Docs: third-party MCP proxy + runtime audit option (Vaara) for Aider's MCP support threads

Feature description

Aider's queue has several open threads asking for MCP support and adjacent agent-governance shapes:

• #2525 (Please add support for Model Context Protocol from Anthropic)
• #3314 (MCP SUPPORT)
• #4506 (Add native MCP server and Agent Mode support to Aider CLI, as in AiderDesk)
• #5121 (Proposal: optional pre-commit safety scan with Agent Threat Rules)

This is a request for docs recognition of an OSS option that addresses the governance side of those threads without requiring core Aider changes.

I maintain Vaara (AGPL-3.0-or-later), an MCP proxy and runtime governance layer. It sits between Aider (when running with MCP support) and any stdio MCP server the user configures. Every tools/call, resources/read, and prompts/get gets a hash-chained audit record. Optional Ed25519-signed OVERT 1.0 envelopes per interaction. Allow and deny rules at the perimeter so Aider users can scope which tools an MCP server exposes.

The proxy is transparent. The initialize handshake, tools/list, resources/list, prompts/list, and notifications/* all forward unchanged. Existing Aider workflows continue. The audit chain is what Vaara adds.

Why this might fit

The Agent Threat Rules proposal in #5121 is a pre-commit scanner. Vaara is a runtime substrate that records the agent's actions while they happen, so a rule-pack approach like ATR can run as policy inputs into the Vaara audit chain. The two compose: ATR provides the rule pack, Vaara provides the runtime evidence chain those rules fire against.

The MCP-support requests (#2525, #3314, #4506) all assume Aider gains an MCP client. Once that lands, Vaara fits in front of whichever MCP server an Aider user configures, no changes inside Aider needed.

Solution requested

A docs mention as a third-party governance and audit option in the Aider docs, under the MCP or troubleshooting section depending on where MCP support eventually lives. The integration shape mirrors the existing examples in the Vaara repo:

https://github.com/vaaraio/vaara/tree/main/examples/

Additional context

• Vaara is acknowledged in the industry contributors of the IMDA Model AI Governance Framework for Agentic AI v1.5 (Singapore, 20 May 2026).
• AMD developer testimonial, May 2026.
• OpenSSF Best Practices Project 12612.
• Coverage map against the MIT AI Risk Repository v4: https://github.com/vaaraio/vaara/blob/main/docs/mit_ai_risk_repository_mapping.md

If maintainers say yes, I will open a docs PR scoped to whichever section is right. If no, no PR will follow.

Henri Sirkkavaara [email protected] https://github.com/vaaraio/vaara