# Bouncer

> Check npm packages and MCP servers before you connect them. Then put Bouncer between your agent and its tools to enforce access rules, rate limits and spend caps.

Canonical: https://bouncer.run/

## Control which tools your AI agents can use.

Check npm packages and MCP servers before you connect them. Then put Bouncer between your agent and its tools to enforce access rules, rate limits and spend caps.

[Run a free security check](https://bouncer.run/check)

Free security check · No account needed. Gateway setup requires an account.

## Where Bouncer fits

AI agent -> Bouncer (tool policies, rate limits, spend caps, call log) -> MCP servers & APIs

Illustrative gateway request: read_document - Allowed; delete_document - Blocked.

## Check before you connect.

Read published package files for install scripts and credential access. Inspect advertised MCP tool definitions for hidden instructions before you connect.

Illustrative scan report: example-notes-mcp@1.0.0 (fictional) - No notable findings. Automated findings, not a security guarantee.

## Control every call through your gateway.

Register an existing MCP endpoint or import an OpenAPI spec. Issue a scoped gateway key, configure tool allow/deny rules and limits, then inspect the call log.

### Limit destructive tool access

Allow the tools an agent needs. Deny destructive calls with tool policies before they reach your upstream service.

### Bound request volume and spend

Set per-key rate limits, daily quotas and spend caps for calls through your gateway.

### Trace requests

Inspect tool calls, policy decisions, status and latency in your call log.

### Turn OpenAPI into MCP tools

Import an OpenAPI specification to expose existing API operations as governed MCP tools.

Keep your AI client and model. Bouncer sits on the tool side, between your agent and the MCP servers or APIs it calls. It is not an LLM router.

## For developers

Use in-page [WebMCP tools](https://bouncer.run/webmcp) or optional [x402 per-call payments](https://bouncer.run/pricing).

## Before you start

### Do I need an account?

No account is needed for a first security check. Re-scans require sign-in. Setting up a gateway, issuing keys and managing policies require an account.

### What can I check?

Check npm packages and remote MCP servers. Enter a package name or npm install command, or paste an MCP server address.

### Does the scan run package code?

No. Published package files are read as text and never executed. For remote MCP servers, Bouncer connects to read the advertised tool definitions.

### Does a scan guarantee security?

No. Reports contain automated findings, not a security certification. Review the findings and your own access requirements before connecting a tool.

### Can I use my existing MCP server or OpenAPI API?

Yes. Register an existing MCP endpoint or import an OpenAPI specification, then give your agent the Bouncer gateway URL and a scoped key.

### What does Bouncer cost?

The security check and gateway are currently free. Optional x402 payments let an API owner set a per-call price. Callers pay that amount plus blockchain network fees; Bouncer takes no platform cut.

## Related
- [Security Check](https://bouncer.run/check)
- [MCP gateway](https://bouncer.run/mcp-gateway)
- [Pricing](https://bouncer.run/pricing)