node9-ai 2.17.0 → 2.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +76 -331
  2. package/package.json +2 -2
package/README.md CHANGED
@@ -11,6 +11,53 @@
11
11
  <a href="https://github.com/node9-ai/node9-proxy/blob/main/.github/workflows/agent-security.yml"><img src="https://img.shields.io/badge/node9-self--scanned-a855f7?style=flat&labelColor=%231A1A2E&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNCAxNCI+PHBhdGggZmlsbD0iI0Y1RTlGRiIgZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik03IDAuNCAxLjYgMi41djQuMmMwIDMuMSAyLjMgNS42IDUuNCA2LjkgMy4xLTEuMyA1LjQtMy44IDUuNC02LjlWMi41TDcgMC40Wm0wIDEuNSAzLjkgMS41djMuM2MwIDIuMy0xLjYgNC4yLTMuOSA1LjMtMi4zLTEuMS0zLjktMy0zLjktNS4zVjMuNEw3IDEuOVptMCAyLjJhMS45IDEuOSAwIDAgMC0xIDMuNXYxLjZoMlY3LjZhMS45IDEuOSAwIDAgMC0xLTMuNVoiLz48L3N2Zz4K" alt="node9 self-scanned" /></a>
12
12
  </p>
13
13
 
14
+ **Credential jail** · **secrets and PII** · **destructive git, SQL and shell held for review** ·
15
+ **MCP tool pinning** · **network egress allowlist** · **loop breaker** · **one record across twelve agents**
16
+
17
+ Works with **Claude Code · Codex CLI · Antigravity (agy) · GitHub Copilot CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server**.
18
+
19
+ ## What it looks like
20
+
21
+ Your agent on the left, node9 on the right. Every tool call the agent makes is
22
+ checked before it runs: allowed and recorded, held for your approval, or blocked.
23
+ The agent here was launched with `--dangerously-skip-permissions`, and node9 still
24
+ decides.
25
+
26
+ <!-- VIDEO: drag monitor-loop.mp4 into a GitHub comment to get its user-attachments
27
+ URL, then replace this block. GitHub plays mp4 from that host; npm will not
28
+ render it, which is why the scan screenshot below stays. -->
29
+
30
+ <p align="center">
31
+ <img src="https://github.com/user-attachments/assets/4661da97-c174-4bae-ae54-4c52a1d69213" width="760" alt="node9 monitor: live tool calls, decisions, shields and score" />
32
+ </p>
33
+
34
+ ## Install
35
+
36
+ ```bash
37
+ brew tap node9-ai/node9 && brew install node9 # macOS / Linux
38
+ npm install -g node9-ai # any platform
39
+ ```
40
+
41
+ Then, in any project:
42
+
43
+ ```bash
44
+ node9 init # finds your agents and MCP servers and puts node9 in front of every tool call
45
+ node9 posture # scores this machine 0-100: what a compromised agent could read, reach and run
46
+ node9 login # optional: adds this machine to a shared dashboard
47
+ ```
48
+
49
+ Requires Node.js 22+.
50
+
51
+ **`init` is the whole product.** It writes the hooks, turns on the credential jail
52
+ and the always-on rules, and starts enforcing immediately. Nothing leaves the
53
+ machine and no account is needed.
54
+
55
+ **`login` adds nothing to enforcement.** It connects the machine to a workspace so
56
+ a team can see one record across everyone's laptops and CI, set policy centrally,
57
+ and approve held actions from a dashboard or Slack. Skip it and node9 works exactly
58
+ the same, alone, offline. `node9 logout` disconnects again and local enforcement
59
+ keeps running.
60
+
14
61
  ## The problem
15
62
 
16
63
  In August 2025, compromised releases of the
@@ -54,341 +101,43 @@ that file. `node9 egress protect` gates destinations as well, and it covers shel
54
101
 
55
102
  ## Verify it yourself
56
103
 
57
- ```bash
58
- npx node9-ai scan # every past agent session on this machine, ~10s, nothing uploads
59
- npx node9-ai scan-repo node9-ai/agent-security-demo # a public repo with a real, hijackable agent workflow
60
- npx node9-ai posture # this machine's exposure in 60s, nothing uploads
61
- gh attestation verify cli.js --repo node9-ai/node9-proxy # every release artifact is signed
62
- ```
63
-
64
- ---
65
-
66
- Three jobs, one tool: **discover** what your agents have already done, **protect** against risky actions in real time, and **review** what happened over any time window.
67
-
68
- Works with **Claude Code · Codex CLI · Antigravity (agy) · GitHub Copilot CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server**.
69
-
70
- ## What node9 does
71
-
72
- - 🔍 **Discover**: scan every past AI session for credential leaks, agent loops, blocked operations, and every secret on disk an agent could reach right now
73
- - 🛡 **Protect**: review or block risky commands before they run, such as `rm -rf`, `git push --force`, `DROP TABLE`, credential reads, `curl | bash`, and AWS/GitHub/Stripe key leaks
74
- - 📊 **Review**: a period-windowed report (today / week / month / 90 days) of cost per agent, top tools, shields fired, and blast radius
75
-
76
- ## Retrospective scan
77
-
78
- This is my own machine, 90 days while building node9. Score 25/100, 5 credential files an AI agent could reach right now.
104
+ Nothing below needs an account, and nothing uploads.
79
105
 
80
106
  ```bash
81
- npx node9-ai scan # before installation, runs in ~10s, nothing uploads
82
- node9 scan # after installation, same output
107
+ npx node9-ai scan # every past agent session on this machine
108
+ npx node9-ai scan-repo node9-ai/agent-security-demo # a public repo with a real, hijackable agent workflow
109
+ gh attestation verify cli.js --repo node9-ai/node9-proxy # every release artifact is signed
83
110
  ```
84
111
 
85
112
  <p align="center">
86
113
  <img src="https://github.com/user-attachments/assets/7c5b30f1-1ca1-40b4-bfd5-d6671002e98e" width="720" alt="node9 scan scorecard" />
87
114
  </p>
88
115
 
89
- ## Security posture scorecard
90
-
91
- `node9 posture` grades how exposed this machine is to a compromised agent across isolation, egress, secrets on disk, supply chain, and privilege, and hands you the exact command to fix each finding.
92
-
93
- ```bash
94
- node9 posture # scorecard with the #1 risk and a fix for every finding
95
- node9 posture --ship # send a redacted snapshot to your node9 dashboard (fleet view)
96
- ```
97
-
98
- Findings are grouped by **who can fix them**: 🔒 the ones node9 reduces (just run the command) and 🧱 the ones only you can. Each carries a plain-language what / why / who and a real remediation. For example, the "agent runs unsandboxed on the host" finding points straight at `node9 sandbox run` (below).
99
-
100
- ```text
101
- 🛡️ Node9 Posture — agent on this host Score: 100/100 (Good)
102
- 2 advisories below don't affect the score — OS-level exposure, yours to weigh.
103
-
104
- 🟢 node9 is already protecting you
105
- ✅ Secrets node9 DLP is blocking this
106
- ✅ Egress node9 egress is approval-gating this
107
- ✅ Approval gate node9 is blocking this
108
- ✅ Privilege node9 is approval-gating this
109
-
110
- 🔒 node9 reduces these — run the command, the rest is yours
111
- ⚠️ Isolation Running directly on the host — no container
112
- The agent runs loose on your whole machine, not in a sandbox.
113
- → node9 sandbox run <agent> — jail it: kernel egress + scoped mounts + node9 inside
114
- → node9 shield enable project-jail — or shrink the blast radius, keep host access
115
- ⚠️ Network exposure 4 services on 0.0.0.0 (node :3000/:4000, PostgreSQL :5432, Redis :6379)
116
- Reachable from your whole network, not just this laptop.
