mcp-bouncer sits between your agent and its MCP servers as a stdio proxy. It checks every tools/call against an allowlist you set per server, normalizes paths before they reach the filesystem so traversal out of the workspace gets refused, and blocks URLs that resolve to private or loopback ranges to stop SSRF. Anything not explicitly permitted never reaches the server. code and docs: github.com/princejain756/mcp-bouncer   submitted by   /u/princejain756 [link]   [comments]