npm install，为人工智能代理重新构想。

** ▶ 观看演示影片（2：32）:** https://youtu.be/w9Ax5KPUGD8

30秒后试试

将此实时URL作为客户端的远程MCP服务器添加：

https://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp

然后问：“用safe_install提示，然后给这个项目添加公理。”*

或者直接重播Axios事件（Bash / zsh）：

可支持（在正式服务器上测试）：

• NitroChat：判决卡已呈现（截图见下方）。
• Claude Code 作为 MCP 客户端：claude mcp add --transport http dep-bouncer ;a 真实会话称为bouncer_check_package和bouncer_replay_incident，报告为BLOCK 结合证据，并推荐了一个安全的Axios版本。
• Claude Code guard hook：阻断代理自身 npm install 的不存在包 （守卫;包括光标钩配置）。
• 通过URL访问任何可流式HTTP的MCP客户端（例如光标、NitroStudio、ChatGPT开发者模式）。

Dep Bouncer 是一个 MCP 服务器，AI 编码代理会在安装或升级 NPM 之前调用 package。它将发布内容与 软件包自身的历史（谁发布了，是否

Dep Bouncer

npm install, reimagined for AI agents.

▶ Watch the demo film (2:32): https://youtu.be/w9Ax5KPUGD8

Try it in 30 seconds

Add this live URL as a remote MCP server in your client:

https://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp

Then ask: “Use the safe_install prompt, then add axios to this project.”

Or replay the axios incident directly (Bash / zsh):

curl -X POST 'https://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp' \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'mcp-protocol-version: 2025-06-18' \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"bouncer_replay_incident","arguments":{"incident":"axios"}}}'

Works with (tested on the live server):

• NitroChat: verdict card rendered (screenshots below).
• Claude Code as an MCP client: claude mcp add --transport http dep-bouncer ; a real session called bouncer_check_package and bouncer_replay_incident, reported BLOCK with the evidence, and recommended a safe axios version.
• Claude Code guard hook: blocked the agent’s own npm install of a non-existent package (guard; Cursor hook config included).
• Any Streamable-HTTP MCP client via the URL (e.g. Cursor, NitroStudio, ChatGPT developer mode).

Dep Bouncer is an MCP server an AI coding agent calls before it installs or upgrades an npm package. It compares the release with the package’s own history (who published it, whether CI signed it, what runs at install time, which dependencies appeared, what code changed) and returns ALLOW / REVIEW / BLOCK with the evidence, plus the version to install instead.

• Live MCP endpoint: https://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp
• Demo video (2:32): https://youtu.be/w9Ax5KPUGD8