117
- → node9 shield enable postgres|redis — node9 blocks DROP TABLE / FLUSHALL
118
- → bind to 127.0.0.1 / firewall the port (your part)
119
-
120
- ✅ Supply chain no issues found
121
- ✅ Coverage no issues found
122
-
123
- Track this across your fleet & keep it green → node9.ai
124
- ```
125
-
126
- ## Scan a repo: agent-CI security
127
-
128
- `node9 scan-repo` checks any repo (or a local folder) for ways an AI agent wired into GitHub Actions could be **hijacked by an outsider**: injectable workflows, agent-reachable secrets, unpinned MCP servers, over-broad agent config, and poisoned instruction files. Static and parse-only: it reads only committed config, never executes repo code. No install or token needed for public repos.
129
-
130
- ```bash
131
- npx node9-ai scan-repo <owner/repo> # any public repo, no install
132
- node9 scan-repo . # a local checkout, no network
133
- node9 scan-repo <owner/repo> --json # machine-readable
134
- ```
135
-
136
- ```text
137
- 🛡️ node9 scan-repo · node9-ai/agent-security-demo · ⚠️ agent-security risk found
138
- inspected 2 config file(s), 2 finding(s)
139
-
140
- 🔴 CRITICAL Injectable agent workflow — untrusted input reaches a tool-using agent with secrets
141
- .github/workflows/vulnerable-example.yml · CI-2
142
- • runs with base-repo secrets (pull_request_target)
143
- • checks out the untrusted PR head into the workspace root
144
- • allowed_non_write_users: "*" — any user can trigger the agent
145
- • no effective actor gate
146
-
147
- 🔴 CRITICAL Exfiltratable secrets reachable by an injectable agent
148
- .github/workflows/vulnerable-example.yml · CI-4
149
- • agent has arbitrary shell (bare Bash) → can read env and exfiltrate
150
- ```
151
-
152
- What it checks:
153
-
154
- | Check | Flags |
155
- | -------- | -------------------------------------------------------------------------------- |
156
- | **CI-1** | committed agent config that pre-authorizes broad tools or runs remote hooks |
157
- | **CI-2** | injectable agent workflows: an outsider can trigger the agent and hijack it |
158
- | **CI-3** | unpinned / `@latest` MCP servers or inline credentials (supply chain) |
159
- | **CI-4** | secrets an injected agent could exfiltrate |
160
- | **CI-6** | poisoned or dangerous instructions in `CLAUDE.md` / `AGENTS.md` / `.cursorrules` |
161
-
162
- **Gate every PR.** The same engine runs as a GitHub Action, so a hijackable config can't get merged:
163
-
164
- ```yaml
165
- # .github/workflows/agent-security.yml
166
- - uses: node9-ai/node9-proxy@v2
167
- with:
168
- fail-on: high # or 'never' to just comment
169
- fail-on-scope: introduced # only what THIS PR added; 'all' (default) judges the whole repo
170
- ```
171
-
172
- `fail-on-scope: introduced` is what makes the gate adoptable on a repository that already
173
- has findings: the PR comment leads with what the change introduced, pre-existing findings
174
- stay listed but do not block, and a base commit that cannot be read falls back to judging
175
- everything rather than passing.
176
-
177
- Marketplace: **[node9 Agent Security](https://github.com/marketplace/actions/node9-agent-security)**
178
-
179
- Running it? Add the **[`scanned by node9` badge](https://node9.ai/docs/badges)** to your README.
180
-
181
- ## Live monitoring
182
-
183
- <p align="center">
184
- <img src="https://github.com/user-attachments/assets/4661da97-c174-4bae-ae54-4c52a1d69213" width="720" alt="node9 monitor dashboard" />
185
- </p>
186
-
187
- `node9 monitor` opens an interactive terminal dashboard with two views:
188
-
189
- - **`[1]` Realtime**: live activity, approvals, security alerts, current risk score
190
- - **`[2]` Report**: period-windowed summary of cost, top tools, shields fired, blast radius
191
-
192
- ## Report
193
-
194
- Press `[2]` in monitor for a period-windowed summary. Toggle the window with `[T]oday` · `[W]eek` · `[M]onth` · `[N]inety`. Same panels as the scan above, driven by your post-install audit log.
