securenow 8.10.0 → 8.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +142 -374
  2. package/cli/agent.js +65 -0
  3. package/cli.js +60 -43
  4. package/legacy-semconv.js +349 -0
  5. package/mcp/catalog.js +85 -0
  6. package/nextjs.js +773 -768
  7. package/nuxt-server-plugin.mjs +510 -506
  8. package/package.json +190 -186
  9. package/tracing.js +852 -844
package/README.md CHANGED
@@ -1,482 +1,250 @@
1
1
  # SecureNow
2
2
 
3
- Zero-config OpenTelemetry for Node.js, Next.js, and Nuxt: traces, logs, body capture, and IP firewall in one install. **No env vars. No copy-pasting keys.**
3
+ **Production security for AI-native development teams.**
4
4
 
5
- **Official npm package:** [securenow](http://securenow.ai/)
5
+ Your coding agent knows your code. SecureNow shows it what's happening in production. One Node.js package, CLI, and MCP server connect Claude Code, Codex, and Cursor to your live application security — attacks, routes, users, traces, IP intelligence, and response controls.
6
6
 
7
- ---
8
-
9
- ## 30-second setup
10
-
11
- ```bash
12
- # 1. Install
13
- npm install securenow
14
-
15
- # 2. Pick (or create) your app in the browser - writes .securenow/runtime.json.
16
- # The friendly login flow can also refresh admin CLI/MCP auth in .securenow/admin.json.
17
- npx securenow login
18
-
19
- # 3. Start your app - one flag is all it takes
20
- node -r securenow/register src/index.js
21
- ```
22
-
23
- That's it. No `.env` edits, no API keys to paste, no peer-dep warnings. Your traces arrive in the app you picked during login.
7
+ Your agent already sees the repository, the dependencies, the auth implementation, the API handlers, the database queries. SecureNow adds the half it can't see: live requests, routes, users and sessions, attack patterns, IP intelligence, traces and logs, security history, and block / rate-limit controls — with human approval on every mutation.
24
8
 
25
- > **package.json** example:
26
- > ```json
27
- > "scripts": {
28
- > "start": "node -r securenow/register src/index.js",
29
- > "dev": "node -r securenow/register --watch src/index.js"
30
- > }
31
- > ```
9
+ **Find it in code. Watch it in production.**
32
10
 
33
11
  ---
34
12
 
35
- ## How it works
36
-
37
- `npx securenow login` opens a browser and runs both lanes for onboarding:
38
-
39
- - admin/control-plane CLI and MCP auth goes to `.securenow/admin.json`
40
- - app/runtime SDK config and the runtime API key go to `.securenow/runtime.json`
13
+ ## What it looks like
41
14
 
