@node9/proxy 1.11.12 โ 1.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +142 -244
- package/dist/cli.js +775 -642
- package/dist/cli.mjs +762 -629
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,62 +1,69 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
[](https://www.npmjs.com/package/node9-ai)
|
|
6
|
-
[](https://opensource.org/licenses/Apache-2.0)
|
|
7
|
-
[](https://huggingface.co/spaces/Node9ai/node9-security-demo)
|
|
8
|
-
[](https://node9.ai/docs)
|
|
9
|
-
|
|
10
|
-
**Node9** sits between your AI agent and your system. Every shell command, file write, and tool call passes through Node9 first โ blocked, approved, or logged based on your policy. Works with Claude Code, Gemini CLI, Cursor, Codex, and any MCP server.
|
|
11
|
-
|
|
12
|
-
๐ **[Full Documentation โ](https://node9.ai/docs)**
|
|
13
|
-
|
|
14
|
-
---
|
|
1
|
+
<p align="center">
|
|
2
|
+
<img src="https://github.com/user-attachments/assets/4aa6e45b-9aba-4953-9ce3-548226622588" width="720" alt="Node9 intercepts a dangerous git push" />
|
|
3
|
+
</p>
|
|
15
4
|
|
|
16
|
-
|
|
5
|
+
<h1 align="center">๐ก๏ธ Node9</h1>
|
|
17
6
|
|
|
18
|
-
|
|
7
|
+
<p align="center"><strong>Every command your AI agent runs, reviewed before it runs.</strong></p>
|
|
19
8
|
|
|
20
9
|
<p align="center">
|
|
21
|
-
<
|
|
10
|
+
<a href="https://www.npmjs.com/package/node9-ai"><img src="https://img.shields.io/npm/v/node9-ai.svg" alt="npm version" /></a>
|
|
11
|
+
<a href="https://www.npmjs.com/package/node9-ai"><img src="https://img.shields.io/npm/dm/node9-ai.svg" alt="monthly downloads" /></a>
|
|
12
|
+
<a href="https://opensource.org/licenses/Apache-2.0"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License: Apache 2.0" /></a>
|
|
13
|
+
<a href="https://node9.ai/docs"><img src="https://img.shields.io/badge/docs-node9.ai-blue" alt="Documentation" /></a>
|
|
14
|
+
<a href="https://huggingface.co/spaces/Node9ai/node9-security-demo"><img src="https://huggingface.co/datasets/huggingface/badges/resolve/main/open-in-hf-spaces-sm.svg" alt="Try on HF Spaces" /></a>
|
|
22
15
|
</p>
|
|
23
16
|
|
|
24
|
-
|
|
17
|
+
Node9 sits between your AI agent and your system. Every shell command, file write, database query, and MCP tool call passes through Node9 first โ blocked, reviewed, or logged based on your policy. Works with **Claude Code**, **Gemini CLI**, **Cursor**, **Codex**, and any **MCP server**.
|
|
25
18
|
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
19
|
+
- ๐ **Block** dangerous actions (`git push --force`, `rm -rf /`, `curl|bash`, `DROP TABLE`, ...) before they run
|
|
20
|
+
- ๐ **Review** anything worth a human glance โ OS-native popup, Slack, or browser approval
|
|
21
|
+
- ๐ **Catch credential leaks** in tool arguments and Claude response text
|
|
22
|
+
- ๐ **Stop agent loops** that burn tokens and money
|
|
23
|
+
- ๐ **Gate MCP tools** and detect rug-pull attacks on server definitions
|
|
24
|
+
- ๐ **Dashboard + scan report** in your browser โ see what your agents actually did
|
|
30
25
|
|
|
31
26
|
---
|
|
32
27
|
|
|
33
|
-
## Try it
|
|
34
|
-
|
|
35
|
-
See what node9 would have caught in your existing Claude Code, Gemini CLI, and Codex history:
|
|
28
|
+
## Try it in 10 seconds โ no install
|
|
36
29
|
|
|
37
30
|
```bash
|
|
38
31
|
npx node9-ai scan
|
|
39
32
|
```
|
|
40
33
|
|
|
41
|
-
|
|
34
|
+
Reads your existing Claude / Gemini / Codex session history, runs the full Node9 policy engine, and shows every operation that would have been blocked or flagged.
