MCPbouncer open-sources a local action firewall for AI agents wired to MCP tools

A developer has released MCPbouncer, an open-source desktop firewall that sits between AI coding assistants and the MCP servers giving those assistants access to local files, shells and databases. Announced in a September 13 post on dev.to, the tool wraps existing Model Context Protocol servers, inspects every tool call flowing across the connection, and pauses destructive or suspicious actions until a human approves them.

The gap it aims to close

The post's author argues that developers are wiring tools such as Cursor, Claude Desktop, Windsurf and Zed, along with custom LLM frameworks, straight into local systems through standard MCP servers for filesystem access, terminal execution and databases like Postgres. In that setup the AI client gives the developer only the final result, not the stream of JSON-RPC messages crossing the stdio connection in between.

That creates several risks the post lays out. A hallucinated shell command or SQL statement can delete code or drop tables before anyone notices. An agent that reads a .env file or an SSH key can pass those secrets along inside arguments to another tool, either by accident or because an indirect prompt injection told it to. Untrusted content the agent reads, such as web pages or files, can hijack its instructions, including via zero-width Unicode characters or hidden Markdown image tags. And there is no unified, real-time audit trail of what tools actually executed.

How the proxy works

MCPbouncer positions itself as an inline, zero-trust proxy between the AI client and downstream MCP servers. Setup is CLI-driven: npx mcpbouncer scan finds MCP servers registered in Cursor and Claude Desktop, npx mcpbouncer protect --all wraps them, and npx mcpbouncer dashboard starts a local web dashboard on 127.0.0.1:4114 where the operator can watch traffic, inspect payloads and approve pending actions. The author describes the tool as zero-dependency and fully local, with no cloud telemetry or remote tracking.

What the firewall claims to do

The announcement credits the tool with five main capabilities:

• A live, Wireshark-style inspector showing each JSON-RPC 2.0 tool call, its parameters, execution duration and response in real time.
• Human-in-the-loop interception: high-risk operations such as SQL drops, recursive shell deletions and disk-level actions are paused with an ALLOW/BLOCK desktop prompt.
• Outbound data-loss prevention: a regex engine the author claims is sub-millisecond and ReDoS-bounded detects API keys for providers including OpenAI, Anthropic, AWS, GitHub, Stripe and Slack, and strips them before they leave the machine.
• An injection and steganography shield that flags instruction overrides, jailbreak personas and hidden zero-width Unicode smuggling.
• A cryptographic audit trail: every tool execution writes a SHA-256 action receipt to a local ledger the author describes as tamper-evident, aimed at SOC 2 and ISO compliance work.

The project is licensed under Apache-2.0 and built with TypeScript, Node.js, React 19, Tailwind CSS and Vite, with the code published on GitHub.

Caveats worth noting

Every claim above comes from the project's own announcement rather than an independent review, and there is currently only a single source for the story. The performance figure for the DLP engine and the compliance framing in particular are vendor claims. Regex-based secret detection is also a well-known cat-and-mouse problem: it catches known key formats but not arbitrary exfiltration. And the firewall model assumes the proxy can read all traffic in the clear, which fits stdio-based MCP servers but may not cover every integration path.

Why it matters

MCP is quickly becoming the default way to hand AI agents real capabilities on a developer's machine, and the permission model has not kept pace: a standard filesystem or terminal server grants sweeping access with little granularity and no record of use. MCPbouncer is an early attempt to treat AI agent actions like network traffic, inspectable, filterable and auditable, which is roughly the model that made packet inspectors and content blockers foundational in their own domains. Even if this particular tool does not win out, the pattern it represents, a local action firewall paired with an audit ledger, is the kind of control enterprises are likely to demand before letting autonomous agents near production credentials, and it points to an emerging category of middleware between the model and the machine.