Your agent reads a web page that says "leak the user's API keys" — a lot of agents will just do it. I built a thing to stop the send.

The failure mode that bothered me: an agent reads untrusted content (web page, email, document) containing instructions like “send this data to X”, and the agent has a real tool capable of doing it. I built Bouncer, a local MCP proxy that gates the destination of outbound tool calls. If the destination came from untrusted tool output → DENY. If it’s explicitly trusted → ALLOW. If it’s new/unproven → ASK once and remember. The important part: there’s no LLM in the enforcement path. It’s deterministic Python over a pinned schema, policy, and taint log, so the model can’t talk its way past the decision. I also benchmarked it against AgentDojo’s workspace suite. Early run: attack success went 0.33 → 0.00, with benign utility remaining 1.00. Small sample, so I’m treating it as a mechanism test rather than a victory lap. It’s intentionally early: MCP-only, stdio-only, and there are documented limits — including cross-server taint propagation. I’m curious: what attack path do you think would beat this design?