Vaikora › Blog › Product Updates

You can run a policy gate on every MCP tool call with nine lines of Python and a free open-source proxy

Product Updates · Nov 5, 2026 · 4 min read

AI agents built on the Model Context Protocol run tool calls by default. Nothing in the protocol itself checks whether a given call should be allowed before it executes. That gap matters most when an agent has access to file systems, databases, external APIs, or any resource where a bad or malformed call causes real damage.

Vaikora Guard MCP is a self-hosted proxy that sits between an agent and the tools it calls. It enforces an allow, block, modify, or require-approval decision before each call runs. It is open-source under the MIT licence, written in Python, and published on PyPI as `vaikora-guard-mcp`.

What the proxy actually does

When an agent issues a tool call, the request hits the Vaikora Guard MCP proxy rather than the tool directly. The proxy evaluates the call against a policy definition, issues a deterministic decision, and then either forwards the call, blocks it, rewrites the arguments, or holds it for a human to approve. The original call never reaches the tool until that decision is made.

The important word is "deterministic": identical input always produces identical output. There is no probabilistic scoring or model-based judgment in the enforcement path. The policy either matches or it does not.

Every decision is written to a SHA-256 hash-chained audit log. Each entry references the previous one, so tampering with a record breaks the chain. That gives you an ordered, tamper-evident history of what every agent was permitted or denied, which is what compliance teams and incident investigators actually need.

How to wire it in

The proxy installs from PyPI:

```
pip install vaikora-guard-mcp
```

A minimal policy file looks like this:

```yaml
rules:
- tool: file_write
match:
path_prefix: /etc
decision: block
- tool: http_request
match:
domain_suffix: .internal
decision: require_approval
- tool: "*"
decision: allow
```

Point your MCP-compatible agent at the proxy endpoint instead of the tool server endpoint. No SDK migration, no code changes to the agent itself. The proxy handles the interception and re-routing transparently.

For a concrete case: an agent with file-write access that receives a prompt injection telling it to overwrite a system configuration file. The call arrives at the proxy, the `file_write` rule matches the `/etc` path prefix, and the proxy blocks the call before it reaches the file system. The agent receives a denial response and continues. No file is touched.

What ships in the six inspection modules

The proxy ships with six content inspection modules that run against call arguments before the policy decision fires:

• PII detection: flags calls that pass personal data to tools that should not receive it
• Secret scanning: catches API keys, tokens, and credentials in call arguments
• Prompt injection detection: identifies instruction-override patterns in content the agent is passing through
• Data exfiltration signals: flags calls that appear to bulk-move data to external destinations
• Schema validation: rejects calls whose arguments do not conform to the tool's declared schema
• Custom regex rules: lets you define your own match patterns for domain-specific content

Each module runs in the inspection layer before the policy rule is evaluated. A call that triggers the secret scanner can be blocked regardless of which tool it targets.

Connecting to the enterprise control plane

The open-source proxy is self-contained. You write policies as YAML files, run the proxy locally or in a container, and read the audit log directly.

If your organization needs centralized policy management across multiple agents, real-time visibility into agent decisions, or integration with your SIEM, the Vaikora Control Plane is the commercial layer that connects to the proxy. It pushes policy updates centrally, surfaces audit events into Microsoft Sentinel, SentinelOne, CrowdStrike Falcon, and AWS Security Hub, and maps severity-scored agent threat indicators into those platforms without custom engineering.

Compliance presets for HIPAA, PCI-DSS, GDPR, SOC 2, and ISO 27001 ship ready to load. That is not a promise of certification. It means the policy rules that map to those frameworks are pre-written and can be activated as a starting point.

What to do next

Pull the package from PyPI and read the policy schema reference before you write your first rule. The most common mistake is writing overly broad allow rules at the top of the file: rules evaluate in order, so a permissive early match stops the more specific rules below it from firing.

If you are running agents with access to production infrastructure, start by auditing your current tool call volume in log-only mode. The proxy can emit decisions without enforcing them, so you can see what your policies would have blocked before you turn on hard enforcement. That audit baseline is worth having before any agent touches anything consequential.

More from the Vaikora blog