195
-
196
- <p align="center">
197
- <img src="https://github.com/user-attachments/assets/66c02a72-e477-443d-807f-d65a21d096cd" width="720" alt="node9 monitor [2] Report" />
198
- </p>
199
-
200
- ```bash
201
- node9 monitor # press [2] for Report view
202
- node9 report --period 7d # CLI form, no TUI
203
- ```
204
-
205
- ## Install
206
-
207
- ```bash
208
- # macOS / Linux
209
- brew tap node9-ai/node9 && brew install node9
210
-
211
- # or via npm (any platform)
212
- npm install -g node9-ai
213
- ```
214
-
215
- ```bash
216
- node9 init # auto-wires all detected agents + MCP servers
217
- node9 login # connect this machine to your workspace (approve it in the browser)
218
- node9 doctor # verify everything is wired and reporting
219
- ```
220
-
221
- Requires Node.js 22+.
222
-
223
- `init` on its own gives you full local enforcement: rules, shields, DLP and
224
- approvals all work offline, on this machine.
225
-
226
- `login` is what puts the machine on your dashboard. It prints a code, opens
227
- the browser, and you approve the machine there; if you don't have an account
228
- yet, signing up mid-flow returns you to the same approval with the code
229
- intact. Until you run it, everything is enforced locally but nothing reaches
230
- Mission Control, so the dashboard stays empty.
231
-
232
- `node9 logout` disconnects a machine again. It revokes that machine's key;
233
- local enforcement keeps running.
234
-
235
- ## Shields and apps
236
-
237
- A **shield** is a curated rule pack for a service an agent touches: Postgres, MongoDB, Redis,
238
- AWS, Kubernetes, Docker, GitHub, the shell, the filesystem, and the credential jail. Three of
239
- them, `project-jail`, `bash-safe` and `filesystem`, are on after `node9 init`. The rest you
240
- enable per service. Each shield mixes hard blocks with actions that come to you for review, and
241
- the docs say which is which, rule by rule.
242
-
243
- Any **MCP app** your agents use, Gmail, Slack, your database, is governed tool by tool from the
244
- Apps page in the dashboard: which tools an agent may call, which need review, which are off.
245
-
246
- ```bash
247
- node9 shield list # every shield and its status
248
- node9 shield enable postgres # or enable it fleet-wide from the dashboard
249
- ```
250
-
251
- The full list, with what each shield blocks and what it sends to review:
252
- **[node9.ai/docs/shields](https://node9.ai/docs/shields)**.
253
-
254
- ## Always on, no config needed
255
-
256
- - **Git**: catches `git push --force`, `git reset --hard`, `git clean -fd`
257
- - **SQL**: catches `DELETE` / `UPDATE` without `WHERE`, `DROP TABLE`, `TRUNCATE`
258
- - **Shell**: catches `curl | bash`, unauthorized `sudo`
259
- - **DLP**: flags AWS keys, GitHub tokens, Stripe keys, PEM private keys in any tool argument, file contents, or shell config (`~/.zshrc`, `~/.bashrc`)
260
- - **Response DLP**: a background scanner reads Claude's conversation history and alerts you if Claude _wrote_ a secret in its response text
261
- - **Skills pinning**: SHA-256 verification of installed Claude skills / plugins between sessions
262
-
263
- ## Review prompts: approve inline, in your agent
264
-
265
- When node9 flags an action for **review** (e.g. `git push --force`, a `DROP TABLE`), the approve/deny prompt renders **inline in the agent conversation**: no frozen session, no separate terminal, no hook-timeout race. node9 still runs the full evaluator and makes the decision; only the prompt _surface_ moves to the agent.
266
-
267
- - **On by default** for **Claude Code** and **GitHub Copilot CLI**, the agents whose hook contract honors a native `ask`. Every other agent (Codex, Gemini, Antigravity, Hermes, Cursor, OpenCode, Pi) uses node9's own approver.
