# Blog

> Practical articles on checking MCP servers and npm packages, tracking tool changes and governing what AI agents can call.

Canonical: https://bouncer.run/blog
Last updated: 2026-10-28

Practical notes on MCP security, tool checks and governing what AI agents can call.

October 28, 2026

## [MCP Security Scanner: Check a Server Before You Connect](https://bouncer.run/blog/mcp-security-scanner)

Which check fits an npm-based local server, a hosted MCP endpoint or a private endpoint, what a report covers, and how to turn findings into tool permissions.

[Read article →](https://bouncer.run/blog/mcp-security-scanner)

October 27, 2026

## [Your MCP server passed a scan. What happens when its tools change?](https://bouncer.run/blog/mcp-tool-changes)

A clean scan describes one moment. How MCP tool lists change, why annotations are hints rather than enforcement, and the controls that still help.

[Read article →](https://bouncer.run/blog/mcp-tool-changes)

September 2, 2026

## [Hello, agent!](https://bouncer.run/blog/hello-agent)

Introducing Bouncer: a gateway between your agents and the APIs they call, with policies, rate limits, call logs and optional per-call payments.

[Read article →](https://bouncer.run/blog/hello-agent)

## Related
- [Security Check](https://bouncer.run/check)
- [MCP gateway](https://bouncer.run/mcp-gateway)
- [Pricing](https://bouncer.run/pricing)