42
- During app runtime onboarding, the browser flow returns a one-time plaintext
43
- `snk_live_...` key scoped to the selected app only. The CLI writes that key as
44
- `apiKey` in `.securenow/runtime.json`. Its `runtime_app` scopes are
45
- `traces:write`, `logs:write`, `firewall:read`, `blocklist:read`, and
46
- `allowlist:read`.
47
-
48
- Use `npx securenow admin login` to refresh only admin auth, or `npx securenow app connect` to refresh only runtime app config. Legacy combined `.securenow/credentials.json` files are still read for old installs.
49
-
50
- Runtime credentials look like:
51
-
52
- ```json
53
- {
54
- "apiKey": "snk_live_...",
55
- "app": {
56
- "key": "<uuid>",
57
- "name": "my-backend",
58
- "instance": "https://ingest.securenow.ai"
59
- },
60
- "config": {
61
- "runtime": { "deploymentEnvironment": "local" },
62
- "logging": { "enabled": true },
63
- "capture": { "body": true, "multipart": true, "maxBodySize": 10240 },
64
- "firewall": { "enabled": true, "failMode": "open" }
65
- }
66
- }
15
+ ```text
16
+ You: Investigate suspicious login activity from the last hour.
17
+
18
+ SecureNow (via MCP):
19
+ 1,482 failed login attempts in the last 60 minutes
20
+ · 63 source IPs
21
+ · 19 accounts targeted
22
+ · 11 IPs match known malicious infrastructure
23
+ · Pattern consistent with distributed credential stuffing
24
+
25
+ Recommended action:
26
+ · Block the 11 high-confidence sources
27
+ · Rate-limit /api/auth/login
28
+ · Review 3 accounts that authenticated successfully during the window
29
+
30
+ Agent: Apply the recommended blocks?
31
+ You: Yes.
67
32
  ```
68
33
 
69
- The SDK reads the runtime file at boot, sends traces/logs through the SecureNow ingest gateway, routes by `app.key`, and authenticates with the runtime API key. When you rotate with `npx securenow api-key create`, the CLI defaults to the current app in `.securenow/runtime.json`, resolves that app UUID to the server app id, creates a one-app `runtime_app` key, and stores the plaintext key back into runtime credentials. `npx securenow init` also fills the config block with secure defaults plus an `_securenow.explanations` section so users can see what every setting does.
34
+ Detection and investigation are automatic. Actions are proposed, a human approves, then they execute — and every action is reversible (unblock keeps the history, revocations can be restored, rate limits expire).
70
35
 
71
36
  ---
72
37
 
73
- ## Monorepo / AI-agent setup
74
-
75
- If you have many apps under one repo, authenticate once from the repo root:
76
-
77
- ```bash
78
- npx securenow login
79
- ```
38
+ ## Quick start (agent-first)
80
39
 
81
- Then ask your coding agent to wire each app with this prompt:
40
+ Paste this into Claude Code, Codex, or Cursor:
82
41
 
83
42
  ```text
84
- I already ran npx securenow login from the repo root. For every Node.js or Next.js app under this repo: install securenow@latest, run or merge npx securenow init, create or reuse a SecureNow app, write local .securenow/runtime.json plus tokenless .securenow/credentials.production.json for secret-file deployment, enable traces, logs, body capture, multipart metadata, and firewall, then verify with npx securenow env --json, npx securenow test-span, npx securenow log send, and a local HTTP smoke test where possible. Do not print secrets.
43
+ Set up SecureNow (npm package "securenow") in this project:
44
+
45
+ 1. Install it: npm install securenow@latest
46
+ 2. Run npx securenow login from the project root and wait while I complete
47
+ the browser flow. It writes .securenow/runtime.json (SDK runtime config +
48
+ runtime API key) and .securenow/admin.json (CLI/MCP auth).
49
+ 3. Wire the runtime: run npx securenow init for Next.js or Nuxt; for plain
50
+ Node servers (Express, Fastify, NestJS, Koa, Hapi) add
51
+ -r securenow/register to the start script instead.
52
+ 4. Make sure the .securenow/*.json credential files are gitignored without
53
+ ignoring the whole .securenow/ directory. Never print their contents.
54
+ 5. Verify: npx securenow whoami, npx securenow doctor,
55
+ npx securenow test-span, then npx securenow status.
56
+
57
+ Do not block traffic or modify security policy without asking me first.
85
58
  ```
86
59
 
87
- For production, deploy the tokenless runtime credentials as a secret file mounted at `<app-root>/.securenow/credentials.json`.
88
-
89
60
  ---
90
61
 
91
- ## Framework integration
92
-
93
- ### Node.js / Express / Fastify / NestJS / Koa / Hapi
94
-
95
- Just add `-r securenow/register` to your start command. No code changes. Every route, DB call, and `console.log` is captured automatically.
96
-
97
- ```bash
98
- node -r securenow/register src/app.js
99
- ```
100
-
101
- Or with `NODE_OPTIONS` if you can't change the script:
62
+ ## Manual install
102
63
 
103
64
  ```bash
104
- NODE_OPTIONS="-r securenow/register" npm start
105
- ```
65
+ # 1. Install
66
+ npm install securenow
106
67
 
107
- ### Next.js
68
+ # 2. Pick (or create) your app in the browser — writes .securenow/runtime.json
69
+ # and refreshes CLI/MCP auth in .securenow/admin.json
70
+ npx securenow login
108
71
 
109
- ```bash
110
- npx securenow init
72
+ # 3. Start your app — one flag is all it takes
73
+ node -r securenow/register src/index.js
111
74
  ```
112
75
 
113
- Creates `instrumentation.ts` and patches `next.config.*` when it can do so safely:
76
+ No `.env` edits, no API keys to paste. Runtime config lives in `.securenow/runtime.json`; it is never read from environment variables.
114
77
 
115
- ```typescript
116
- // instrumentation.ts
117
- export async function register() {
118
- if (process.env.NEXT_RUNTIME !== 'nodejs') return;
119
-
120
- const securenowNext = await import(/* webpackIgnore: true */ 'securenow/nextjs');
121
- const registerSecureNow = securenowNext.registerSecureNow || securenowNext.default?.registerSecureNow;
122
- registerSecureNow({ captureBody: true });
123
- await import(/* webpackIgnore: true */ 'securenow/nextjs-auto-capture');
78
+ ```json
79
+ "scripts": {
80
+ "start": "node -r securenow/register src/index.js",
81
+ "dev": "node -r securenow/register --watch src/index.js"
124
82
  }
125
83
  ```
126
84
 
