MCP proxy that blocks exfil addresses from tool output: 48/164 attacks to 0, but blocks legit sends too
eccentric_ez · reddit · 2026-11-05
A developer released bouncer-mcp (MIT, on PyPI), a proxy between your MCP client and servers that checks every tool call with plain Python rules — no LLM in the loop. If a send/share target address first appeared in tool output (email, ticket, doc), the call is denied; unknown-origin addresses trigger a user elicitation.
Tested on agentdojo (workspace suite, gpt-4o-mini, one fixed attack): attack success dropped from 48/164 to 0/163 — but the author honestly notes the 0 is mostly by construction, since every send including legitimate ones was denied. Without attacks, the 6 tasks requiring email/file-share went from 4/6 to 0/6 completed.
Post-mortem gems: user-typed addresses that also appeared in tool output got denied; a substring bug denied [email protected] because [email protected] appeared earlier (fail-closed, not a bypass; fixed to whole-address matching). The open question: how to handle false positives, and whether clients support elicitation — without it every ask becomes a deny. A candid, instructive look at agent-security tradeoffs.
More from coding & agent
- Dev finds pi coding tool defaults to Opus 4.8 on a fresh install — lucasmeijer · 2026-11-05
- Kylon puts whole teams and agents in shared rooms, with a Neon branch per app draft — jefrankle · 2026-11-05
- "Evals > vibes": agent workflow debates are just guessing without eval stats — annetgriffin · 2026-11-05
- OpenAI hackathon winner joins YC, launches Raven, an agent-first phone — ycombinator · 2026-11-05
- Open-source Cicada brings real-time translation and AI meeting notes to any Mac call, free 50h/month — dotey · 2026-11-05
- IBM launches AI coding assistant named "Bob", devs can't stop laughing — zeeg · 2026-11-05