securenow
Advanced tools
OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend
Production security for AI-native development teams.
Your coding agent knows your code. SecureNow shows it what's happening in production. One Node.js package, CLI, and MCP server connect Claude Code, Codex, and Cursor to your live application security — attacks, routes, users, traces, IP intelligence, and response controls.
Your agent already sees the repository, the dependencies, the auth implementation, the API handlers, the database queries. SecureNow adds the half it can't see: live requests, routes, users and sessions, attack patterns, IP intelligence, traces and logs, security history, and block / rate-limit controls — with human approval on every mutation.
Find it in code. Watch it in production.
You: Investigate suspicious login activity from the last hour.
SecureNow (via MCP):
1,482 failed login attempts in the last 60 minutes
· 63 source IPs
· 19 accounts targeted
· 11 IPs match known malicious infrastructure
· Pattern consistent with distributed credential stuffing
Recommended action:
· Block the 11 high-confidence sources
· Rate-limit /api/auth/login
· Review 3 accounts that authenticated successfully during the window
Agent: Apply the recommended blocks?
You: Yes.
Detection and investigation are automatic. Actions are proposed, a human approves, then they execute — and every action is reversible (unblock keeps the history, revocations can be restored, rate limits expire).
Paste this into Claude Code, Codex, or Cursor:
Set up SecureNow (npm package "securenow") in this project:
1. Install it: npm install securenow@latest
2. Run npx securenow login from the project root and wait while I complete
the browser flow. It writes .securenow/runtime.json (SDK runtime config +
runtime API key) and .securenow/admin.json (CLI/MCP auth).
3. Wire the runtime: run npx securenow init for Next.js or Nuxt; for plain
Node servers (Express, Fastify, NestJS, Koa, Hapi) add
-r securenow/register to the start script instead.
4. Make sure the .securenow/*.json credential files are gitignored without
ignoring the whole .securenow/ directory. Never print their contents.
5. Verify: npx securenow whoami, npx securenow doctor,
npx securenow test-span, then npx securenow status.
Do not block traffic or modify security policy without asking me first.
# 1. Install
npm install securenow
# 2. Pick (or create) your app in the browser — writes .securenow/runtime.json
# and refreshes CLI/MCP auth in .securenow/admin.json
npx securenow login
# 3. Start your app — one flag is all it takes
node -r securenow/register src/index.js
No .env edits, no API keys to paste. Runtime config lives in .securenow/runtime.json; it is never read from environment variables.
"scripts": {
"start": "node -r securenow/register src/index.js",
"dev": "node -r securenow/register --watch src/index.js"
}
Can't change the script? Use NODE_OPTIONS="-r securenow/register" npm start, or the wrapper: npx securenow run src/index.js.
Next.js — npx securenow init creates instrumentation.ts and patches next.config.* when it can do so safely (adds securenow to serverExternalPackages on Next.js 15+). If your config needs human judgment, init prints an agent-ready prompt with the exact edits to merge.
Nuxt 3 — add the module, then run npx securenow init:
export default defineNuxtConfig({
modules: ['securenow/nuxt'],
});
What's captured automatically: HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw http), database spans (Postgres, MySQL, MongoDB, Redis), console.* as logs with trace correlation, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in .securenow/runtime.json under config.
Production — same file structure, no env vars. Generate a tokenless runtime credentials file and mount it as a deployment secret:
npx securenow credentials runtime --env production
# store the output, mount it at <app-root>/.securenow/credentials.json
Verify any environment with:
npx securenow test-span # send a test span
npx securenow doctor # diagnose config + connectivity
npx securenow status # dashboard summary
Tests — test runs otherwise report to your real app with the project's .securenow credentials. SECURENOW_DISABLED=1 npm test turns the SDK off for that process: no traces, logs, events, firewall or session sync, and guard() just calls next(). This is the only setting read from the environment.
SecureNow ships a local stdio MCP server. The server command is npx securenow mcp (also installed as the securenow-mcp bin). Authenticate first with npx securenow login.
Claude Code
claude mcp add securenow -- npx securenow mcp
Codex
codex mcp add securenow -- npx securenow mcp
Cursor — .cursor/mcp.json:
{
"mcpServers": {
"securenow": {
"command": "npx",
"args": ["securenow", "mcp"]
}
}
}
The server resolves credentials by operation type: admin/control-plane tools use .securenow/admin.json, app-scoped runtime reads can use .securenow/runtime.json or an explicit app key. Refresh one lane with npx securenow admin login or npx securenow app connect.