|
|
42
35
|
|
|
43
36
|
```
|
|
44
37
|
๐ Scanning your AI history โ what would node9 have caught?
|
|
45
38
|
|
|
46
|
-
|
|
39
|
+
15 sessions (8 Claude ยท 6 Gemini ยท 1 Codex) 5,470 tool calls
|
|
40
|
+
2,439 bash commands last 90 days Apr 6, 2026 โ Apr 23, 2026
|
|
47
41
|
|
|
48
|
-
|
|
49
|
-
๐ Would have flagged 44 sent to you for approval
|
|
50
|
-
๐ Credential leak 1 secret detected in tool call
|
|
42
|
+
Found 168 risky operations in your history
|
|
51
43
|
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
44
|
+
๐ Would have blocked 3 operations stopped before execution
|
|
45
|
+
๐ Would have flagged 162 sent to you for approval
|
|
46
|
+
๐ Credential leak 3 secret detected in tool call
|
|
47
|
+
๐ Loop detected 117 repeated tool call patterns found
|
|
56
48
|
|
|
57
|
-
|
|
49
|
+
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
|
|
50
|
+
Your Rules ยท added in node9.config.json 2 blocked ยท 157 review
|
|
51
|
+
๐ block-force-push ร2 โ Force push overwrites remote history
|
|
52
|
+
๐ review-git-push ร154 โ git push sends changes to a shared remote
|
|
53
|
+
|
|
54
|
+
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
|
|
55
|
+
bash-safe ยท high-risk bash patterns 1 blocked ยท 1 review
|
|
56
|
+
๐ block-eval-remote โ eval of remote download (supply-chain attack)
|
|
57
|
+
|
|
58
|
+
๐ View in browser: http://127.0.0.1:7391/
|
|
58
59
|
```
|
|
59
60
|
|
|
61
|
+
The last line opens a live dashboard in your browser with collapsible drill-downs, per-agent breakdown, and credential-leak samples:
|
|
62
|
+
|
|
63
|
+
<p align="center">
|
|
64
|
+
<img src="https://github.com/user-attachments/assets/825f99d8-b487-4746-9cef-a02a9ca76c1f" width="90%" alt="Node9 browser History Audit dashboard" />
|
|
65
|
+
</p>
|
|
66
|
+
|
|
60
67
|
---
|
|
61
68
|
|
|
62
69
|
## Install
|
|
@@ -65,40 +72,57 @@ No account, no daemon, no config. Reads `~/.claude/projects/`, `~/.gemini/tmp/`,
|
|
|
65
72
|
# macOS / Linux
|
|
66
73
|
brew tap node9-ai/node9 && brew install node9
|
|
67
74
|
|
|
68
|
-
# or via npm
|
|
75
|
+
# or via npm (any platform)
|
|
69
76
|
npm install -g node9-ai
|
|
70
77
|
```
|
|
71
78
|
|
|
72
79
|
```bash
|
|
73
|
-
node9 init # auto-
|
|
80
|
+
node9 init # auto-wires Claude Code, Gemini CLI, Cursor, Codex, MCP servers
|
|
74
81
|
node9 doctor # verify everything is wired correctly
|
|
75
82
|
```
|
|
76
83
|
|
|
84
|
+
That's it โ future agent sessions are protected.
|
|
85
|
+
|
|
77
86
|
---
|
|
78
87
|
|
|
79
|
-
## Shields โ one command
|
|
88
|
+
## Shields โ expert policy in one command
|
|
89
|
+
|
|
90
|
+
Each shield is a curated rule set for a service or domain. Enable only what you need.
