Vaikora › Blog › Product Updates

Why we MIT-licensed the MCP policy proxy and what that means for teams building agentic workflows

Product Updates · Nov 7, 2026 · 4 min read

Publishing source code is easy. Publishing the enforcement layer that sits between an AI agent and every tool it calls is a different decision, and it deserves a plain explanation.

Vaikora Guard MCP is the open-source proxy that checks each tool call against policy before the tool runs. It is written in Python, MIT-licensed, self-hosted, and published on PyPI as `vaikora-guard-mcp`. This post explains the design choices behind opening it up and what a team actually gets from dropping it into an agentic workflow.

What the proxy does, mechanically

When an MCP-compatible AI agent calls a tool, the request passes through the Vaikora Guard MCP proxy first. The proxy evaluates the call against a deterministic policy set and returns one of four decisions: allow, block, modify, or require-approval. The tool executes only if the decision is allow or modify. Everything else stops before execution.

Identical input always produces identical output. There is no probabilistic scoring that lets the same call through one moment and blocks it the next. That determinism matters because it makes policy auditable: you can replay a sequence of calls and get the same decisions every time.

Every decision is written to a SHA-256 hash-chained audit log. Each entry references the previous one, so tampering with a record breaks the chain. That is what gives the log its value in a compliance investigation.

Why open source the enforcement layer specifically

The enforcement layer is the part of the stack that security and compliance teams need to inspect. A policy engine running as a black box inside a vendor's infrastructure is hard to trust, hard to audit, and impossible to adapt to organization-specific requirements.

Publishing the proxy under MIT means:

• Security engineers can read exactly how a policy decision is reached.
• Teams running in air-gapped or regulated environments can self-host without depending on external services.
• Organizations can extend the policy logic to cover internal data classifications, internal tool inventories, or approval workflows that no packaged solution would anticipate.

The commercial product (the Vaikora Control Plane, hosted by Data443) adds the enterprise control surface: centralized policy management, SIEM integrations, compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001, and the native connectors to Microsoft Sentinel, CrowdStrike Falcon, and SentinelOne. The proxy itself stays open and self-contained.

A concrete scenario

Say an agentic workflow is authorized to query a database and send notifications. Without a policy gate, nothing stops a prompt-injection attack from causing the agent to call a file-deletion tool or exfiltrate a query result to an external endpoint, if those tools are reachable in the same MCP context.

With the proxy in place, you write a policy that explicitly allows `db.query` and `notify.send`, and blocks everything else by default. If the agent attempts `fs.delete` or `http.post` to an unlisted domain, the proxy blocks the call before execution and writes the blocked attempt to the audit log. The tool never runs. The audit entry is there for the investigation if one is needed.

This is not detection after the fact. The call is stopped at the gate.

What teams need to run it

Installing from PyPI takes one command. The proxy supports 12 LLM providers with no SDK migration required, so it fits into existing agent architectures without replacing infrastructure. MCP compatibility means it works with any agent built to the Model Context Protocol.

Enforcement latency runs at P50 8ms and P99 45ms, so the gate does not add meaningful overhead to most agentic workflows. Teams running high-volume pipelines can take that number to their engineering leads as a concrete figure rather than a vague assurance.

What to check next

If you are running MCP-compatible agents in production or staging, the specific thing to verify is whether tool calls pass through any policy evaluation before execution. If they do not, you have no deterministic record of what the agent attempted, no enforcement point to block unauthorized actions, and no audit trail for compliance purposes.

Pull `vaikora-guard-mcp` from PyPI, write a policy against your actual tool inventory, and run a test call that your policy should block. Check whether the audit log entry appears and whether the hash chain holds. That test takes under an hour and tells you whether your enforcement layer is real or assumed.

More from the Vaikora blog