Show HN: Check an NPM package or MCP server for malicious code before install

Category: security

Tags: security, npm, mcp, supply-chain, ai-agents

Score: 5.0/10 (Innovation: 5, Technical: 4, Documentation: 3, Utility: 6)

Bouncer is a web service that scans npm packages and MCP servers for malicious code before you install them. It targets the growing risk of AI agents blindly installing code from chat messages, providing a textual risk assessment without executing anything. It's a timely security utility, though the closed-source nature and minimal public info limit deeper evaluation.

Target audience: backend devs, AI agent users, devops, security engineers

Repository: https://bouncer.run/check

View on Hacker News