268
- - **Control it** with `reviewChannel` in `~/.node9/config.json` (or `--no-ask` on the hook):
269
-
270
- ```jsonc
271
- {
272
- "settings": {
273
- "reviewChannel": "ask", // "ask" = inline agent prompt (default) | "approver" = node9's own approver
274
- },
275
- }
276
- ```
277
-
278
- - **Team setups:** when a cloud/team approver is configured (`approvers.cloud: true`), reviews route to that approver instead. node9 won't let an inline self-approval bypass routed/second-party approval.
279
-
280
- ## Sandbox: run an agent in a jail
281
-
282
- When watching isn't enough, **`node9 sandbox`** runs the agent inside a disposable container with a **kernel-enforced egress allowlist** and **scoped mounts**, while node9's hooks govern and audit every tool call _inside_ the box. The hard version of protection: the agent can only touch the folder you mount and reach the hosts you allow; everything else is dropped at the kernel.
283
-
284
- ```bash
285
- cd ~/my-project
286
- node9 sandbox new # write node9.sandbox.yaml: what to mount + which hosts to allow
287
- node9 sandbox run # build + boot the jailed agent (your project at /workspace)
288
- node9 sandbox tail # watch the agent's actions live, from the host
289
- ```
290
-
291
- - **Disposable**: the container is destroyed on exit; your project edits land on your real disk, nothing else survives.
292
- - **Same policy**: your existing shields / egress rules / approvals apply inside the box, streamed to the same audit log and dashboard.
293
- - **Closes the posture loop**: running it flips the Isolation / Egress findings green.
294
-
295
- Honest scope (Phase 1): single container, **Claude first** (Codex next); the agent still holds its _own_ credentials in the box (the kernel egress allowlist confines them to the allowed hosts). _"The agent never holds a secret"_ is the credential-broker phase on the roadmap. Requires Docker.
296
-
297
- ## MCP gateway
298
-
299
- Wrap any MCP server transparently. The agent sees the same server. node9 intercepts every tool call.
300
-
301
- ```json
302
- {
303
- "mcpServers": {
304
- "postgres": {
305
- "command": "node9",
306
- "args": ["mcp", "--upstream", "npx -y @modelcontextprotocol/server-postgres postgresql://..."]
307
- }
308
- }
309
- }
310
- ```
311
-
312
- Or just run `node9 init`, which wraps your existing MCP servers automatically.
313
-
314
- <details>
315
- <summary><strong>🔐 MCP tool pinning: rug-pull defense</strong></summary>
316
-
317
- MCP servers can change their tool definitions between sessions. A compromised or malicious server could silently add, remove, or modify tools after you first trusted it, a **rug pull** attack.
318
-
319
- node9 pins tool definitions on first use:
320
-
321
- 1. **First connection**: the gateway records a SHA-256 hash of every tool's name, description, and schema
322
- 2. **Subsequent connections**: the hash is compared; if tools changed, the session is **quarantined** and every tool call is blocked until a human reviews and approves the change
323
- 3. **Corrupt pin state**: fails closed (blocks), never silently re-trusts
324
-
325
- ```bash
326
- node9 mcp pin list # show all pinned servers and hashes
327
- node9 mcp pin update <serverKey> # remove pin, re-pin on next connection
328
- node9 mcp pin reset # clear all pins
329
- ```
330
-
331
- </details>
332
-
333
- ## Other commands
334
-
335
- Beyond the three flow commands above (`scan` / `monitor` / `report`):
336
-
337
- | Command | What it shows | When to use |
338
- | ---------------- | --------------------------------------------------------- | -------------------------------------- |
339
- | `node9 blast` | What an AI agent can reach right now: files, creds, env | First thing to run on any machine |
