# node9 [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/node9-ai/node9-proxy  
**GitHub Stars:** 220  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/node9

## Description
Access control for AI agents and MCP servers: allow, hold for approval, or block each tool call

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What node9 does

The node9 MCP server gives an agent a way to inspect its security controls from inside a conversation. It can provide status, machine posture, audit information, and policy details, and it can explain why a tool call was allowed, held, or blocked.

The broader node9 product places a gate between an AI agent and the tools it invokes. Each call is evaluated before execution. Allowed actions run and are recorded; blocked actions do not run; held actions remain stopped until a person approves them. If nobody responds to a held request, it stays blocked.

This fits the 🔒 Security category because its primary purpose is controlling agent access to files, commands, databases, network destinations, and other MCP tools. Default protections include a credential jail covering paths such as `~/.ssh`, `~/.aws`, `.env` files, and private keys. The documented rules also cover destructive Git operations, SQL without a `WHERE` clause, `curl | bash`, and unauthorized `sudo`.

## How it works

node9 evaluates actions in its hook rather than trusting an agent's startup permission flags. Shell commands are parsed as an abstract syntax tree, so hiding a sensitive file read inside command substitution or encoded output does not avoid the rule. A command that reads a protected path is stopped and the agent receives instructions explaining the decision.

Network egress protection is optional and disabled by default. When enabled with `node9 egress protect`, node9 gates shell-command destinations as well as other applicable checks. The credential protection and tool-level controls are broader than shell alone, while egress protection applies to shell commands.

## Setup and configuration

Install with Homebrew on macOS or Linux, or install the npm package globally on any platform. Node.js 22 or newer is required. Running `node9` in a new interactive terminal starts setup, where you can choose local protection or connect to a dashboard. Local protection does not require an account.

Use `node9 setup` to revisit configuration or `node9 setup <target>` to configure one agent. `node9 init --recommended` supports noninteractive scripts. Login is optional: it connects a machine to a shared workspace for centralized policy, visibility, and approvals, but local enforcement continues without it and works offline.

To expose the node9 MCP server to an MCP client, run `npx -y node9-ai mcp-server` over stdio. No API key is required. The project is listed in the official MCP Registry as `io.github.node9-ai/node9`.

## Tools and capabilities

The node9 MCP server can expose:

- Current node9 status
- Machine posture and its 0–100 score
- The audit record of agent actions
- Active policy information
- Explanations for allow, hold, and block decisions

The command-line package also includes `scan` for reviewing past agent sessions and `scan-repo` for examining a public repository's agent workflow. These are verification commands rather than MCP tools.

## Limitations and notes

node9 is a gate, not a replacement for an agent's own permissions. Its enforcement hook keeps held actions stopped even when an agent was started with permission checks skipped. However, egress control must be enabled separately. With the default egress setting, a shell command that sends a file directly to the network is not necessarily treated as reading that file.

Dashboard login adds shared visibility and approval workflows but does not strengthen local enforcement by itself. Usage statistics are sent only after a separate opt-in prompt. Workspace policy is managed in the dashboard, while service settings remain local.

_Full upstream README: https://allmcps.com/mcp/node9/readme_