bouncerwebmcp documentation
Bouncer's WebMCP tools
Bouncer exposes WebMCP tools on every page so AI agents can run a Security Check, browse the catalog and manage APIs programmatically — plus an OAuth-protected MCP endpoint at bouncer.run/mcp.
What is WebMCP?
WebMCP lets a web page expose structured tools directly to an AI agent browsing it — no API key, no scraping, no screen-reading. Every Bouncer page registers its tools on window.__webmcp.tools, so a compatible agent can call them in-page with plain JSON and get structured answers back.
Public tools — no account needed
Available on every page, signed in or not. The Security Check tools are the same engine behind bouncer.run/check.
security_check_scan
input (string), mode? (npm | remote_mcp), auth_token? (private servers)
Runs a Security Check on an npm package or MCP server and returns the verdict, risk score, findings and a link to the full report.
security_check_get_report
name (string), version? (string), ecosystem? (npm | remote_mcp)
Fetches an existing Security Check report, e.g. the results for axios@1.20.0 or a previously scanned MCP server.
security_check_recent
none
Lists the most recent public Security Checks with their verdicts and report links.
bouncer_overview
none
A short summary of what Bouncer is and the pages available.
bouncer_navigate
page (string)
Navigates the agent's browser to a Bouncer page such as /check, /pricing or /catalog.
bouncer_how_to_publish_api
none
Step-by-step instructions for publishing an API behind the gateway.
Account tools — after sign-in
Once the visitor is signed in, these tools act on their own account. They are scoped to that user's APIs and keys and can never touch another account.
bouncer_list_apis
List the APIs and agents in your account.
bouncer_get_api
Fetch one API's config, policies and proxy URL.
bouncer_list_calls
Read the live call log: tool, decision, latency, status, tokens and payments.
bouncer_usage_summary
Aggregated usage and spend per API.
bouncer_create_api
Register a new API or paste an OpenAPI spec to generate MCP tools.
bouncer_add_policy
Add an allow- or deny-list rule to an API.
bouncer_set_api_active
Pause or resume an API's proxy URL.
Remote MCP endpoint
Agents that aren't browsing the page can use the same tool surface over Streamable HTTP at https://bouncer.run/mcp. The endpoint is protected by OAuth: the agent completes a consent flow, receives a token, and calls the tools with it.
// Example: ask for a security check from an agent
const result = await webmcp.call("security_check_scan", {
input: "axios@1.20.0",
mode: "npm",
});
// → { verdict: "warn", risk_score: 25, findings: [...], report_url: "https://bouncer.run/check/npm/axios/1.20.0" }