@node9/proxy
Advanced tools
Node9 sits between your AI agent and your system. Every shell command, file write, and tool call passes through Node9 first — blocked, approved, or logged based on your policy. Works with Claude Code, Gemini CLI, Cursor, Codex, and any MCP server.
AIs move fast. Ask an agent to "ship the fix" and it might push straight to git without asking you.
With Node9:
Bash("git push origin main")# macOS / Linux
brew tap node9-ai/node9 && brew install node9
# or via npm
npm install -g @node9/proxy
node9 init # auto-detects Claude Code, Gemini CLI, Cursor, Codex
node9 doctor # verify everything is wired correctly
Enable expert-crafted protection for the infrastructure your agent touches:
node9 shield enable postgres # blocks DROP TABLE, TRUNCATE, DROP COLUMN
node9 shield enable mongodb # blocks dropDatabase, drop(), deleteMany({})
node9 shield enable redis # blocks FLUSHALL, FLUSHDB
node9 shield enable aws # blocks S3 delete, EC2 terminate, IAM changes
node9 shield enable k8s # blocks namespace delete, helm uninstall
node9 shield enable docker # blocks system prune, volume prune, rm -f
node9 shield enable github # blocks gh repo delete, remote branch deletion
node9 shield enable bash-safe # blocks curl|bash, base64|sh, rm -rf /
node9 shield enable filesystem # reviews chmod 777, writes to /etc/
node9 shield list # see all shields and their status
Wrap any MCP server transparently. The AI sees the same server — Node9 intercepts every tool call:
{
"mcpServers": {
"postgres": {
"command": "node9",
"args": ["mcp", "--upstream", "npx -y @modelcontextprotocol/server-postgres postgresql://..."]
}
}
}
Or use node9 init — it wraps existing MCP servers automatically.
MCP servers can change their tool definitions between sessions. A compromised or malicious server could silently add, remove, or modify tools after initial trust — a rug pull attack.
Node9 defends against this by pinning tool definitions on first use:
node9 mcp pin list # show all pinned servers and hashes
node9 mcp pin update <serverKey> # remove pin, re-pin on next connection
node9 mcp pin reset # clear all pins (re-pin on next connection)
This is automatic — no configuration needed. The gateway pins on first tools/list and enforces on every subsequent session.
from node9 import configure
configure(agent_name="my-agent", policy="require_approval")
# Your existing agent code runs unchanged — Node9 intercepts tool calls
Python SDK → · Governed Agent examples →
git push --force, git reset --hard, git clean -fdDELETE/UPDATE without WHERE, DROP TABLE, TRUNCATEcurl | bash, sudo commandsnode9 undo to revertEvery tool call your AI agent makes is recorded — command, arguments, result, and cost estimate. Node9 wires a live statusline into Claude Code that shows you what's happening in real time:
🛡 node9 | standard | [bash-safe] | ✅ 12 allowed 🛑 2 blocked 🚨 0 dlp | ~$0.43 | ⚡ no-force-push
📊 claude-opus-4-6 | ctx [████████░░░░░░░] 54% | 5h [██░░░░░░░░░░░░░] 12% | 7d [█░░░░░░░░░░░░░░] 7%
🗂 2 CLAUDE.md | 8 rules | 3 MCPs | 4 hooks
Line 1 — Security state: active mode, enabled shields, session totals (allowed / blocked / DLP hits), estimated cost, last rule that fired.
Line 2 — Context & rate limits: model name, context window usage, 5-hour and 7-day token rate-limit bars — so you can see when an agent is burning through quota.
Line 3 — Environment: how many CLAUDE.md files, rules, MCP servers, and hooks are active in the current project.
The HUD is wired automatically by node9 init. Full session logs land in ~/.node9/audit.log.
Run node9 report after a session to get a summary dashboard — what was allowed, what was blocked, DLP hits, cost (Claude Code only), and daily activity:
$ node9 report --period 7d
🛡 node9 Report · Last 7 Days Apr 8 – Apr 14 2,255 events
──────────────────────────────────────────────────────────────────────────────
✅ 1,746 allowed 🛑 509 blocked 🚨 70 DLP hits 23% block rate 💰 $82.91
Top Tools Top Blocks
───────────────────────────────────── ─────────────────────────────────────
Bash ██████ 1,595 timeout ██████ 281
Read █░░░░░ 196 smart-rule-block ██░░░░ 79
Edit █░░░░░ 118 observe-mode-dlp-would… █░░░░░ 69
drop_resource █░░░░░ 69 persistent-deny █░░░░░ 69
Grep █░░░░░ 35 local-decision █░░░░░ 5
Daily Activity
──────────────────────────────────────────────────────────────────────────────
Apr 9 ██████████████████████████████ 833 216 blocked
Apr 10 █████░░░░░░░░░░░░░░░░░░░░░░░░░ 145 24 blocked
Apr 11 ██████████████████████░░░░░░░░ 617 139 blocked
Periods: today, 7d (default), 30d, month. Cost data is read from ~/.claude/projects/ — no API calls, fully offline.
Everything else — config reference, smart rules, stateful rules, trusted hosts, approval modes, CLI reference — is at node9.ai/docs.
Node9 Pro provides governance locking, SAML/SSO, and VPC deployment. Visit node9.ai.
FAQs
Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
The npm package @node9/proxy receives a total of 1,238 weekly downloads. As such, @node9/proxy popularity was classified as popular.
We found that @node9/proxy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.
Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.
Security News
/Product
Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace.