How pvnarp/kong-plugin-vard works
Vard is a Kong Gateway plugin that evaluates MCP tool calls using their arguments and Kong principal, then allows, denies, or holds them. The main flow is agent → Kong/Vard → tool server; held calls wait for human review at the approvals UI. Vard also observes tool listings to detect manifest drift and refuses the next call to a changed tool. The map preserves the documented model-gateway observer capability. Plugin internals are only partially sampled, so uncertain storage and call wiring are omitted.
Main entry points: handler.lua Vard plugin · ui.lua Approvals UI · rules.example.yaml Policy rules
Components 11
Gateway policy
- Vard plugin
kong/plugins/vard/handler.lua - Policy rules
rules.example.yaml - Call verdict
kong/plugins/vard/handler.lua
Manifest integrity
- Manifest pinning
kong/plugins/vard/handler.lua - Drift refusal
kong/plugins/vard/handler.lua
Human approval
- Approvals UI
kong/plugins/vard/ui.lua
Runtime integrations
- Kong Gateway
- MCP tool server
- AI Gateway
Other components
- MCP agent
- Human approver
Connections 14
- MCP agent → Kong Gateway: sends MCP calls
- Kong Gateway → Vard plugin: invokes plugin
- Vard plugin → Policy rules: evaluates rules
- Vard plugin → Call verdict: scores call
- Call verdict → Kong Gateway: returns decision
- Kong Gateway → MCP tool server: proxies allowed calls
- Kong Gateway → Vard plugin: passes tool listings
- Vard plugin → Manifest pinning: hashes manifests
- Manifest pinning → Drift refusal: detects changes
- Drift refusal → Vard plugin: refuses next call
- Call verdict → Approvals UI: parks held calls
- Human approver → Approvals UI: reviews requests
- Approvals UI → Call verdict: releases decision
- Kong Gateway → AI Gateway: model-lane observer