|
|
80
91
|
|
|
81
|
-
|
|
92
|
+
| Shield | What it catches | Enable |
|
|
93
|
+
| ----------------- | ----------------------------------------------------------------- | ------------------------------------- |
|
|
94
|
+
| `bash-safe` | `curl \| bash`, `rm -rf /`, disk overwrite, `eval` of remote | `node9 shield enable bash-safe` |
|
|
95
|
+
| `postgres` | `DROP TABLE`, `TRUNCATE`, `DROP COLUMN`, `DELETE` without `WHERE` | `node9 shield enable postgres` |
|
|
96
|
+
| `mongodb` | `dropDatabase`, `drop()`, `deleteMany({})`, index drops | `node9 shield enable mongodb` |
|
|
97
|
+
| `redis` | `FLUSHALL`, `FLUSHDB`, `CONFIG SET` on a live server | `node9 shield enable redis` |
|
|
98
|
+
| `aws` | S3 delete, EC2 terminate, IAM changes, RDS destroy | `node9 shield enable aws` |
|
|
99
|
+
| `k8s` | namespace delete, `helm uninstall`, cluster role wipes | `node9 shield enable k8s` |
|
|
100
|
+
| `docker` | `system prune`, `volume prune`, `rm -f` containers | `node9 shield enable docker` |
|
|
101
|
+
| `github` | `gh repo delete`, remote branch deletion, settings changes | `node9 shield enable github` |
|
|
102
|
+
| `filesystem` | `chmod 777`, writes under `/etc/`, `/boot/`, `/usr/` | `node9 shield enable filesystem` |
|
|
103
|
+
| `mcp-tool-gating` | unapproved MCP tools silently activating new capabilities | `node9 shield enable mcp-tool-gating` |
|
|
82
104
|
|
|
83
105
|
```bash
|
|
84
|
-
node9 shield
|
|
85
|
-
node9 shield enable mongodb # blocks dropDatabase, drop(), deleteMany({})
|
|
86
|
-
node9 shield enable redis # blocks FLUSHALL, FLUSHDB
|
|
87
|
-
node9 shield enable aws # blocks S3 delete, EC2 terminate, IAM changes
|
|
88
|
-
node9 shield enable k8s # blocks namespace delete, helm uninstall
|
|
89
|
-
node9 shield enable docker # blocks system prune, volume prune, rm -f
|
|
90
|
-
node9 shield enable github # blocks gh repo delete, remote branch deletion
|
|
91
|
-
node9 shield enable bash-safe # blocks curl|bash, base64|sh, rm -rf /
|
|
92
|
-
node9 shield enable filesystem # reviews chmod 777, writes to /etc/
|
|
93
|
-
|
|
94
|
-
node9 shield list # see all shields and their status
|
|
106
|
+
node9 shield list # show all shields + status
|
|
95
107
|
```
|
|
96
108
|
|
|
97
109
|
---
|
|
98
110
|
|
|
99
|
-
##
|
|
111
|
+
## Always on โ no config needed
|
|
100
112
|
|
|
101
|
-
|
|
113
|
+
- **Git** โ blocks `git push --force`, `git reset --hard`, `git clean -fd`
|
|
114
|
+
- **SQL** โ blocks `DELETE` / `UPDATE` without `WHERE`, `DROP TABLE`, `TRUNCATE`
|
|
115
|
+
- **Shell** โ blocks `curl | bash`, unauthorized `sudo`
|
|
116
|
+
- **DLP** โ blocks AWS keys, GitHub tokens, Stripe keys, PEM private keys in any tool argument
|
|
117
|
+
- **Response DLP** โ background scanner reads Claude's conversation history and alerts you if Claude _wrote_ a secret in its response text (not just executed one). Gemini / Codex coverage coming.
|
|
118
|
+
- **Auto-undo** โ git snapshot before every AI file edit โ `node9 undo` to revert
|
|
119
|
+
- **Skills pinning** โ SHA-256 verification of installed Claude skills / plugins between sessions
|
|
120
|
+
|
|
121
|
+
---
|
|
122
|
+
|
|
123
|
+
## MCP gateway โ protect any MCP server
|
|
124
|
+
|
|
125
|
+
Wrap any MCP server transparently. The agent sees the same server โ Node9 intercepts every tool call.
|
|
102
126
|
|
|
103
127
|
```json
|
|
104
128
|
{
|
|
@@ -111,251 +135,125 @@ Wrap any MCP server transparently. The AI sees the same server โ Node9 interce
|
|
|
111
135
|
}
|
|
112
136
|
```
|
|
113
137
|
|
|
114
|
-
Or
|
|
138
|
+
Or just run `node9 init` โ it wraps your existing MCP servers automatically.
