Node9-Proxy

What did your AI agent actually do? Find out.

Node9 sits between your AI agent and the tools it can use —discoverwhat it's already been doing,protectagainst risky actions in real time, andreviewwhat happened over any time window.

Works withClaude Code · Codex CLI · Antigravity (agy) · GitHub Copilot CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server.

- 🔍Discover— scan every past AI session for credential leaks, agent loops, blocked operations, and every secret on disk an agent could reach right now
- 🛡Protect— review or block risky commands before they run —rm -rf,git push --force,DROP TABLE, credential reads,curl | bash, AWS/GitHub/Stripe key leaks
- 📊Review— period-windowed report (today / week / month / 90 days) — cost per agent, top tools, shields fired, blast radius

This is my own machine — 90 days while building Node9. Score 25/100, 5 credential files an AI agent could reach right now.

npx node9-ai scan # before installation, runs in ~10s, nothing uploads node9 scan # after installation, same output

node9 posturegrades how exposed this machine is to a compromised agent — isolation, egress, secrets on disk, supply chain, privilege — and hands you the exact command to fix each finding.

node9 posture # scorecard with the #1 risk and a fix for every finding node9 posture --ship # send a redacted snapshot to your node9 dashboard (fleet view)

Findings are grouped bywho can fix them: 🔒 the ones node9 reduces (just run the command) and 🧱 the ones only you can. Each carries a plain-language what / why / who and a real remediation — e.g. the "agent runs unsandboxed on the host" finding points straight atnode9 sandbox run(below).

🛡️ Node9 Posture — agent on this host Score: 100/100 (Good) 2 advisories below don't affect the score — OS-level exposure, yours to weigh. 🟢 node9 is already protecting you ✅ Secrets node9 DLP is blocking this ✅ Egress node9 egress is approval-gating this ✅ Approval gate node9 is blocking this ✅ Privilege node9 is approval-gating this 🔒 node9 reduces these — run the command, the rest is yours ⚠️ Isolation Running directly on the host — no container The agent runs loose on your whole machine, not in a sandbox. → node9 sandbox run <agent> — jail it: kernel egress + scoped mounts + node9 inside → node9 shield enable project-jail — or shrink the blast radius, keep host access ⚠️ Network exposure 4 services on 0.0.0.0 (node :3000/:4000, PostgreSQL :5432, Redis :6379) Reachable from your whole network, not just this laptop. → node9 shield enable postgres|redis — node9 blocks DROP TABLE / FLUSHALL → bind to 127.0.0.1 / firewall the port (your part) ✅ Supply chain no issues found ✅ Coverage no issues found Track this across your fleet & keep it green → node9.ai

node9 scan-repochecks any repo (or a local folder) for ways an AI agent wired into GitHub Actions could behijacked by an outsider— injectable workflows, agent-reachable secrets, unpinned MCP servers, over-broad agent config, and poisoned instruction files. Static and parse-only: it reads only committed config, never executes repo code. No install or token needed for public repos.

npx node9-ai scan-repo <owner/repo> # any public repo, no install node9 scan-repo . # a local checkout — no network node9 scan-repo <owner/repo> --json # machine-readable

🛡️ node9 scan-repo · node9-ai/agent-security-demo · ⚠️ agent-security risk found inspected 2 config file(s), 2 finding(s) 🔴 CRITICAL Injectable agent workflow — untrusted input reaches a tool-using agent with secrets .github/workflows/vulnerable-example.yml · CI-2 • runs with base-repo secrets (pull_request_target) • checks out the untrusted PR head into the workspace root • allowed_non_write_users: "" — any user can trigger the agent • no effective actor gate 🔴 CRITICAL Exfiltratable secrets reachable by an injectable agent .github/workflows/vulnerable-example.yml · CI-4 • agent has arbitrary shell (bare Bash) → can read env and exfiltrate

# .github/workflows/agent-security.yml - uses: node9-ai/agent-security-action@v1 with: fail-on: high # or 'never' to just comment

node9 monitor # press [2] for Report view node9 report --period 7d # CLI form, no TUI