127
- For Next.js 15+, `init` adds `securenow` to `serverExternalPackages` and includes the SDK in standalone output when it can safely edit the file:
85
+ Can't change the script? Use `NODE_OPTIONS="-r securenow/register" npm start`, or the wrapper: `npx securenow run src/index.js`.
128
86
 
129
- ```javascript
130
- const nextConfig = {
131
- serverExternalPackages: ['securenow'],
132
- outputFileTracingIncludes: {
133
- '/*': ['./node_modules/securenow/**/*'],
134
- },
135
- };
136
-
137
- export default nextConfig;
138
- ```
87
+ **Next.js** — `npx securenow init` creates `instrumentation.ts` and patches `next.config.*` when it can do so safely (adds `securenow` to `serverExternalPackages` on Next.js 15+). If your config needs human judgment, `init` prints an agent-ready prompt with the exact edits to merge.
139
88
 
140
- If a custom config or existing instrumentation file needs human judgment, `init` prints a Codex/Claude-ready prompt with the exact edits to merge.
141
-
142
- ### Nuxt 3
89
+ **Nuxt 3** — add the module, then run `npx securenow init`:
143
90
 
144
91
  ```ts
145
- // nuxt.config.ts
146
92
  export default defineNuxtConfig({
147
93
  modules: ['securenow/nuxt'],
148
94
  });
149
95
  ```
150
96
 
151
- Run `npx securenow init` after installing so the credentials file and secure defaults are created before the app starts.
152
-
153
- ---
154
-
155
- ## What's captured automatically
156
-
157
- - HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw `http`)
158
- - Database spans (Postgres, MySQL, MongoDB, Redis)
159
- - `console.log/info/warn/error/debug` forwarded as OTLP logs with trace correlation
160
- - Request body capture (JSON, GraphQL, form-encoded) with auto-redaction of `password`, `token`, `api_key`, `authorization`, `cookie`, etc.
161
- - Multipart upload metadata (field names, file names, sizes, content-types; never file content)
162
- - Firewall protection from the selected app's SecureNow blocklist and IPDB sync - activates as soon as you've logged in
163
-
164
- All of these are **on by default**. Tune them in `.securenow/runtime.json` under the `config` block.
165
-
166
- SecureNow does not export metrics by default. The preload sets `OTEL_METRICS_EXPORTER=none` when the app has not explicitly configured a metrics exporter, which prevents OpenTelemetry's default metrics reader from falling back to `localhost:4318`.
167
-
168
- ---
169
-
170
- ## Production Without Env Vars
171
-
172
- Production uses the same file structure. Deploy a tokenless runtime credentials file as a secret file and mount/copy it to:
97
+ **What's captured automatically:** HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw `http`), database spans (Postgres, MySQL, MongoDB, Redis), `console.*` as logs with trace correlation, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in `.securenow/runtime.json` under `config`.
173
98
 
174
- ```text
175
- <app-root>/.securenow/credentials.json
176
- ```
177
-
178
- Create that runtime file from a logged-in project:
99
+ **Production** — same file structure, no env vars. Generate a tokenless runtime credentials file and mount it as a deployment secret:
179
100
 
180
101
  ```bash
181
102
  npx securenow credentials runtime --env production
103
+ # store the output, mount it at <app-root>/.securenow/credentials.json
182
104
  ```
183
105
 
184
- It writes `.securenow/credentials.production.json`, with the same `app`, `apiKey`, `config`, and `_securenow.explanations` shape, but without the CLI OAuth `token`, `email`, or `expiresAt`. Store that JSON in your deployment secret manager and materialize it as `.securenow/credentials.json` at runtime.
185
-
186
- The v8 SDK also accepts generated runtime filenames directly without reading environment variables to choose the file. If `.securenow/credentials.json` is missing, it checks named files in a deterministic order: staging, production, preview, local, test, development, dev, then prod.
187
-
188
- Resolution order:
189
-
190
- 1. Project-local `.securenow/runtime.json`
191
- 2. Legacy project-local `.securenow/credentials.json`
192
- 3. Project-local named runtime credentials: `.securenow/credentials.staging.json`, then `.securenow/credentials.production.json`, then preview/local/test/development/dev/prod variants
193
- 4. Global `~/.securenow/runtime.json`
194
- 5. Legacy global `~/.securenow/credentials.json`
195
- 6. Global named runtime credentials in the same fixed order
196
- 7. `package.json#name` (label only)
197
-
198
- SDK runtime config is credentials-json based. Environment-variable fallbacks are no longer supported.
199
-
200
- ---
201
-
202
- ## CLI
106
+ **Verify** any environment with:
203
107
 
