Node9 Proxy

🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database.node9 decides what they may do with each one.

Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · one record across twelve agents

Works with Claude Code · Codex CLI · Antigravity (agy) · GitHub Copilot CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server.

What it looks like

A real Claude Code session with node9 installed. Every tool call is checked before it runs. Building a page and editing a button run. A request to the cloud metadata address is blocked, and the agent gets the reason and carries on. Deleting files waits for your approval, right in the chat.

Install

brew tap node9-ai/node9 && brew install node9   # macOS / Linux
npm install -g node9-ai                         # any platform

Then, in any project:

node9            # first run: choose dashboard connection or local protection
node9 posture    # scores this machine 0-100: what a compromised agent could read, reach and run
node9 login      # optional: adds this machine to a shared dashboard

Requires Node.js 22+.

On a new interactive terminal, node9 guides you through setup. Local protection needs no account. The checklist shows recommended shields, DLP/PII, optional network egress review, and the background service. Usage statistics are sent only if you accept the separate prompt. The summary lists configured agents and any setup steps that need attention.

Run node9 setup to revisit setup, or node9 setup <target> to configure one agent. Once configured, bare node9 shows help. node9 init remains available; for scripts use node9 init --recommended (no questions and no telemetry opt-in). --skip-setup leaves agent wiring and service installation alone. Explicit --mode takes precedence over the checklist's standard-mode recommendation. Existing settings are preserved unless selected changes or explicit flags request an update. Workspace policy is managed in the dashboard; service settings remain local.

login adds nothing to enforcement. It connects the machine to a workspace so a team can see one record across everyone's laptops and CI, set policy centrally, and approve held actions from a dashboard or Slack. Skip it and node9 works exactly the same, alone, offline. node9 logout disconnects again and local enforcement keeps running.

Use as an MCP server

node9 also runs as an MCP server, so an agent can read its status, posture, audit record and policy, and explain any decision, from inside the conversation:

claude mcp add --transport stdio node9 -- npx -y node9-ai mcp-server

Any MCP client works the same way: the command is npx -y node9-ai mcp-server over stdio, with no API key. It is listed in the official MCP Registry as io.github.node9-ai/node9.

The problem