|
|
115
139
|
|
|
116
|
-
|
|
140
|
+
<details>
|
|
141
|
+
<summary><strong>๐ MCP tool pinning โ rug-pull defense</strong></summary>
|
|
117
142
|
|
|
118
|
-
MCP servers can change their tool definitions between sessions. A compromised or malicious server could silently add, remove, or modify tools after
|
|
143
|
+
MCP servers can change their tool definitions between sessions. A compromised or malicious server could silently add, remove, or modify tools after you first trusted it โ a **rug pull** attack.
|
|
119
144
|
|
|
120
|
-
Node9
|
|
145
|
+
Node9 pins tool definitions on first use:
|
|
121
146
|
|
|
122
|
-
1. **First connection** โ
|
|
123
|
-
2. **Subsequent connections** โ
|
|
147
|
+
1. **First connection** โ gateway records a SHA-256 hash of every tool's name, description, and schema
|
|
148
|
+
2. **Subsequent connections** โ hash is compared; if tools changed, the session is **quarantined** and every tool call is blocked until a human reviews and approves the change
|
|
124
149
|
3. **Corrupt pin state** โ fails closed (blocks), never silently re-trusts
|
|
125
150
|
|
|
126
151
|
```bash
|
|
127
152
|
node9 mcp pin list # show all pinned servers and hashes
|
|
128
153
|
node9 mcp pin update <serverKey> # remove pin, re-pin on next connection
|
|
129
|
-
node9 mcp pin reset # clear all pins
|
|
154
|
+
node9 mcp pin reset # clear all pins
|
|
130
155
|
```
|
|
131
156
|
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
### Skills Pinning โ installed-plugin drift detection
|
|
135
|
-
|
|
136
|
-
Marketplace plugins at `~/.claude/plugins/marketplaces/` come from registries, not your workspace โ `git status` never sees them. Each installed plugin gets its own pin (same model as MCP server pinning): installing a new plugin creates a new pin silently; only changes to an already-pinned plugin trigger drift. Opt-in via `policy.skillPinning.enabled: true`; use `mode: 'block'` for strict enforcement. User-edited files are **not** in default scope. Extend via `policy.skillPinning.roots`.
|
|
157
|
+
Automatic, no configuration. The gateway pins on first `tools/list` and enforces on every subsequent session.
|
|
137
158
|
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
## Python SDK โ govern any Python agent
|
|
141
|
-
|
|
142
|
-
```python
|
|
143
|
-
from node9 import configure
|
|
144
|
-
|
|
145
|
-
configure(agent_name="my-agent", policy="require_approval")
|
|
146
|
-
|
|
147
|
-
# Your existing agent code runs unchanged โ Node9 intercepts tool calls
|
|
148
|
-
```
|
|
159
|
+
</details>
|
|
149
160
|
|
|
150
|
-
|
|
161
|
+
<details>
|
|
162
|
+
<summary><strong>โก Large MCP response detection</strong></summary>
|
|
151
163
|
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
## What's always on (no config needed)
|
|
164
|
+
When an MCP server returns a 500KB+ response, it sits in the context window for every subsequent LLM turn โ often silently doubling per-turn cost. Node9 warns you in real time with a toast and records the event in the dashboard so you can spot the offender.
