security check
Your agent installs AI skills, MCP servers and npm packages on a single chat message. Paste what you're about to install and see exactly what it does before it ever runs on your machine.
Paste the install command you were about to run. We read the published files as text — we never run them.
try:
Automated risk assessment. Not a guarantee of safety.
What we look at #
One careless install can hand a stranger your SSH keys, cloud credentials and every file on disk — or plant hidden instructions your agent will follow without ever showing you. A check takes seconds.
npm package security check
- Install scripts that fetch or run code on your machine
- Code that touches SSH keys, cloud credentials, tokens or wallets
- Where it sends data, and whether those places are known
- Release age, provenance, maintainer changes and known advisories
MCP security scanner
- Every tool it offers, and what each one claims to do
- Hidden instructions and invisible characters in tool descriptions
- Tools that steer your agent towards other tools or secrets
- A fingerprint of the tool list, so you are told when it changes
Recent checks, with real findings #
Every report below came from a live package or server — read the findings before you install.
…
source & further reading
bouncer.run — original article