204
108
  ```bash
205
- # Setup
206
- npx securenow login # friendly flow: admin auth + app runtime connection
207
- npx securenow admin login # admin/control-plane CLI + MCP auth only
208
- npx securenow app connect # app/runtime SDK connection only
209
- npx securenow admin login --token <TOKEN> # headless admin auth (CI)
210
- npx securenow init --env local # scaffold framework files + local env scope
211
- npx securenow credentials runtime --env production # write tokenless production credentials file
212
- npx securenow api-key create --name "CLI runtime" # mint + store runtime API key
213
- npx securenow api-key set snk_live_... # store runtime API key in .securenow/runtime.json
214
-
215
- # Apps
216
- npx securenow apps # list all apps
217
- npx securenow apps create my-app # create and get the key
218
- npx securenow apps default <key> # change which app this project uses
219
-
220
- # Observability
221
- npx securenow traces # list recent traces
222
- npx securenow logs # tail logs
223
- npx securenow status # dashboard summary
224
- npx securenow doctor # diagnose config + connectivity
225
-
226
- # Detection authoring contract
227
- npx securenow telemetry schema --json
228
- npx securenow telemetry fields --app <key> --env production --since 24h --json
229
-
230
- # Security
231
- npx securenow firewall status --env production
232
- npx securenow blocklist add 1.2.3.4 --reason "scanner"
233
- npx securenow blocklist add 1.2.3.4 --route /admin* --mode prefix --method ALL --reason "admin probing"
234
- npx securenow blocklist unblock <id> --reason "reviewed safe"
235
- npx securenow fp ai-fill --description "Stripe webhook POST /api/stripe/webhook"
236
-
237
- # Telemetry from shell (no SDK boot)
238
- npx securenow log send "Deploy succeeded" --level info
239
- npx securenow test-span # verify collector connectivity
109
+ npx securenow test-span # send a test span
110
+ npx securenow doctor # diagnose config + connectivity
111
+ npx securenow status # dashboard summary
240
112
  ```
241
113
 
242
- Full reference: run `npx securenow help` or see [CLI Reference](#cli-reference) below.
243
-
244
114
  ---
245
115
 
246
- ## MCP for Codex and Claude
116
+ ## Connect your coding agent (MCP)
247
117
 
248
- SecureNow ships a local stdio MCP server for agent clients:
118
+ SecureNow ships a local stdio MCP server. The server command is `npx securenow mcp` (also installed as the `securenow-mcp` bin). Authenticate first with `npx securenow login`.
119
+
120
+ **Claude Code**
249
121
 
250
122
  ```bash
251
- npx securenow login
252
- npx securenow admin login # admin/control-plane only
253
- npx securenow app connect # runtime app/API key only
254
- codex mcp add securenow -- npx securenow mcp
255
- # or run directly:
256
- npx -p securenow securenow-mcp
123
+ claude mcp add securenow -- npx securenow mcp
257
124
  ```
258
125
 
