v0.1.4

Changed

• The review pack heading "What Bouncer guarantees and does not guarantee" is now
  "What Bouncer enforces and what it does not", and "Not guaranteed" is "Not
  enforced". The review pack, docs/how-it-works.md and SECURITY.md now say
  that only tool names are pinned at startup, not schemas; a changed schema for
  an existing tool was never detected.
• The standalone server's bouncer_get_active_policies description lists the
  packs that exist (filesystem, gmail, slack, github, gdrive).

Documentation

• README: the share of Bouncer cases where the agent tried to email the attacker
  is now counted (107 of 163). The unverified "88/164 vs 99/163, p = 0.09"
  figure is removed.
• README: the demo caption now says what the demo shows (email and SSH write
  denied, first delete runs, second stopped by the budget). The deepseek control
  line now reads 1 attack in 15, and 0 in 8 in the probe, each linked to its
  results file.
• SECURITY.md scope now includes the bouncer-mcp proxy.
• docs/how-it-works.md no longer lists LobeHub as a supported client; it was
  never tested.

Install: pip install bouncer-mcp==0.1.4

v0.1.3

Security

In 0.1.0 to 0.1.2, proxy mode (bouncer run) added Bouncer's own bouncer_* management tools, prompts and resources to every wrapped server and answered them before the policy engine ran. A prompt-injected agent could call them. bouncer_check_verdict wrote entries into the audit log, and bouncer_audit_summary returned logged arguments from every wrapped server.

0.1.3 removes them from proxy mode. The proxy now exposes only the wrapped server's own tools, and a call to any other name goes through the engine like an unknown tool. bouncer serve, the standalone server, is unchanged. A new test starts the real proxy over stdio and checks this. If you run 0.1.x, please upgrade.

Added

• bouncer report writes a Markdown security review pack from a policy, the server's tool list and the audit log.
• Audit log lines carry a UTC ts timestamp.
• examples/demo/: an end-to-end demo of a hijacked agent against a mock helpdesk MCP server behind the real proxy. No API keys needed: uv run python examples/demo/run_demo.py.
• An AgentDojo benchmark driver for all 40 workspace user tasks, with a benign pass without Bouncer, a cost cap, resumable per-case logs, confidence intervals and generated charts (benchmark/run_final.sh).

Benchmark result (with its limits)

AgentDojo workspace v1.2.2, gpt-4o-mini as the agent, 164 attack cases: the attacker's goal was reached in 48 cases without Bouncer and 0 of 163 with it. Bouncer allowed no send at all in that run, so the 0 follows by construction, and the six tasks that send email or share files went from 4/6 to 0/6 completed. One model, one fixed non-adaptive attack. Details, charts and raw rows: benchmark/RESULTS-final.md.

Full changelog: CHANGELOG.md