Skip to main content
bouncer

Security checks + MCP gateway

Control which tools your AI agents can use.

Check npm packages and MCP servers before you connect them. Then put Bouncer between your agent and its tools to enforce access rules, rate limits and spend caps.

Run a free security check

Free security check · No account needed

Set up your gateway
AI agent
Bouncer
  • Tool policies
  • Rate limits
  • Spend caps
  • Call log
MCP servers
& APIs

Illustrative gateway request

read_documentAllowed

delete_documentBlocked

01 / Before you connect

Check before you connect.

Read published package files for install scripts and credential access. Inspect advertised MCP tool definitions for hidden instructions before you connect.

Check a package or MCP server

Illustrative scan report

example-notes-mcp@1.0.0 (fictional)

No notable findings

Automated findings, not a security guarantee.

02 / At runtime

Control every call through your gateway.

Register an existing MCP endpoint or import an OpenAPI spec. Issue a scoped gateway key, configure tool allow/deny rules and limits, then inspect the call log.

  1. 01Register your MCP endpoint or OpenAPI API
  2. 02Issue a scoped gateway key
  3. 03Set tool policies, rate limits and spend caps
  4. 04Inspect requests and decisions in the call log
Set up your gatewayHow the gateway works

Your tools. Your boundaries.

Limit destructive tool access

Allow the tools an agent needs. Deny destructive calls with tool policies before they reach your upstream service.

Bound request volume and spend

Set per-key rate limits, daily quotas and spend caps for calls through your gateway.

Trace requests

Inspect tool calls, policy decisions, status and latency in your call log.

Turn OpenAPI into MCP tools

Import an OpenAPI specification to expose existing API operations as governed MCP tools.

Keep your AI client and model. Bouncer sits on the tool side, between your agent and the MCP servers or APIs it calls. It is not an LLM router.

For developers

Connect through WebMCP. Charge only if you choose.

Use Bouncer’s in-page WebMCP tools and generated snippets, or enable optional x402 per-call payments on your API.

WebMCP docsPricing & x402

Before you start

Do I need an account?

No account is needed for a first security check. Re-scans require sign-in. Setting up a gateway, issuing keys and managing policies require an account.

What can I check?

Check npm packages and remote MCP servers. Enter a package name or npm install command, or paste an MCP server address.

Does the scan run package code?

No. Published package files are read as text and never executed. For remote MCP servers, Bouncer connects to read the advertised tool definitions.

Does a scan guarantee security?

No. Reports contain automated findings, not a security certification. Review the findings and your own access requirements before connecting a tool.

Can I use my existing MCP server or OpenAPI API?

Yes. Register an existing MCP endpoint or import an OpenAPI specification, then give your agent the Bouncer gateway URL and a scoped key.

What does Bouncer cost?

The security check and gateway are currently free. Optional x402 payments let an API owner set a per-call price. Callers pay that amount plus blockchain network fees; Bouncer takes no platform cut.

See pricing

Check your next tool. Then set its boundaries.

Start with a package or MCP server. Set up a gateway when you’re ready to control its calls.

Run a free security check

Free security check · No account needed

Set up your gateway