259
- The MCP server resolves credentials by operation type: admin/global tools use `.securenow/admin.json`, while app-scoped runtime reads can use `.securenow/runtime.json` or an explicit app key. Legacy combined `.securenow/credentials.json` remains a fallback. It exposes tools for apps, traces, logs, firewall, IP intelligence, forensics, blocklist/allowlist/trusted IPs, rate-limit remediation, plus resources for the bundled SecureNow docs and setup prompts.
260
-
261
- ---
262
-
263
- ## Credentials Config
264
-
265
- Use `.securenow/runtime.json` fields for new local SDK/runtime setups. Production exports still use tokenless `.securenow/credentials.<environment>.json` files that can be mounted as `.securenow/credentials.json`.
266
-
267
- | Field | Default | Purpose |
268
- |---|---|---|
269
- | `app.key` | selected during login | App routing UUID; the gateway routes telemetry by this key |
270
- | `app.name` | selected during login | Human-readable label for CLI and dashboard output |
271
- | `apiKey` | minted during login | One-app scoped runtime API key (`snk_live_...`) for telemetry ingestion and firewall sync. Runtime scopes: `traces:write`, `logs:write`, `firewall:read`, `blocklist:read`, `allowlist:read` |
272
- | `config.runtime.deploymentEnvironment` | `local` from `init`, `production` from runtime credentials | Sent as OTel `deployment.environment` |
273
- | `config.logging.enabled` | `true` | Forward `console.*` as OTLP logs |
274
- | `config.capture.body` | `true` | Capture JSON / form request bodies with redaction |
275
- | `config.capture.multipart` | `true` | Capture multipart metadata, never file content |
276
- | `config.capture.maxBodySize` | `10240` | Max bytes captured per body |
277
- | `config.capture.sensitiveFields` | `[]` | Extra field-name fragments to redact |
278
- | `config.firewall.enabled` | Deprecated | Ignored as a local kill switch; dashboard/API firewall toggle is scoped per environment |
279
- | `config.otel.*` | empty | Optional custom OTLP endpoints, headers, and log level |
280
-
281
- The credentials file is versioned with `_securenow.schemaVersion`, so future SDK
282
- versions can migrate defaults without asking customers to manage env vars. For
283
- production, generate a tokenless runtime file:
126
+ **Codex**
284
127
 
285
128
  ```bash
286
- npx securenow credentials runtime --env production
129
+ codex mcp add securenow -- npx securenow mcp
287
130
  ```
288
131
 
289
- Mount or copy that JSON as `.securenow/credentials.json` in the deployed app.
290
- New runtime credentials do not include a per-instance collector URL; the SDK
291
- uses `https://ingest.securenow.ai` by default and the gateway routes by
292
- `app.key`.
293
- Environment-variable fallback is not supported; use runtime credentials files
294
- for local, staging, preview, and production.
132
+ **Cursor** — `.cursor/mcp.json`:
295
133
 
296
- ---
297
-
298
- ## Supported frameworks
299
-
300
- ### Web
301
- Next.js (App & Pages Router), Nuxt 3, Express, Fastify, NestJS, Koa, Hapi
302
-
303
- ### Databases
304
- PostgreSQL, MySQL / MySQL2, MongoDB, Redis
305
-
306
- ### Other
307
- HTTP/HTTPS, GraphQL, gRPC, and many more via [@opentelemetry/auto-instrumentations-node](https://www.npmjs.com/package/@opentelemetry/auto-instrumentations-node).
308
-
309
- > MongoDB instrumentation is included in the current SDK. To disable it for a service, add `@opentelemetry/instrumentation-mongodb` to `config.otel.disableInstrumentations` in `.securenow/runtime.json`.
310
-
311
- ---
134
+ ```json
135
+ {
136
+ "mcpServers": {
137
+ "securenow": {
138
+ "command": "npx",
139
+ "args": ["securenow", "mcp"]
140
+ }
141
+ }
142
+ }
143
+ ```
312
144
 
313
- ## Documentation
145
+ The server resolves credentials by operation type: admin/control-plane tools use `.securenow/admin.json`, app-scoped runtime reads can use `.securenow/runtime.json` or an explicit app key. Refresh one lane with `npx securenow admin login` or `npx securenow app connect`.
314
146
 
315
- The npm package ships the current setup references: this README, `NPM_README.md`, `SKILL-API.md`, `SKILL-CLI.md`, and the MCP resources exposed by `npx securenow mcp`. Older long-form guides are kept in the repository only so customer installs do not receive stale `.env`-first instructions.
147
+ It exposes tools for apps, traces, logs, firewall, IP intelligence, forensics, blocklist/allowlist/trusted IPs, session revocation, rate limits, and the human approval queue — plus bundled docs as MCP resources and ready-made prompts (`investigate_ip`, `work_human_actions`, `work_alert_review`, `soc_patrol`, `secure_project_setup`). Read tools are annotated read-only; every write tool refuses to run without `confirm: true` and a non-empty `reason`.
316
148
 