|
|
155
165
|
|
|
156
|
-
|
|
157
|
-
- **SQL:** blocks `DELETE`/`UPDATE` without `WHERE`, `DROP TABLE`, `TRUNCATE`
|
|
158
|
-
- **Shell:** blocks `curl | bash`, `sudo` commands
|
|
159
|
-
- **DLP:** blocks AWS keys, GitHub tokens, Stripe keys, PEM private keys in any tool call argument
|
|
160
|
-
- **Response DLP:** background scanner reads Claude's JSONL history hourly and alerts you if a secret appears in Claude's _response text_ (not just tool args) โ see [`node9 dlp`](#node9-dlp--response-secret-scanner)
|
|
161
|
-
- **Auto-undo:** git snapshot before every AI file edit โ `node9 undo` to revert
|
|
162
|
-
- **Skills Pinning:** SHA-256 verification of agent skill files between sessions; quarantines on drift (AST 02 + AST 07 โ supply chain & update drift)
|
|
166
|
+
</details>
|
|
163
167
|
|
|
164
168
|
---
|
|
165
169
|
|
|
166
|
-
## Observability
|
|
170
|
+
## Observability โ five views
|
|
167
171
|
|
|
168
|
-
Every tool call
|
|
172
|
+
Every tool call is recorded โ command, arguments, decision, cost. See what your agent did, five ways:
|
|
169
173
|
|
|
170
|
-
|
|
174
|
+
| Command | What it shows | When to use |
|
|
175
|
+
| ---------------- | -------------------------------------------------------- | ----------------------------------------- |
|
|
176
|
+
| `node9 scan` | Retrospective audit of existing agent history | Before installing, or to review past risk |
|
|
177
|
+
| `node9 tail` | Live stream of every tool call | Watching an agent work in real time |
|
|
178
|
+
| `node9 report` | Per-period summary: allowed/blocked/DLP/cost + top tools | Reviewing what happened after a session |
|
|
179
|
+
| `node9 sessions` | Session history with prompt, tool trace, cost, snapshot | Reviewing a handoff or past work |
|
|
180
|
+
| `node9 dlp` | Credential-leak findings in Claude response text | Any time a DLP desktop alert fires |
|
|
171
181
|
|
|
172
|
-
|
|
182
|
+
Plus a **live HUD** in your Claude Code statusline:
|
|
173
183
|
|
|
174
184
|
```
|
|
175
|
-
๐ก node9 | standard | [bash-safe] | โ
12 allowed ๐ 2 blocked ๐จ 0 dlp | ~$0.43
|
|
176
|
-
๐ claude-opus-4-6 | ctx [
|
|
185
|
+
๐ก node9 | standard | [bash-safe] | โ
12 allowed ๐ 2 blocked ๐จ 0 dlp | ~$0.43
|
|
186
|
+
๐ claude-opus-4-6 | ctx [โโโโโโโโโโโ] 54% | 5h [โโโโโโโโโโ] 12% | 7d [โโโโโโโโ] 7%
|
|
177
187
|
๐ 2 CLAUDE.md | 8 rules | 3 MCPs | 4 hooks
|
|
178
188
|
```
|
|
179
189
|
|
|
180
|
-
**
|
|
181
|
-
|
|
182
|
-
**Line 2 โ Context & rate limits:** model name, context window usage, 5-hour and 7-day token rate-limit bars โ so you can see when an agent is burning through quota.
|
|
183
|
-
|
|
184
|
-
**Line 3 โ Environment:** how many CLAUDE.md files, rules, MCP servers, and hooks are active in the current project.
|
|
185
|
-
|
|
186
|
-
The HUD is wired automatically by `node9 init`. Full session logs land in `~/.node9/audit.log`.
|
|
187
|
-
|
|
188
|
-
### `node9 scan` โ flags
|
|
189
|
-
|
|
190
|
-
```bash
|
|
191
|
-
node9 scan # last 90 days
|
|
192
|
-
node9 scan --all # all time
|
|
193
|
-
node9 scan --drill-down # full commands + session IDs
|
|
194
|
-
```
|
|
195
|
-
|
|
196
|
-
### `node9 tail` โ live stream
|
|
197
|
-
|
|
198
|
-
Stream every tool call as it happens. Useful when you send an agent off to work and want to watch what it's doing:
|
|
199
|
-
|
|
200
|
-
```bash
|
|
201
|
-
node9 tail # stream tool calls for the active session
|
|
202
|
-
node9 tail --all # include all projects
|
|
203
|
-
```
|
|
204
|
-
|
|
205
|
-
Each line shows the tool name, a summary of its arguments, and the decision (allowed / blocked / DLP hit).
