🛡️ AgentBouncer

Know what your AI agent can actually do — before it does it.

AgentBouncer scans the tools an AI agent is allowed to use (via MCP or plain tool definitions), flags the dangerous ones, scores the risk, catches exposed secrets, and hands you ready-to-use guardrail policies.

No account. No cloud. No data leaves your machine. Just a CLI you run in 60 seconds.

pipx install agentbouncer
agentbouncer scan my_agent_config.json

The problem

Companies are wiring AI agents into Gmail, Slack, GitHub, Stripe, and their databases. These agents act on their own — send emails, modify records, run SQL, trigger payments.

But almost nobody checks what an agent is actually allowed to do before turning it loose. So an agent can:

delete production data
send the wrong email to thousands of customers
run a destructive SQL query
trigger a payment
leak an API key sitting in its config

AgentBouncer is the bouncer at the door. It reads the agent's tool permissions and tells you, in plain terms, where the danger is.

What it does

Lists every tool your agent can call, grouped by what it actually does.
Classifies each action — read / write / send / db / delete / payment / admin.
Scores the risk per tool (0–10) and overall (0–100), plus a peak score for your single worst tool.
Catches exposed secrets (API keys, tokens, connection strings) — shown redacted, never in clear text.
Flags missing auth and tools that are trusted implicitly.
Generates a recommended policy (allow / ask / deny per tool) as ready-to-use YAML.
Outputs a clean report — terminal, Markdown (for your CTO/security review), or JSON (for your pipeline).

Quickstart (60 seconds)

# install (the CLI command is `agentbouncer`)
pipx install agentbouncer

# scan a config
agentbouncer scan examples/mcp_config_stripe.json

# save a Markdown report + the recommended policy
agentbouncer scan examples/mcp_config_stripe.json --output report.md --policies policy.yaml

# machine-readable output
agentbouncer scan examples/mcp_config_stripe.json --json

Example output

🛡️  AgentBouncer — Risk Report   (examples/mcp_config_stripe.json)

Tools detected: 5
  🔴 High risk    2
  🟠 Medium risk  1
  🟢 Low risk     2

Dangerous capabilities
  • charge_card        payment   10/10
  • create_payout      payment    9/10
  • list_charges       read       1/10   ✓ correctly NOT flagged as payment

⚠️  Missing auth on 1 server
🔴 Possible secret exposed:  sk_live_••••••••••••3f9a

GLOBAL RISK: 64/100      PEAK: 100/100  ⚠️ HIGH

Recommended policy → policy.yaml
  charge_card    → deny
  create_payout  → deny
  list_charges   → allow

Next steps
  1. Require human approval before any payment action
  2. Move the exposed key to an environment variable
  3. Apply policy.yaml to your agent runtime

How it works

AgentBouncer is a static analyzer — it reads a config file, it doesn't run your agent or sit in its traffic. Nothing to break, nothing to trust with your data.

Load — auto-detects MCP-style configs (mcpServers) or simple tool lists (tools).
Classify — verb-first naming heuristic with noun escalation. list_charges stays read; create_payout escalates to payment. No ML, no false-alarm soup.
Check — missing auth, dangerous tool names, implicit trust, exposed secrets.
Score — transparent weighted table (you can tune every weight).
Report — terminal / Markdown / JSON + a recommended YAML policy.

Risk categories

Category	Weight	Examples
`read`	1	`get_file`, `list_charges`
`write`	4	`update_record`, `create_issue`
`send`	5	`send_email`, `post_message`
`db`	6	`query`, `sql_exec`
`delete`	8	`delete_repo`, `drop_table`
`payment`	9	`charge_card`, `create_payout`
`admin`	10	`grant_access`, `rotate_keys`

Weights, keywords, and thresholds all live in rules/default.yaml — tune them without touching code.

What AgentBouncer is (and isn't) — yet

Today (v1): a static scanner. You point it at a config, it tells you the risk. That's it, and that's the point — useful in 60 seconds.

Not yet: live MCP connection, runtime monitoring, action blocking, dashboards, cloud. Those are on the roadmap — see ROADMAP.md. AgentBouncer will earn each of those steps, not bolt them on early.

We'd rather ship one thing that works than ten things that don't.

Who it's for

AI agencies & integrators shipping agents to clients — prove what an agent can do, cover yourself.
Startups heading into SOC 2 / ISO 42001 — get an auditable read on agent permissions.
Any developer wiring an agent to real tools who wants to sleep at night.

Contributing

AgentBouncer gets stronger with every tool the community teaches it about. The easiest, highest-impact contribution: add a policy or detection rule for a tool you use.

🐛 Found a misclassification or bug? Open an issue.
➕ Want to add rules for a new tool (GitHub, Slack, Notion, your internal API)? Edit rules/default.yaml and open a Pull Request — no need to touch the core code.
📋 Looking for somewhere to start? Check the issues tagged good first issue.

Every PR is reviewed before merging. You keep credit for your contribution.

License

MIT — free to use, modify, and build on. See LICENSE.

AgentBouncer is an independent open-source project. "MCP" refers to the open Model Context Protocol. AgentBouncer is not affiliated with any tool or platform it scans.

Agentbouncer

README