317
149
  ---
318
150
 
319
- ## CLI Reference
320
-
321
- After install, the `securenow` CLI is available via `npx securenow` or globally with `npm install -g securenow`.
322
-
323
- ### Run (convenience wrapper)
324
-
325
- | Command | Description |
326
- |---|---|
327
- | `securenow run <script>` | Run a Node app with `-r securenow/register` injected |
328
- | `securenow run --watch <script>` | Same, with Node.js watch mode |
329
- | `securenow run --firewall-only <script>` | Preload the firewall only, skip OTel |
330
-
331
- ### Authentication
332
-
333
- | Command | Description |
334
- |---|---|
335
- | `securenow login` | Friendly onboarding: admin auth + runtime app connection |
336
- | `securenow admin login` | Admin/control-plane CLI and MCP auth only |
337
- | `securenow app connect` | App/runtime SDK connection only |
338
- | `securenow login --global` | Save to ~/.securenow/ instead |
339
- | `securenow admin login --token <TOKEN>` | Headless admin auth (CI/servers) |
340
- | `securenow logout` | Clear admin auth only; runtime app config stays intact |
341
- | `securenow logout --global` | Clear ~/.securenow/ instead |
342
- | `securenow whoami` | Show admin auth and runtime app status separately |
343
- | `securenow api-key create [--name "CLI runtime"] [--app <key-or-id>]` | Mint and store a one-app `runtime_app` key. Defaults to the current app in `.securenow/runtime.json` |
344
- | `securenow api-key set <snk_live_...>` | Store runtime API key in `.securenow/runtime.json` (`--global` for `~/.securenow/`) |
345
- | `securenow api-key show` | Print masked key + source file |
346
- | `securenow api-key clear` | Remove stored key (`--global` for `~/.securenow/`) |
347
-
348
- ### Applications
151
+ ## CLI
349
152
 
350
- | Command | Description |
351
- |---|---|
352
- | `securenow apps` | List all apps for your account |
353
- | `securenow apps create <name>` | Create an app |
354
- | `securenow apps info <id>` | Show app details |
355
- | `securenow apps delete <id>` | Delete an app |
356
- | `securenow apps default <key>` | Switch which app this project uses (updates `.securenow/`) |
153
+ Everything the MCP server can do is also a command. Run `npx securenow help` for the full reference; most read commands take `--json` for machine-readable output and `--app <key>` to target another app.
357
154
 
358
- ### Observability
155
+ ### Investigate
359
156
 
360
157
  | Command | Description |
361
158
  |---|---|
362
- | `securenow traces` | Recent traces |
363
- | `securenow traces show <traceId>` | Trace spans |
364
- | `securenow traces analyze <traceId>` | AI security analysis |
365
- | `securenow logs` | View logs (`--minutes`, `--level`) |
366
- | `securenow logs trace <traceId>` | Logs for a trace |
367
- | `securenow analytics` | Response code analytics |
368
- | `securenow status` | Dashboard summary |
159
+ | `securenow ip <address>` | IP intelligence (geo, abuse, verdict) |
160
+ | `securenow ip traces <address>` | Traces from an IP |
161
+ | `securenow forensics "<query>"` | Natural-language forensic query |
162
+ | `securenow traces` / `traces show <traceId>` | Recent traces / trace spans |
163
+ | `securenow traces analyze <traceId>` | AI security analysis of a trace |
164
+ | `securenow logs [--since 6h] [--level error]` | View logs |
165
+ | `securenow analytics` | Response-code analytics |
369
166
 
370
- ### Detection authoring
167
+ ### Respond
371
168
 
372
169
  | Command | Description |
373
170
  |---|---|
374
- | `securenow telemetry schema --json` | Offline, versioned tables, fields, event mappings, tenant scope, and SQL requirements |
375
- | `securenow telemetry fields --app <key> --env production --since 24h --json` | Fields, types, and custom event names actually observed for an authorized app; values are never returned |
376
- | `securenow alerts rules validate --sql @rule.sql --app <key>` | Compile and dry-run candidate SQL before creating a rule |
377
-
378
- The machine-readable contract is also exported as `require('securenow/telemetry-schema')`; the full workflow and SQL examples are in [`TELEMETRY-SQL.md`](./TELEMETRY-SQL.md).
171
+ | `securenow human list` / `human show <row>` | Review AI-prepared decisions awaiting a human |
172
+ | `securenow human block <row> --yes --reason "..."` | Approve a proposed block |
173
+ | `securenow blocklist add <ip> [--route /admin*] [--mode prefix] [--duration 24h] [--reason "..."]` | Block an IP globally or per-route |
174
+ | `securenow blocklist unblock <id> --reason "..."` | Stop enforcement, keep the history |
175
+ | `securenow ratelimit from-text "rate limit /api/login to 5 per minute" --yes` | Rate-limit rule from natural language |
176
+ | `securenow challenge add <ip> --route /login` | Proof-of-work challenge instead of a hard block |
177
+ | `securenow revoke session <id>` / `revoke user <id>` | Kill stolen sessions (enforced via `securenow/sessions`) |
178
+ | `securenow trusted add <ip>` | Mark an IP as trusted |
379
179
 
