Bouncer Gates MCP server

bouncer-gates

Five checks that stop the expensive mistakes before they merge, whether a person or an agent wrote the code.

Hardcoded secrets. Database queries that leak one customer's data to another. Float maths on money. Migrations that break the running app. Docs that link to files which no longer exist.

Agents write most new code now, and they make exactly these mistakes: a key pasted in to make a test pass, a query with no tenant filter because the prompt never mentioned tenants. bouncer-gates runs inside Claude Code and Cursor, so the agent hears about it in the same turn it wrote it, and again in CI so nothing gets through.

Try it on any repository in ten seconds:

npx bouncer-gates

Or paste some code into the playground and watch the same checks run on it.

Quick start

npx bouncer-gates --init          # writes bouncer-gates.config.json, reads your Prisma schema if you have one
npx bouncer-gates --init-agents   # wires the same checks into Claude Code and Cursor for this repo
npx bouncer-gates                 # runs every check and prints what it found

Add it to GitHub Actions:

steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: 0             # needed so the migration check can see what is new
  - uses: ajeermahmood/bouncer-gates@v0
    with:
      version: "0.5.0"

That is the whole setup. Everything below is detail.

In the editor, with the agent

--init-agents commits two things into the repository: an MCP server the agent can call, and a hook that scans every file the agent writes. When a file has a blocking finding, the agent sees the file, the line, what is wrong and what to do instead, in the same turn:

x src/orders.ts:12  scope/unscoped-query
  "order" is tenant-owned, but nothing in this query mentions "tenantId", so it returns rows from every tenant.
  fix: Add tenantId to the where clause, or go through a tenant-scoped client.

Any other MCP client can run npx -y bouncer-gates --mcp, and any post-edit hook can pipe its event to npx -y bouncer-gates --hook. How it works, and what it will not do.

What it checks

Each check exists because of a real, expensive bug. None is a style opinion. The gate reference explains every rule with a bad example and a fixed one.

When it finds something

Every finding names the file, the line, what is wrong and what to do instead:

FAIL  scope

    x src/orders.ts:2  scope/unscoped-query
      "order" is tenant-owned, but nothing in this query mentions "tenantId", so it returns rows from every tenant.
      fix: Add tenantId to the where clause, or go through a tenant-scoped client.

You have three options, in this order:

Shortened. The full README is on GitHub.