Dep Bouncer

v0.1.0

A powerful MCP server built with NitroStack

Connection Setup

Add via Cursor Settings UI (Settings > Features > MCP > Add New MCP Server): 

{
  "mcpServers": {
    // your other mcp servers
    "dep-bouncer": {
      "url": "http://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp"
    }
  }
}

Connect remote tools directly via Claude's Web UI:

Add custom connector BETA
Connect Claude to your data and tools. Learn more about connectors or get started with pre-built ones.
Advanced settings
Only use connectors from developers you trust. Anthropic does not control which tools developers make available and cannot verify that they will work as intended or that they won't change.
Building an MCP server? Report issues and subscribe to updates here

Configure custom tools directly via ChatGPT's Web UI:

New App
Icon (optional)
PNG only. Best results at 256 x 256 px or larger. Max file size: 10 KB
Name
Description (optional)
Connection
Authentication
Custom MCP servers introduce risk. Learn more
OpenAI hasn't reviewed this MCP server. Attackers may attempt to steal your data or trick the model into taking unintended actions, including destroying data.
Read the guide

Add the following configuration block under mcpServers in your Antigravity configuration file (~/.gemini/config/mcp_config.json): 

{
  "mcpServers": {
    // your other mcp servers
    "dep-bouncer": {
      "serverUrl": "http://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp"
    }
  }
}

Add the following configuration block to your Codex configuration file (~/.codex/config.toml): 

[mcp_servers.dep-bouncer]
url = "http://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp"

Connect directly using the Server-Sent Events endpoint: 

http://dep-bouncer-6ad22414-giberelin-heapify-global-community.app.nitrocloud.ai/mcp
Available Tools
bouncer_check_package

Call this BEFORE `npm install <pkg>` or adding a dependency. Compares the release with the package's own history (publisher, provenance, install scripts, new dependencies, code diff, name) and returns ALLOW, REVIEW or BLOCK with evidence, what npm audit/OSV say, and a safe version to install instead when blocked.

bouncer_check_upgrade

Call this before bumping a dependency from one version to another. Returns the verdict on the new version plus what changed between the two (publisher, provenance, install scripts, dependencies).

bouncer_safe_version

Returns the newest version of a package (optionally within a semver range such as "^1.14.0") that passes every Dep Bouncer check, and which newer versions were skipped and why. Use it to pick what to install instead of a blocked release.

bouncer_review_install_scripts

npm 12 skips dependency install scripts until they are approved (`npm approve-scripts`), but only shows the command. Pass the packages it lists; for each one this returns the scripts, why, and APPROVE / REVIEW / DENY. Also useful on npm 11 to see which dependencies run code at install time.

bouncer_check_manifest

Checks every dependency in a package.json at the version npm would install for its range today (the newest match), e.g. before running `npm install` in a cloned repo. Runs as an MCP Task with live progress; returns BLOCK/REVIEW first, each with the reason and a safe version.

bouncer_diff_release

Raw evidence for humans: what changed between two versions of a package (publisher, provenance, install scripts, dependencies, files added/removed/changed, and risky code patterns new in this release). Use it to explain a REVIEW or BLOCK.

bouncer_replay_incident

Replays a real npm hijack through Dep Bouncer, as an agent would have met it 30 minutes after publication, before any advisory existed. Incidents: axios (2026), keyv (2026), chalk (2025), nx (2025), tinycolor (2025). The malicious versions were removed from npm, so the bad release is a clearly labelled reconstruction with benign stand-in code.