# Agentbouncer

> Scan what your AI agent can actually do — before it does it. Open-source MCP security scanner.

- **Type:** MCP server
- **Install:** `agentstack add mcp-sengchanhkano-prog-agentbouncer`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [sengchanhkano-prog](https://agentstack.voostack.com/s/sengchanhkano-prog)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [sengchanhkano-prog](https://github.com/sengchanhkano-prog)
- **Source:** https://github.com/sengchanhkano-prog/agentbouncer

## Install

```sh
agentstack add mcp-sengchanhkano-prog-agentbouncer
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# 🛡️ AgentBouncer

**Know what your AI agent can actually do — before it does it.**

AgentBouncer scans the tools an AI agent is allowed to use (via [MCP](https://modelcontextprotocol.io) or plain tool definitions), flags the dangerous ones, scores the risk, catches exposed secrets, and hands you ready-to-use guardrail policies.

No account. No cloud. No data leaves your machine. Just a CLI you run in 60 seconds.

```bash
pipx install agentbouncer
agentbouncer scan my_agent_config.json
```

---

## The problem

Companies are wiring AI agents into Gmail, Slack, GitHub, Stripe, and their databases. These agents act on their own — send emails, modify records, run SQL, trigger payments.

But almost nobody checks **what an agent is actually allowed to do** before turning it loose. So an agent can:

- delete production data
- send the wrong email to thousands of customers
- run a destructive SQL query
- trigger a payment
- leak an API key sitting in its config

AgentBouncer is the bouncer at the door. It reads the agent's tool permissions and tells you, in plain terms, where the danger is.

---

## What it does

- **Lists every tool** your agent can call, grouped by what it actually does.
- **Classifies each action** — `read` / `write` / `send` / `db` / `delete` / `payment` / `admin`.
- **Scores the risk** per tool (0–10) and overall (0–100), plus a *peak* score for your single worst tool.
- **Catches exposed secrets** (API keys, tokens, connection strings) — shown redacted, never in clear text.
- **Flags missing auth** and tools that are trusted implicitly.
- **Generates a recommended policy** (`allow` / `ask` / `deny` per tool) as ready-to-use YAML.
- **Outputs a clean report** — terminal, Markdown (for your CTO/security review), or JSON (for your pipeline).

---

## Quickstart (60 seconds)

```bash
# install (the CLI command is `agentbouncer`)
pipx install agentbouncer

# scan a config
agentbouncer scan examples/mcp_config_stripe.json

# save a Markdown report + the recommended policy
agentbouncer scan examples/mcp_config_stripe.json --output report.md --policies policy.yaml

# machine-readable output
agentbouncer scan examples/mcp_config_stripe.json --json
```

### Example output

```
🛡️  AgentBouncer — Risk Report   (examples/mcp_config_stripe.json)

Tools detected: 5
  🔴 High risk    2
  🟠 Medium risk  1
  🟢 Low risk     2

Dangerous capabilities
  • charge_card        payment   10/10
  • create_payout      payment    9/10
  • list_charges       read       1/10   ✓ correctly NOT flagged as payment

⚠️  Missing auth on 1 server
🔴 Possible secret exposed:  sk_live_••••••••••••3f9a

GLOBAL RISK: 64/100      PEAK: 100/100  ⚠️ HIGH

Recommended policy → policy.yaml
  charge_card    → deny
  create_payout  → deny
  list_charges   → allow

Next steps
  1. Require human approval before any payment action
  2. Move the exposed key to an environment variable
  3. Apply policy.yaml to your agent runtime
```

---

## How it works

AgentBouncer is a **static analyzer** — it reads a config file, it doesn't run your agent or sit in its traffic. Nothing to break, nothing to trust with your data.

1. **Load** — auto-detects MCP-style configs (`mcpServers`) or simple tool lists (`tools`).
2. **Classify** — verb-first naming heuristic with noun escalation. `list_charges` stays `read`; `create_payout` escalates to `payment`. No ML, no false-alarm soup.
3. **Check** — missing auth, dangerous tool names, implicit trust, exposed secrets.
4. **Score** — transparent weighted table (you can tune every weight).
5. **Report** — terminal / Markdown / JSON + a recommended YAML policy.

### Risk categories

| Category  | Weight | Examples |
|-----------|:------:|----------|
| `read`    | 1  | `get_file`, `list_charges` |
| `write`   | 4  | `update_record`, `create_issue` |
| `send`    | 5  | `send_email`, `post_message` |
| `db`      | 6  | `query`, `sql_exec` |
| `delete`  | 8  | `delete_repo`, `drop_table` |
| `payment` | 9  | `charge_card`, `create_payout` |
| `admin`   | 10 | `grant_access`, `rotate_keys` |

Weights, keywords, and thresholds all live in [`rules/default.yaml`](rules/default.yaml) — tune them without touching code.

---

## What AgentBouncer is (and isn't) — yet

**Today (v1):** a static scanner. You point it at a config, it tells you the risk. That's it, and that's the point — useful in 60 seconds.

**Not yet:** live MCP connection, runtime monitoring, action blocking, dashboards, cloud. Those are on the roadmap — see [`ROADMAP.md`](ROADMAP.md). AgentBouncer will earn each of those steps, not bolt them on early.

We'd rather ship one thing that works than ten things that don't.

---

## Who it's for

- **AI agencies & integrators** shipping agents to clients — prove what an agent can do, cover yourself.
- **Startups heading into SOC 2 / ISO 42001** — get an auditable read on agent permissions.
- **Any developer** wiring an agent to real tools who wants to sleep at night.

---

## Contributing

AgentBouncer gets stronger with every tool the community teaches it about. The easiest, highest-impact contribution: **add a policy or detection rule for a tool you use.**

- 🐛 Found a misclassification or bug? [Open an issue](../../issues).
- ➕ Want to add rules for a new tool (GitHub, Slack, Notion, your internal API)? Edit [`rules/default.yaml`](rules/default.yaml) and open a Pull Request — no need to touch the core code.
- 📋 Looking for somewhere to start? Check the issues tagged `good first issue`.

Every PR is reviewed before merging. You keep credit for your contribution.

---

## License

MIT — free to use, modify, and build on. See [LICENSE](LICENSE).

---

*AgentBouncer is an independent open-source project. "MCP" refers to the open Model Context Protocol. AgentBouncer is not affiliated with any tool or platform it scans.*

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [sengchanhkano-prog](https://github.com/sengchanhkano-prog)
- **Source:** [sengchanhkano-prog/agentbouncer](https://github.com/sengchanhkano-prog/agentbouncer)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-sengchanhkano-prog-agentbouncer
- Seller: https://agentstack.voostack.com/s/sengchanhkano-prog
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.