Node9

What node9 does

The node9 MCP server gives an agent a way to inspect its security controls from inside a conversation. It can provide status, machine posture, audit information, and policy details, and it can explain why a tool call was allowed, held, or blocked.

The broader node9 product places a gate between an AI agent and the tools it invokes. Each call is evaluated before execution. Allowed actions run and are recorded; blocked actions do not run; held actions remain stopped until a person approves them. If nobody responds to a held request, it stays blocked.

This fits the 🔒 Security category because its primary purpose is controlling agent access to files, commands, databases, network destinations, and other MCP tools. Default protections include a credential jail covering paths such as ~/.ssh, ~/.aws, .env files, and private keys. The documented rules also cover destructive Git operations, SQL without a WHERE clause, curl | bash, and unauthorized sudo.

How it works

node9 evaluates actions in its hook rather than trusting an agent's startup permission flags. Shell commands are parsed as an abstract syntax tree, so hiding a sensitive file read inside command substitution or encoded output does not avoid the rule. A command that reads a protected path is stopped and the agent receives instructions explaining the decision.

Network egress protection is optional and disabled by default. When enabled with node9 egress protect, node9 gates shell-command destinations as well as other applicable checks. The credential protection and tool-level controls are broader than shell alone, while egress protection applies to shell commands.

Setup and configuration

Install with Homebrew on macOS or Linux, or install the npm package globally on any platform. Node.js 22 or newer is required. Running node9 in a new interactive terminal starts setup, where you can choose local protection or connect to a dashboard. Local protection does not require an account.

Use node9 setup to revisit configuration or node9 setup <target> to configure one agent. node9 init --recommended supports noninteractive scripts. Login is optional: it connects a machine to a shared workspace for centralized policy, visibility, and approvals, but local enforcement continues without it and works offline.

To expose the node9 MCP server to an MCP client, run npx -y node9-ai mcp-server over stdio. No API key is required. The project is listed in the official MCP Registry as io.github.node9-ai/node9.

Tools and capabilities

The node9 MCP server can expose:

• Current node9 status
• Machine posture and its 0–100 score
• The audit record of agent actions
• Active policy information
• Explanations for allow, hold, and block decisions

The command-line package also includes scan for reviewing past agent sessions and scan-repo for examining a public repository's agent workflow. These are verification commands rather than MCP tools.

Limitations and notes

node9 is a gate, not a replacement for an agent's own permissions. Its enforcement hook keeps held actions stopped even when an agent was started with permission checks skipped. However, egress control must be enabled separately. With the default egress setting, a shell command that sends a file directly to the network is not necessarily treated as reading that file.

Dashboard login adds shared visibility and approval workflows but does not strengthen local enforcement by itself. Usage statistics are sent only after a separate opt-in prompt. Workspace policy is managed in the dashboard, while service settings remain local.