MCP Bouncer

MCP Bouncer is an open-source MCP proxy that blocks AI agent send calls to destinations found in untrusted data.

MCP Bouncer is a local MCP proxy designed to limit what a compromised AI agent can do through Model Context Protocol servers. It works by monitoring tool outputs, recording data as untrusted, and deterministically denying send and share calls targeting destinations that previously appeared in untrusted output. Built for users running MCP clients, it applies path confinement, per-session call budgets, regex checks, and strict validation without relying on any LLMs for enforcement decisions. Every action is logged as a JSON line for audit purposes, and a built-in report command generates a markdown review pack. It supports MCP over stdio on a single machine and integrates with common MCP clients like Claude Code, Cursor, and Claude Desktop.

MCP Bouncer at a glance

Best for: Software engineer
Runs on: CLI, self-hosted, open source
Pricing: Free
Released: October 2026
Category: AI agent tool
Website: github.com/ezed9/mcp-bouncer

Key features

Blocks sends to destinations found in untrusted tool data
Enforces path confinement and regex checks on arguments
Implements per-session call budgets
Logs every allow, deny, and ask decision to an audit file
Generates markdown review packs from audit logs
Uses deterministic rules without any LLM in the enforcement path

Use it for

Preventing data exfiltration via poisoned tool outputs
Auditing AI agent tool calls and decisions
Restricting file paths and write tool operations
Controlling agent access to external messaging and email servers

Alternatives to MCP Bouncer

mcpgawk — Pins each tool to what you approved and blocks calls if a server changes.
APIStack — Connect AI agents to over 100 tools using one API key or a single MCP endpoint.
HaltState MCP — Enforces backend action policies automatically without human approval queues.
Planlock — Stops unauthorized agent calls through code enforcement instead of prompts.
Proxy — Restricts agent access and stops context sharing across multiple personal agents
Melra — Governs AI agent tool calls with local policies, approval gates, and verified receipts.
Windows-MCP — Enables any LLM to perform native Windows tasks without complex vision models.
Kilasec — Stops runaway spend and masks sensitive data without modifying agent code.
TaintWall — Enforces deterministic security policies at the tool boundary for AI agents.
LLM Cost Firewall — Catches infinite tool loops and stops budget overruns instantly.
AgentGate — Blocks attacks in under 35ms with a local neural classification head.
iFixAi — Audits agent behavior independently without building manual eval harnesses.

All MCP Bouncer alternatives