340
- | `node9 tail` | Live stream of every tool call (text-only, no TUI) | Piping into other tools, CI, logs |
341
- | `node9 sessions` | Session history with prompt, tool trace, and cost | Reviewing a handoff or past work |
342
- | `node9 dlp` | Credential-leak findings in Claude response text | Any time a DLP desktop alert fires |
343
- | `node9 mask` | Redact plaintext secrets from local session history files | After a DLP finding, cleans local disk |
344
-
345
- Plus a **live HUD** in your Claude Code statusline:
346
-
347
- ```
348
- 🛡 node9 | standard | [bash-safe] | ✅ 12 allowed 🛑 2 blocked 🚨 0 dlp | ~$0.43
349
- 📊 claude-opus-4-7 | ctx [████████░░░] 54% | 5h [██░░░░░░░░] 12% | 7d [█░░░░░░░] 7%
350
- 🗂 2 CLAUDE.md | 8 rules | 3 MCPs | 4 hooks
351
- ```
352
-
353
- ## Reading the data: what the numbers mean
354
-
355
- node9 surfaces the signal. Here are the patterns worth knowing:
356
-
357
- | Signal | Likely meaning |
358
- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------- |
359
- | `Would have blocked` ≥ 5 in a week | Agent is attempting high-impact ops; shields are worth reviewing |
360
- | Single `review-git-push` rule >50% of findings | Your own rule is firing as intended: not a risk, just supervision |
361
- | DLP finding in `user-prompt` tool | You pasted a secret into your own prompt. Rotate the key |
362
- | Agent Loop ×50+ on same file | Agent stuck in an edit/test/fix cycle. Check context or slow down |
363
- | MCP tool pin mismatch | Server changed its tools. Review before re-trusting |
364
- | Large MCP response warning | That server is inflating your context window for every subsequent turn |
365
- | `Response DLP` alert | Claude wrote a secret in its response text. Not blocked, rotate immediately |
366
- | DLP finding in `tool-result` | Claude read a file containing a secret (`.env`, credentials). Rotate the key and run `node9 mask` |
367
- | DLP finding in `[Shell]` | Plaintext secret in `~/.zshrc` or `~/.bashrc`. Every AI session can see it |
368
-
369
- One-off signals are normal; persistent patterns are what you act on.
370
-
371
- ## Python SDK: govern any Python agent
372
-
373
- ```python
374
- from node9 import configure, protect
375
-
376
- configure(agent_name="my-agent", policy="require_approval")
377
-
378
- @protect("bash")
379
- def run_command(cmd: str) -> str:
380
- ...
381
- ```
382
-
383
- **[Python SDK →](https://github.com/node9-ai/node9-python)** · **[GitHub Action →](https://github.com/marketplace/actions/node9-agent-security)**
384
-
385
- ## Under the hood
386
-
387
- - **Scan** reads raw agent history from `~/.claude/projects/`, `~/.gemini/tmp/`, `~/.gemini/antigravity-*/brain/`, `~/.copilot/session-state/`, `~/.codex/sessions/`. No API calls, fully offline
388
- - **Runtime** intercepts tool calls via pre-execution hooks (Claude Code, Codex, Antigravity, GitHub Copilot CLI, Gemini CLI, Opencode, Pi) or via the MCP gateway (Cursor, Windsurf, VSCode, Claude Desktop). All decisions land in `~/.node9/audit.log` atomically.
389
- - **MCP gateway** is a stdio proxy; intercepts `tools/list` + `tools/call` JSON-RPC, forwards the rest
390
- - **Policy engine** uses [mvdan-sh](https://github.com/mvdan/sh) for bash AST analysis, which defeats obfuscation via backslash escaping, variable substitution, eval of remote download
391
- - **Sandbox** generates a Dockerfile + entrypoint that seal an `ipset`/`iptables` deny-by-default egress allowlist, then drop to a non-root agent with node9's daemon + hooks running inside; only the agent's credential file is mounted, never your whole `~/.claude`
116
+ ## What it governs
117
+
118
+ Each line is one capability, with the page that documents it. The docs are the
119
+ reference; this file is the map.