380
- ### Detect & Respond
180
+ ### Rules & detections
381
181
 
382
182
  | Command | Description |
383
183
  |---|---|
384
- | `securenow notifications` | List notifications |
385
- | `securenow notifications unread` | Unread count |
386
- | `securenow alerts rules` | List alert rules |
387
- | `securenow alerts rules dry-run-query <id> --sql @candidate.sql --wait` | Dry-run candidate alert SQL without saving |
388
- | `securenow alerts rules tune-query <id> --sql @candidate.sql --apply-globally --yes` | Admin: update a shared system rule query mapping |
184
+ | `securenow alerts rules` | List alert rules (`create`, `update`, `test`, `delete`, ...) |
185
+ | `securenow alerts rules validate --sql @rule.sql --app <key>` | Compile and dry-run candidate detection SQL |
389
186
  | `securenow alerts history` | Alert history |
390
-
391
- ### Investigate
392
-
393
- | Command | Description |
394
- |---|---|
395
- | `securenow ip <address>` | IP intel (geo, abuse, verdict) |
396
- | `securenow ip traces <address>` | Traces from an IP |
397
- | `securenow forensics "<query>"` | Natural language forensic query |
398
- | `securenow api-map` | Discovered API endpoints |
187
+ | `securenow fp` / `fp ai-fill --description "..."` | False-positive exclusions, AI-drafted |
188
+ | `securenow fp dry-run --conditions '[...]'` | Test exclusions against the last 3 days of traces |
189
+ | `securenow telemetry schema --json` | The machine-readable detection-authoring contract |
190
+ | `securenow telemetry fields --app <key> --since 24h --json` | Fields actually observed for your app |
399
191
 
400
192
  ### Firewall
401
193
 
402
194
  | Command | Description |
403
195
  |---|---|
404
- | `securenow firewall status` | Firewall layers + key info |
196
+ | `securenow firewall status` | Firewall layers + blocklist info |
405
197
  | `securenow firewall test-ip <ip> [--path /admin/users]` | Would this IP be blocked? |
198
+ | `securenow firewall enable` / `disable [--app <key>] [--env production]` | Per-app, per-environment toggle |
406
199
 
407
- ### Remediation
408
-
409
- | Command | Description |
410
- |---|---|
411
- | `securenow blocklist` | List blocked IPs |
412
- | `securenow blocklist add <ip> [--route /admin*] [--mode prefix] [--method GET] [--reason ...]` | Block an IP globally or only for matching routes |
413
- | `securenow blocklist unblock <id> [--reason ...]` | Stop enforcement and keep block history |
414
- | `securenow ratelimit parse "<request>"` | Fill a rate-limit rule draft from natural language |
415
- | `securenow ratelimit from-text "<request>" --yes` | Create a soft rate-limit rule from natural language |
416
- | `securenow allowlist add <ip>` | Allow an IP (restrict-mode) |
417
- | `securenow trusted add <ip>` | Mark an IP as trusted |
418
-
419
- ### False positives
200
+ ### Health & diagnostics
420
201
 
421
202
  | Command | Description |
422
203
  |---|---|
423
- | `securenow fp` | List exclusion rules |
424
- | `securenow fp ai-fill --description "..."` | AI-generate exclusion conditions |
425
- | `securenow fp mark <notif-id> <ip>` | Mark an alert as a false positive |
426
- | `securenow fp dry-run --conditions '[...]'` | Test against last 3 days of traces |
427
-
428
- ### Telemetry from the shell
204
+ | `securenow doctor` | Probe OTLP + API, check config |
205
+ | `securenow status` | Dashboard summary |
206
+ | `securenow whoami` | Admin auth and runtime status |
207
+ | `securenow env` | Show resolved config |
208
+ | `securenow test-span` | Verify collector connectivity |
209
+ | `securenow log send "Deploy done" --level info` | Emit a log from shell/CI |
429
210
 
430
- | Command | Description |
431
- |---|---|
432
- | `securenow log send "<msg>" [--level info\|warn\|error]` | Emit a log record via OTLP |
433
- | `securenow test-span` | Send a test span |
211
+ ---
434
212
 