# macOS / Linux brew tap node9-ai/node9 && brew install node9 # or via npm (any platform) npm install -g node9-ai

node9 init # auto-wires all detected agents + MCP servers node9 doctor # verify everything is wired correctly

node9 shield list # show all shields + status

- Git— catchesgit push --force,git reset --hard,git clean -fd
- SQL— catchesDELETE/UPDATEwithoutWHERE,DROP TABLE,TRUNCATE
- Shell— catchescurl | bash, unauthorizedsudo
- DLP— flags AWS keys, GitHub tokens, Stripe keys, PEM private keys in any tool argument, file contents, or shell config (~/.zshrc,~/.bashrc)
- Response DLP— background scanner reads Claude's conversation history and alerts you if Claudewrotea secret in its response text
- Auto-undo— git snapshot before every AI file edit →node9 undoto revert
- Skills pinning— SHA-256 verification of installed Claude skills / plugins between sessions

When node9 flags an action forreview(e.g.git push --force, aDROP TABLE), the approve/deny prompt rendersinline in the agent conversation— no frozen session, no separate terminal, no hook-timeout race. node9 still runs the full evaluator and makes the decision; only the promptsurfacemoves to the agent.

{ "settings": { "reviewChannel": "ask", // "ask" = inline agent prompt (default) | "approver" = node9's own approver }, }

When watching isn't enough,node9 sandboxruns the agent inside a disposable container with akernel-enforced egress allowlistandscoped mounts— while node9's hooks govern and audit every tool callinsidethe box. The hard version of protection: the agent can only touch the folder you mount and reach the hosts you allow; everything else is dropped at the kernel.

cd ~/my-project node9 sandbox new # write node9.sandbox.yaml — what to mount + which hosts to allow node9 sandbox run # build + boot the jailed agent (your project at /workspace) node9 sandbox tail # watch the agent's actions live, from the host

Honest scope (Phase 1): single container,Claude first(Codex next); the agent still holds itsowncredentials in the box (the egress wall confines them to the allowed hosts) —"the agent never holds a secret"is the credential-broker phase on the roadmap. Requires Docker.

{ "mcpServers": { "postgres": { "command": "node9", "args": ["mcp", "--upstream", "npx -y @modelcontextprotocol/server-postgres postgresql://..."] } } }

node9 mcp pin list # show all pinned servers and hashes node9 mcp pin update <serverKey> # remove pin, re-pin on next connection node9 mcp pin reset # clear all pins

🛡 node9 | standard | [bash-safe] | ✅ 12 allowed 🛑 2 blocked 🚨 0 dlp | ~$0.43 📊 claude-opus-4-7 | ctx [████████░░░] 54% | 5h [██░░░░░░░░] 12% | 7d [█░░░░░░░] 7% 🗂 2 CLAUDE.md | 8 rules | 3 MCPs | 4 hooks

from node9 import configure, protect configure(agent_name="my-agent", policy="require_approval") @protect("bash") def run_command(cmd: str) -> str: ...

- Scanreads raw agent history from~/.claude/projects/,~/.gemini/tmp/,~/.gemini/antigravity-/brain/,~/.copilot/session-state/,~/.codex/sessions/— no API calls, fully offline
- Runtimeintercepts tool calls via pre-execution hooks (Claude Code, Codex, Antigravity, GitHub Copilot CLI, Gemini CLI, Opencode, Pi) or via the MCP gateway (Cursor, Windsurf, VSCode, Claude Desktop). All decisions land in~/.node9/audit.logatomically.
- MCP gatewayis a stdio proxy; interceptstools/list+tools/callJSON-RPC, forwards the rest
- Policy engineusesmvdan-shfor bash AST analysis — defeats obfuscation via backslash escaping, variable substitution, eval of remote download
- Shadow repofor auto-undo lives at~/.node9/snapshots/<hash16>/— never touches your.git
- Sandboxgenerates a Dockerfile + entrypoint that seal anipset/iptablesdeny-by-default egress wall, then drop to a non-root agent with node9's daemon + hooks running inside; only the agent's credential file is mounted, never your whole~/.claude

Config reference, smart rules, stateful rules, trusted hosts, approval modes, CLI reference — atnode9.ai/docs.

- node9-python— Python SDK
- node9-pr-agent— GitHub Action that reviews PRs through Node9

Node9 Proadds governance locking, SAML/SSO, central audit export, and VPC deployment. Seenode9.ai.

Check any MCP server's identity, risk grade and tool classifications before installing it.