Dep Bouncer

npm install, reimagined for AI agents.

▶ Watch the demo film (2:32): https://youtu.be/w9Ax5KPUGD8

Try it in 30 seconds

Add this live URL as a remote MCP server in your client:

https://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp

Then ask: “Use the safe_install prompt, then add axios to this project.”

Or replay the axios incident directly (Bash / zsh):

curl -X POST 'https://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp' \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'mcp-protocol-version: 2025-06-18' \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"bouncer_replay_incident","arguments":{"incident":"axios"}}}'

Works with (tested on the live server):

• NitroChat: verdict card rendered (screenshots below).
• Claude Code as an MCP client: claude mcp add --transport http dep-bouncer ; a real session called bouncer_check_package and bouncer_replay_incident, reported BLOCK with the evidence, and recommended a safe axios version.
• Claude Code guard hook: blocked the agent’s own npm install of a non-existent package (guard; Cursor hook config included).
• Any Streamable-HTTP MCP client via the URL (e.g. Cursor, NitroStudio, ChatGPT developer mode).

Dep Bouncer is an MCP server an AI coding agent calls before it installs or upgrades an npm package. It compares the release with the package’s own history (who published it, whether CI signed it, what runs at install time, which dependencies appeared, what code changed) and returns ALLOW / REVIEW / BLOCK with the evidence, plus the version to install instead.

• Live MCP endpoint: https://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp
• Demo video (2:32): https://youtu.be/w9Ax5KPUGD8