It exposes tools for apps, traces, logs, firewall, IP intelligence, forensics, blocklist/allowlist/trusted IPs, session revocation, rate limits, and the human approval queue — plus bundled docs as MCP resources and ready-made prompts (investigate_ip, work_human_actions, work_alert_review, soc_patrol, secure_project_setup). Read tools are annotated read-only; every write tool refuses to run without confirm: true and a non-empty reason.
Everything the MCP server can do is also a command. Run npx securenow help for the full reference; most read commands take --json for machine-readable output and --app <key> to target another app.
| Command | Description |
|---|---|
securenow ip <address> | IP intelligence (geo, abuse, verdict) |
securenow ip traces <address> | Traces from an IP |
securenow forensics "<query>" | Natural-language forensic query |
securenow traces / traces show <traceId> | Recent traces / trace spans |
securenow traces analyze <traceId> | AI security analysis of a trace |
securenow logs [--since 6h] [--level error] | View logs |
securenow analytics | Response-code analytics |
| Command | Description |
|---|---|
securenow human list / human show <row> | Review AI-prepared decisions awaiting a human |
securenow human block <row> --yes --reason "..." | Approve a proposed block |
securenow blocklist add <ip> [--route /admin*] [--mode prefix] [--duration 24h] [--reason "..."] | Block an IP globally or per-route |
securenow blocklist unblock <id> --reason "..." | Stop enforcement, keep the history |
securenow ratelimit from-text "rate limit /api/login to 5 per minute" --yes | Rate-limit rule from natural language |
securenow challenge add <ip> --route /login | Proof-of-work challenge instead of a hard block |
securenow revoke session <id> / revoke user <id> | Kill stolen sessions (enforced via securenow/sessions) |
securenow trusted add <ip> | Mark an IP as trusted |
| Command | Description |
|---|---|
securenow alerts rules | List alert rules (create, update, test, delete, ...) |
securenow alerts rules validate --sql @rule.sql --app <key> | Compile and dry-run candidate detection SQL |
securenow alerts history | Alert history |
securenow fp / fp ai-fill --description "..." | False-positive exclusions, AI-drafted |
securenow fp dry-run --conditions '[...]' | Test exclusions against the last 3 days of traces |
securenow telemetry schema --json | The machine-readable detection-authoring contract |
securenow telemetry fields --app <key> --since 24h --json | Fields actually observed for your app |
| Command | Description |
|---|---|
securenow firewall status | Firewall layers + blocklist info |
securenow firewall test-ip <ip> [--path /admin/users] | Would this IP be blocked? |
securenow firewall enable / disable [--app <key>] [--env production] | Per-app, per-environment toggle |
| Command | Description |
|---|---|
securenow doctor | Probe OTLP + API, check config |
securenow status | Dashboard summary |
securenow whoami | Admin auth and runtime status |
securenow env | Show resolved config |
securenow test-span | Verify collector connectivity |
securenow log send "Deploy done" --level info | Emit a log from shell/CI |
The in-process IP firewall is included in SecureNow (14-day free trial, then $99 per app per month). It runs on its own, no tracing required:
npx securenow run --firewall-only src/index.js
# or as a preload:
node -r securenow/firewall-only src/index.js
It syncs your app's blocklist plus SecureNow's known-bad IP feed, refreshed hourly, and blocks in-process with HTTP 403. No proxies, no DNS changes, no network configuration — and it fails open.
SecureNow never needs your source code. It sees runtime telemetry — requests, spans, logs — not your repository.
Redacted at capture. password, token, api_key, authorization, cookie, and friends are auto-redacted before leaving your process; multipart file content is never captured. Preview with securenow redact '<json>'.
SecureNow 8.11.2 redacts sign-in credentials named code, otpCode, oneTimeCode, verificationCode, and passcode by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so status_code and error_code remain available for investigation. Redaction changes exported telemetry only.
Fails open. If SecureNow is unreachable, your app serves traffic normally (config.firewall.failMode: "open" is the default).
Read/write split. MCP read tools are read-only; write tools require explicit confirm: true plus a reason, and human approval is the designed path for mutations — blocks, rate limits, and revocations are proposed, approved, executed, and reversible.
More at securenow.ai/security.
One plan: $99 per app per month, every feature included — detection, MCP, AI investigations, traces and logs, custom detections, blocking, rate limits, alerts, and the firewall.
Details at securenow.ai. Full CLI/SDK reference: npx securenow help plus the SKILL-CLI.md and SKILL-API.md files shipped in this package.
ISC
FAQs
OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend
The npm package securenow receives a total of 26 weekly downloads. As such, securenow popularity was classified as not popular.
We found that securenow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Cloudflare introduces tsrs, a Rust port of TypeScript’s compiler promising faster checks and lower memory use, with the TypeScript team’s help.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.