120
+
121
+ | | | |
122
+ | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
123
+ | **Credential jail** | `~/.ssh`, `~/.aws`, `.env` and private keys are blocked from every tool, not just the shell | [docs](https://node9.ai/docs/shields) |
124
+ | **Always-on rules** | destructive git, SQL without a `WHERE`, `curl \| bash` and unauthorised `sudo`, with no config | [docs](https://node9.ai/docs/smart-rules) |
125
+ | **Secrets and PII** | AWS keys, GitHub and Stripe tokens, PEM keys and card or SSN shapes, in any tool argument, plus a background scan of what the agent wrote back | [docs](https://node9.ai/docs/dlp) |
126
+ | **Per-service shields** | curated rule packs for Postgres, MongoDB, Redis, AWS, Kubernetes, Docker, GitHub and the filesystem | [docs](https://node9.ai/docs/shields) |
127
+ | **Inline review** | a held action asks you inside the agent conversation, or through a team approver | [docs](https://node9.ai/docs/cloud-policy) |
128
+ | **Egress allowlist** | gate where a shell command may send data, off by default | [docs](https://node9.ai/docs/egress) |
129
+ | **MCP gateway** | wrap any MCP server, authorise each tool, and pin tool definitions so a server cannot change them behind your back | [docs](https://node9.ai/docs/mcp-gateway) |
130
+ | **Sandbox** | run an agent in a container with a kernel egress allowlist and scoped mounts | [docs](https://node9.ai/docs/sandbox) |
131
+ | **Posture score** | how exposed this machine is, with the command that fixes each finding | [docs](https://node9.ai/docs/posture) |
132
+ | **Repo scanning** | find workflows where an outsider could hijack an agent that holds your secrets, in CI or from the CLI | [docs](https://node9.ai/docs/repo-scanning) |
133
+ | **Session history** | read what every agent already did on this machine, before node9 was installed | [docs](https://node9.ai/docs/sessions) |
134
+ | **Live monitor and report** | a terminal dashboard, and a windowed summary of cost, tools, blocks and blast radius | [docs](https://node9.ai/docs/report) |
135
+ | **Skills pinning** | SHA-256 verification of installed Claude skills and plugins between sessions | [docs](https://node9.ai/docs/skill-pinning) |
136
+ | **Canary credentials** | planted fake keys that prove an exfiltration attempt happened | [docs](https://node9.ai/docs/canary-credentials) |
137
+ | **Python SDK** | govern any Python agent, not only the CLIs | [docs](https://node9.ai/docs/python-sdk) |
138
+
139
+ Full CLI and config reference: **[node9.ai/docs](https://node9.ai/docs)**.
140
+ How the layers fit together: **[how it works](https://node9.ai/docs/how-it-works)**.
392
141
 
393
142
  ## Learn
394
143
 
@@ -405,10 +154,6 @@ Background reading, written to stand on its own. Each page says what node9 does
405
154
  - **[node9 against the alternatives](https://node9.ai/compare)**: a matrix, including the rows where node9 scores worse
406
155
  - **[Per-agent coverage](https://node9.ai/agents)**: what is governed on each of the twelve supported agents
407
156
 
408
- ## Full docs
409
-
410
- Config reference, smart rules, stateful rules, trusted hosts, approval modes, CLI reference, at **[node9.ai/docs](https://node9.ai/docs)**.
411
-
412
157
  ## Related projects
413
158
 
414
159
  - **[node9-python](https://github.com/node9-ai/node9-python)**: Python SDK
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "node9-ai",
3
- "version": "2.17.0",
3
+ "version": "2.18.0",
4
4
  "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
5
5
  "keywords": [
6
6
  "ai-security",
@@ -44,7 +44,7 @@
44
44
  "node9-ai": "bin/node9.js"
45
45
  },
46
46
  "dependencies": {
47
- "@node9/proxy": "2.17.0"
47
+ "@node9/proxy": "2.18.0"
48
48
  },
49
49
  "type": "module",
50
50
  "engines": {