Bouncer

What the bouncer MCP server does

The bouncer MCP server evaluates application code against JSON rule packs representing selected regulatory requirements. Built-in packs cover the UK Online Safety Act, the ICO Children's Code, and Nigerian requirements from NDPC, FCCPC, and FIRS. Each rule connects a regulatory standard to a static assertion over a code surface, such as sign-up, profile, chat, livestream, user-generated content, or governance files.

The checks distinguish three outcomes. pass means matching evidence was found and includes a file and line reference. fail means the relevant surface exists but the expected control was not detected. unknown means the surface could not be located, so the result is not treated as a pass. This makes the output useful for identifying both missing controls and areas the scanner cannot determine.

The tool is an engineering aid, not legal advice. A passing result only indicates that the configured static checks found the expected code patterns; it does not replace compliance or DPO review.

How it works

The scanner loads a configuration file, selects adapters and rule packs, maps named surfaces to files, and evaluates regular-expression assertions. Rules can require a pattern, prohibit one, or combine checks with allOf, anyOf, and not. Custom packs can be supplied as JSON files, while individual rule IDs can be excluded when an obligation is procedural rather than provable through source code.

The bouncer MCP server uses the same deterministic engine as the command-line interface. Its stdio process can be launched with npx @nugehs/bouncer mcp, allowing an MCP client to request checks and supporting information from the configured repository.

Setup and configuration

Node.js 18 or newer is required. Install or run the package with npx, initialize a starter configuration, and then configure the target repository, adapter, roots, packs, optional custom pack directories, ignored rules, and statuses that should make a check fail.

The shipped adapters are next for Next.js App Router projects and react-native. Other frameworks require a custom adapter that maps surface aliases to file globs. The default configuration can run the UK packs, and the built-in Nigerian packs can be selected explicitly.

A typical MCP client configuration starts the server as a stdio command:

{
  "mcpServers": {
    "bouncer": {
      "command": "npx",
      "args": ["-y", "@nugehs/bouncer", "mcp"]
    }
  }
}

Tools and capabilities

The MCP tools are:

• compliance_check: runs configured packs and returns verdicts with evidence.
• list_rules: shows the rules applied by the configured packs.
• explain_rule: returns a rule's standard, intent, fix, and checking method.
• list_packs: lists the available rule packs.

The CLI also supports reports, filtered status output, pack inspection, configuration diagnostics, and rule explanations. A CI command exits non-zero when a configured failure bucket is found, which allows a build to gate changes that remove a required control.

Limitations and notes

Static checks cannot prove process obligations such as registration, signed data-processing agreements, or actual tax remittance. These may be tracked as gaps instead. Results depend on the selected adapter, repository roots, rule patterns, and configured surfaces. If a surface is absent or cannot be located, the result is unknown rather than a passing result. The project has no runtime dependencies and uses Node's built-in test runner for its tests.