|
|
206
|
-
|
|
207
|
-
At startup, `tail` prints a one-line context summary:
|
|
208
|
-
|
|
209
|
-
```
|
|
210
|
-
ctx: 34% (68k/200k out 2k ยท claude-sonnet-4-6)
|
|
211
|
-
```
|
|
212
|
-
|
|
213
|
-
This shows how full the context window is, how many output tokens were generated, and which model is running. Color-coded: cyan < 50%, yellow 50โ79%, red โฅ 80%.
|
|
214
|
-
|
|
215
|
-
### `node9 report` โ security dashboard
|
|
216
|
-
|
|
217
|
-
Run after a session to get a summary of what was allowed, blocked, DLP hits, cost, and daily activity:
|
|
218
|
-
|
|
219
|
-
```
|
|
220
|
-
$ node9 report --period 7d
|
|
221
|
-
|
|
222
|
-
๐ก node9 Report ยท Last 7 Days Apr 8 โ Apr 14 2,255 events
|
|
223
|
-
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
|
|
224
|
-
|
|
225
|
-
โ
1,746 allowed ๐ 509 blocked ๐จ 70 DLP hits 23% block rate ๐ฐ $82.91
|
|
226
|
-
|
|
227
|
-
Top Tools Top Blocks
|
|
228
|
-
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
|
|
229
|
-
Bash โโโโโโ 1,595 timeout โโโโโโ 281
|
|
230
|
-
Read โโโโโโ 196 smart-rule-block โโโโโโ 79
|
|
231
|
-
Edit โโโโโโ 118 observe-mode-dlp-wouldโฆ โโโโโโ 69
|
|
232
|
-
drop_resource โโโโโโ 69 persistent-deny โโโโโโ 69
|
|
233
|
-
Grep โโโโโโ 35 local-decision โโโโโโ 5
|
|
234
|
-
|
|
235
|
-
Daily Activity
|
|
236
|
-
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
|
|
237
|
-
Apr 9 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ 833 216 blocked
|
|
238
|
-
Apr 10 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ 145 24 blocked
|
|
239
|
-
Apr 11 โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ 617 139 blocked
|
|
240
|
-
```
|
|
241
|
-
|
|
242
|
-
The report also includes a **Tokens** section showing a breakdown of input, output, cache-write, and cache-read tokens with a cache hit-rate percentage โ useful for spotting sessions that are burning tokens without getting cache savings.
|
|
190
|
+
And a **browser dashboard** that auto-opens after `node9 scan` โ History Audit modal with full drill-down, per-agent breakdown, loop-cost estimate, and live status strip.
|
|
243
191
|
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
If the response DLP scanner found secrets during the period, the report shows a `โ ๏ธ DLP ALERT` banner at the top and a dedicated **Response DLP** section listing each finding with the pattern name, a masked sample, and the project it came from.
|
|
192
|
+
---
|
|
247
193
|
|
|
248
|
-
|
|
194
|
+
## Reading the data โ what the numbers mean
|
|
249
195
|
|
|
250
|
-
|
|
196
|
+
Node9 surfaces the signal. Here are the patterns worth knowing:
|
|
251
197
|
|
|
252
|
-
|
|
253
|
-
|
|
198
|
+
| Signal | Likely meaning |
|
|
199
|
+
| ----------------------------------------------------------- | ---------------------------------------------------------------------------- |
|
|
200
|
+
| `Would have blocked` โฅ 5 in a week | Agent is attempting destructive ops; shields need review |
|
|
201
|
+
| Single `review-git-push` rule accounts for >50% of findings | Your own rule is firing as intended โ not a risk, just supervision |
|
|
202
|
+
| DLP finding in `user-prompt` tool | You pasted a secret into your own prompt โ rotate the key |
|
|
203
|
+
| Agent Loop ร50+ on same file | Agent stuck in edit/test/fix cycle โ check context or slow down |
|
|
204
|
+
| MCP tool pin mismatch | Server changed its tools โ review before re-trusting |
|
|
205
|
+
| Large MCP response warning | That server is inflating your context window for every subsequent turn |
|
|
206
|
+
| `Response DLP` alert | Claude wrote a secret in its response text โ not blocked, rotate immediately |
|
|
254
207
|
|
|
255
|
-
|
|
208
|
+
These are starting points, not verdicts. One-off signals are normal; persistent patterns are what you act on.
