Show HN: Bouncer, an MCP proxy that denies sends to addresses the agent read

Nishit9 — Tue, 27 Oct 2026 14:00:52 +0000

Article URL: https://github.com/Ezed9/mcp-bouncer

Comments URL: https://news.ycombinator.com/item?id=50259501

Points: 2

# Comments: 0

New comment by Nishit9 in "Launch HN: Alter (YC S25) – Access control for multi-user agents"

Nishit9 — Sat, 24 Oct 2026 07:46:22 +0000

Question on the cross-user case, which I don’t think the memory partitioning answer upthread fully covers. Say the agent pulls a deal record under the CEO’s grant and writes a summary into a shared Slack channel. Later a contractor’s session reads that channel and emails the summary somewhere. Every call passes on its own, since the contractor is allowed to send email. Does the policy engine know anything about where an argument came from, like which grant originally fetched it, or only who’s calling and which endpoint? I ask because I’ve been building something that tracks where send destinations first showed up, and it’s noisy. In my testing it also denied sends where the user typed the address themselves, because the same address was in tool output.

Hacker News: Nishit9

Show HN: Bouncer, an MCP proxy that denies sends to addresses the agent read

New comment by Nishit9 in "Launch HN: Alter (YC S25) – Access control for multi-user agents"