435
- ### Diagnostics & utilities
213
+ ## Free firewall
436
214
 
437
- | Command | Description |
438
- |---|---|
439
- | `securenow doctor` | Probe OTLP + API, check config |
440
- | `securenow env` | Show resolved config |
441
- | `securenow redact '<json>'` | Preview redaction |
442
- | `securenow cidr match <ip> <cidr>` | Test CIDR match (exit 0/2) |
215
+ The free tier includes the in-process IP firewall — no tracing required:
443
216
 
444
- ### Global flags
217
+ ```bash
218
+ npx securenow run --firewall-only src/index.js
219
+ # or as a preload:
220
+ node -r securenow/firewall-only src/index.js
221
+ ```
445
222
 
446
- | Flag | Effect |
447
- |---|---|
448
- | `--json` | Machine-readable output |
449
- | `--help` | Help for any command |
450
- | `--app <key>` | Override which app |
451
- | `--global` | Global credentials scope (login/logout) |
223
+ It syncs your app's blocklist plus SecureNow's IP database of 500k+ known-bad IPs, refreshed hourly, and blocks in-process with HTTP 403. No proxies, no DNS changes, no network configuration — and it fails open.
452
224
 
453
- ### Where things live
225
+ ---
454
226
 
455
- | File | Purpose |
456
- |---|---|
457
- | `./.securenow/admin.json` | Project-local admin/control-plane CLI and MCP auth |
458
- | `./.securenow/runtime.json` | Project-local SDK runtime app config and runtime API key |
459
- | `./.securenow/credentials.json` | Legacy combined credentials; still read for backward compatibility |
460
- | `./.securenow/credentials.<environment>.json` | Tokenless runtime file generated by `securenow credentials runtime --env <environment>`; read in a fixed order, not selected from env vars |
461
- | `~/.securenow/admin.json` | Global admin/control-plane auth |
462
- | `~/.securenow/runtime.json` | Global SDK runtime app config |
463
- | `~/.securenow/credentials.json` | Legacy global combined credentials |
464
- | `~/.securenow/credentials.<environment>.json` | Global environment-specific runtime credentials |
465
- | `~/.securenow/config.json` | API URL, default app, preferences |
227
+ ## Security & trust
466
228
 
467
- Runtime resolution order: project `.securenow/runtime.json` -> legacy project `.securenow/credentials.json` -> project named runtime credentials in fixed staging/production/preview/local/test/development/dev/prod order -> global `~/.securenow/runtime.json` -> legacy global credentials -> global named runtime credentials -> package name fallback. Admin auth resolves from `admin.json` first, then legacy `credentials.json`. Runtime config is never read from environment variables.
229
+ - **SecureNow never needs your source code.** It sees runtime telemetry — requests, spans, logs — not your repository.
230
+ - **Redacted at capture.** `password`, `token`, `api_key`, `authorization`, `cookie`, and friends are auto-redacted before leaving your process; multipart file content is never captured. Preview with `securenow redact '<json>'`.
231
+ - **Fails open.** If SecureNow is unreachable, your app serves traffic normally (`config.firewall.failMode: "open"` is the default).
232
+ - **Read/write split.** MCP read tools are read-only; write tools require explicit `confirm: true` plus a reason, and human approval is the designed path for mutations — blocks, rate limits, and revocations are proposed, approved, executed, and reversible.
468
233
 
469
- Override the dashboard API with `securenow config set apiUrl <url>`.
234
+ More at [securenow.ai/security](https://securenow.ai/security).
470
235
 
471
236
  ---
472
237
 
473
- ## Support
238
+ ## Pricing
474
239
 
475
- - **Website:** [securenow.ai](http://securenow.ai/)
476
- - **Docs:** this README, `NPM_README.md`, `SKILL-API.md`, `SKILL-CLI.md`, and `npx securenow help`
477
- - **Issues:** report bugs and requests on GitHub
240
+ 14-day free trial. No credit card. Full product.
478
241
 
479
- ---
242
+ - **Free** — $0: local AI security audit, IP intelligence, basic firewall with 500k+ known-bad IPs refreshed hourly, CLI
243
+ - **Pro** — $49/app/mo: full production security — detection, MCP, AI investigations, traces/logs, custom detections, blocking, rate limits, alerts, 7-day history
244
+ - **Team** — $149/mo: 5 apps, 30-day history, team features
245
+ - **Scale** — custom: dedicated isolated instance
246
+
247
+ Details at [securenow.ai](https://securenow.ai/). Full CLI/SDK reference: `npx securenow help` plus the `SKILL-CLI.md` and `SKILL-API.md` files shipped in this package.
480
248
 
481
249
  ## License
482
250