|
|
256
209
|
|
|
257
|
-
|
|
258
|
-
avg $25.56 /session 7 of 7 sessions had snapshots
|
|
210
|
+
---
|
|
259
211
|
|
|
260
|
-
|
|
261
|
-
Bash โโโโโโโโโโโโโโโโโโโโ 1165 (49%)
|
|
262
|
-
Read โโโโโโโโโโโโโโโโโโโโ 613 (26%)
|
|
263
|
-
Edit โโโโโโโโโโโโโโโโโโโโ 367 (15%)
|
|
264
|
-
Other โโโโโโโโโโโโโโโโโโโโ 203 (9%)
|
|
265
|
-
Write โโโโโโโโโโโโโโโโโโโโ 31 (1%)
|
|
212
|
+
## Python SDK โ govern any Python agent
|
|
266
213
|
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
12:47 ok, it seems you crash and we have a bugโฆ 95 tools $6.40 ๐ธ 5a4e7fab
|
|
270
|
-
```
|
|
214
|
+
```python
|
|
215
|
+
from node9 import configure, protect
|
|
271
216
|
|
|
272
|
-
|
|
217
|
+
configure(agent_name="my-agent", policy="require_approval")
|
|
273
218
|
|
|
274
|
-
|
|
275
|
-
|
|
276
|
-
|
|
277
|
-
Session 4812594b-c93f-4a26-91f0-44aa2e324918
|
|
278
|
-
Prompt can you push node9-proxy to git dev?
|
|
279
|
-
Project ~/node9
|
|
280
|
-
When Apr 9, 2026, 20:49
|
|
281
|
-
Cost ~$2.06
|
|
282
|
-
Snapshot โ taken
|
|
283
|
-
|
|
284
|
-
Tool calls (54):
|
|
285
|
-
20:49 Bash git status && git branch -a
|
|
286
|
-
20:52 Write /home/nadav/node9/node9-proxy/.git/hooks/pre-commit
|
|
287
|
-
20:56 Edit /home/nadav/node9/node9-proxy/src/cli/commands/check.ts
|
|
219
|
+
@protect("bash")
|
|
220
|
+
def run_command(cmd: str) -> str:
|
|
288
221
|
...
|
|
289
|
-
|
|
290
|
-
Files modified (3):
|
|
291
|
-
/home/nadav/node9/node9-proxy/.git/hooks/pre-commit
|
|
292
|
-
/home/nadav/node9/node9-proxy/src/cli/commands/check.ts
|
|
293
|
-
/home/nadav/node9/node9-proxy/src/cli/hud.ts
|
|
294
|
-
```
|
|
295
|
-
|
|
296
|
-
```bash
|
|
297
|
-
node9 sessions # last 7 days
|
|
298
|
-
node9 sessions --all # all time
|
|
299
|
-
node9 sessions --days 30 # last 30 days
|
|
300
|
-
node9 sessions --detail <session-id> # full tool trace (prefix match on session ID)
|
|
301
|
-
```
|
|
302
|
-
|
|
303
|
-
Currently works with Claude Code. Support for other agents coming as they expose session history.
|
|
304
|
-
|
|
305
|
-
### `node9 dlp` โ response secret scanner
|
|
306
|
-
|
|
307
|
-
Node9's tool-call DLP blocks secrets _before_ they leave your machine. But Claude can also write secrets into its **response text** โ a curl example with a real token, a config snippet with a live key โ and that text bypasses tool-call interception entirely.
|
|
308
|
-
|
|
309
|
-
The **response DLP scanner** runs as a background daemon. It reads Claude's JSONL conversation history incrementally (delta scan โ only new bytes since the last check), looks for secret patterns in assistant response text, and fires a desktop notification the moment it finds one.
|
|
310
|
-
|
|
311
|
-
```
|
|
312
|
-
โ ๏ธ node9 DLP alert
|
|
313
|
-
AWS Access Key found in Claude response text.
