the request and evaluates it against configured policy. The outcome is one of four decisions:

• allow: the call proceeds as issued
• block: the call is rejected before execution, with a reason returned to the agent
• modify: the call is altered (for example, a payload is redacted) and then forwarded
• require-approval: the call is held and routed to a human reviewer before proceeding

The P50 enforcement latency is 8ms. The P99 is 45ms. At scale, the proxy handles 10,000 or more actions per second. For most agent workflows, enforcement is effectively invisible to the user.

Every decision is written to a SHA-256 hash-chained, tamper-evident audit log. Each entry in that log is signed into the chain in order, so any tampering with an earlier record breaks the chain from that point forward. That property matters if you need to demonstrate policy compliance to auditors or in an incident investigation.

Installing and running it

The proxy is on PyPI:

```
pip install vaikora-guard-mcp
```

After installation, you configure it with a policy file and point your agent at the proxy endpoint instead of calling the LLM or tool directly. The proxy then handles all forwarding. No changes to the LLM provider, no changes to the agent SDK.

Compliance presets are available for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001. A preset loads a baseline set of content inspection rules appropriate for that regulatory context. You can extend a preset with custom rules or write policy from scratch.

A concrete scenario: an agent with file read and HTTP post access

Say you have an agent that can read files from a local directory and post data to an external API. Without a policy gate, nothing stops that agent from reading a file containing PII and posting it out. The agent does not need elevated credentials to do this if it already has the access its tasks require.

With the proxy in place, you define a policy that blocks any outbound POST containing content that matches a PII pattern (email addresses, SSNs, credit card numbers, depending on your preset). When the agent issues the HTTP post tool call, the proxy inspects the payload before it leaves. If the payload matches, the call is blocked and logged. The agent receives a rejection response. The audit log records the full decision: timestamp, action type, matched rule, and outcome.

If you want a human to review ambiguous cases rather than block automatically, the require-approval path holds the call until a reviewer acts through the control plane.

What the open-source boundary is

The proxy itself, `vaikora-guard-mcp`, is the open-source component. The Vaikora Control Plane is the commercial product, hosted by Data443. The control plane provides centralized policy management, the audit log UI, approval workflows, and the integrations with Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, and AWS Security Hub.

If you are running a small agent deployment and want enforcement without the control plane, the proxy alone gives you local policy evaluation and a local audit log. If you need fleet-wide visibility, coordinated policy across multiple agents, or SIEM integration, that is where the control plane becomes relevant.

What to check next

Start by installing the proxy and running it against a test agent with a PCI-DSS or HIPAA preset. Issue a tool call that contains data that should be blocked and confirm the audit log entry. Then look at your actual agent tool permissions and ask which combinations of read and write access, if left ungated, could move sensitive data without any alert firing. That gap is what the proxy is designed to close.

The source is on GitHub. The package is on PyPI. Both are MIT-licensed.

More from the Vaikora blog