ezed9/mcp-bouncer is a local stdio proxy that sits between MCP clients and existing tool servers. It re-exposes tools 1:1 and inspects each call, deciding deterministically — without going through an LLM — which destination the value flows to. The criterion is not whether a tool can be used, but where the value goes. It is written in Python and licensed under MIT.
The inputs to the decision are the recorded schema, policies, and taint logs. It computes data provenance, argument constraints, and call budgets as rules, classifies each call as one of allow, deny, or ask, and records the outcome in a local audit log. Because the decision descends only through a pure Python rule engine that passes through neither an LLM nor a classifier, the same input yields the same decision, and reproducibility and auditability differ structurally from classifier-based guards. Results actually measured on the AgentDojo v1 workspace suite are also published case by case. Baseline attack success was 1/3, and 0/3 with Bouncer applied. The user-task utility went from 0.33 to 1.00, and the benign-condition utility was 1.00.
That said, the limitation of a small sample is pointed out by the record itself. This is an early v1 stage, and the extensibility of the policy DSL has not been validated. There are 2 stars and no releases yet. Under the presented conditions, blocking and task-utility retention appeared together, but these numbers alone are not enough to conclude anything about results in general MCP environments.