|
|
314
|
-
Sample: AKIA****MPLE โ run: node9 dlp
|
|
315
|
-
```
|
|
316
|
-
|
|
317
|
-
```bash
|
|
318
|
-
node9 dlp # show all open findings with pattern, sample, project, date
|
|
319
|
-
node9 dlp resolve # acknowledge all current findings (clears the banner)
|
|
320
222
|
```
|
|
321
223
|
|
|
322
|
-
|
|
224
|
+
**[Python SDK โ](https://github.com/node9-ai/node9-python)** ยท **[CI code review agent example โ](https://github.com/node9-ai/node9-pr-agent)**
|
|
323
225
|
|
|
324
|
-
|
|
325
|
-
๐ node9 dlp โ secrets found in Claude response text
|
|
326
|
-
|
|
327
|
-
โ ๏ธ 1 open finding
|
|
328
|
-
|
|
329
|
-
These secrets were included in Claude's response text โ NOT blocked.
|
|
330
|
-
Rotate each affected key immediately.
|
|
331
|
-
|
|
332
|
-
โ AWS Access Key ID Apr 14, 2026
|
|
333
|
-
Sample: AKIA****MPLE
|
|
334
|
-
Project: ~/node9
|
|
226
|
+
---
|
|
335
227
|
|
|
336
|
-
|
|
337
|
-
1. Rotate any exposed keys shown above
|
|
338
|
-
2. Run node9 dlp resolve to acknowledge
|
|
339
|
-
3. Run node9 report for full audit history
|
|
340
|
-
```
|
|
228
|
+
## Under the hood
|
|
341
229
|
|
|
342
|
-
|
|
230
|
+
- **Scan** reads raw agent history from `~/.claude/projects/`, `~/.gemini/tmp/`, `~/.codex/sessions/` โ no API calls, fully offline
|
|
231
|
+
- **Runtime** wires PreToolUse hooks into Claude Code, Gemini CLI, and Codex โ hooks write to `~/.node9/audit.log` atomically
|
|
232
|
+
- **MCP gateway** is a stdio proxy; intercepts `tools/list` + `tools/call` JSON-RPC, forwards the rest
|
|
233
|
+
- **Policy engine** uses [mvdan-sh](https://github.com/mvdan/sh) for bash AST analysis โ defeats obfuscation via backslash escaping, variable substitution, eval of remote download
|
|
234
|
+
- **Shadow repo** for auto-undo lives at `~/.node9/snapshots/<hash16>/` โ never touches your `.git`
|
|
343
235
|
|
|
344
236
|
---
|
|
345
237
|
|
|
346
238
|
## ๐ Full docs
|
|
347
239
|
|
|
348
|
-
Everything else โ config reference, smart rules, stateful rules, trusted hosts, approval modes, CLI reference โ is at **[node9.ai/docs](https://node9.ai/docs)**.
|
|
240
|
+
Everything else โ config reference, smart rules, stateful rules, trusted hosts, approval modes, Slack integration, CLI reference โ is at **[node9.ai/docs](https://node9.ai/docs)**.
|
|
349
241
|
|
|
350
242
|
---
|
|
351
243
|
|
|
352
|
-
## Related
|
|
244
|
+
## Related projects
|
|
353
245
|
|
|
354
|
-
- [node9-python](https://github.com/node9-ai/node9-python) โ Python SDK
|
|
355
|
-
- [
|
|
246
|
+
- **[node9-python](https://github.com/node9-ai/node9-python)** โ Python SDK for governed agents
|
|
247
|
+
- **[node9-pr-agent](https://github.com/node9-ai/node9-pr-agent)** โ GitHub Action that reviews PRs through Node9 (reference implementation of a governed agent)
|
|
356
248
|
|
|
357
249
|
---
|
|
358
250
|
|
|
359
251
|
## Enterprise
|
|
360
252
|
|
|
361
|
-
Node9 Pro
|
|
253
|
+
**Node9 Pro** adds governance locking, SAML/SSO, central audit export, and VPC deployment. See [node9.ai](https://node9.ai).
|
|
254
|
+
|
|
255
|
+
---
|
|
256
|
+
|
|
257
|
+
<p align="center">
|
|
258
|
+
<sub>Built with โ and healthy paranoia.</sub>
|
|
259
|
+
</p>
|