securenow
Advanced tools
OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend
Production security for AI-native development teams.
Your coding agent knows your code. SecureNow shows it what's happening in production. One Node.js package, CLI, and MCP server connect Claude Code, Codex, and Cursor to your live application security — attacks, routes, users, traces, IP intelligence, and response controls.
Your agent already sees the repository, the dependencies, the auth implementation, the API handlers, the database queries. SecureNow adds the half it can't see: live requests, routes, users and sessions, attack patterns, IP intelligence, traces and logs, security history, and block / rate-limit controls — with human approval on every mutation.
Find it in code. Watch it in production.
You: Investigate suspicious login activity from the last hour.
SecureNow (via MCP):
1,482 failed login attempts in the last 60 minutes
· 63 source IPs
· 19 accounts targeted
· 11 IPs match known malicious infrastructure
· Pattern consistent with distributed credential stuffing
Recommended action:
· Block the 11 high-confidence sources
· Rate-limit /api/auth/login
· Review 3 accounts that authenticated successfully during the window
Agent: Apply the recommended blocks?
You: Yes.
Detection and investigation are automatic. Actions are proposed, a human approves, then they execute — and every action is reversible (unblock keeps the history, revocations can be restored, rate limits expire).
Paste this into Claude Code, Codex, or Cursor:
Set up SecureNow (npm package "securenow") in this project:
1. Install it: npm install securenow@latest
2. Run npx securenow login from the project root and wait while I complete
the browser flow. It writes .securenow/runtime.json (SDK runtime config +
runtime API key) and .securenow/admin.json (CLI/MCP auth).
3. Wire the runtime: run npx securenow init for Next.js or Nuxt; for plain
Node servers (Express, Fastify, NestJS, Koa, Hapi) add
-r securenow/register to the start script instead.
4. Make sure the .securenow/*.json credential files are gitignored without
ignoring the whole .securenow/ directory. Never print their contents.
5. Verify: npx securenow whoami, npx securenow doctor,
npx securenow test-span, then npx securenow status.
Do not block traffic or modify security policy without asking me first.
# 1. Install
npm install securenow
# 2. Pick (or create) your app in the browser — writes .securenow/runtime.json
# and refreshes CLI/MCP auth in .securenow/admin.json
npx securenow login
# 3. Start your app — one flag is all it takes
node -r securenow/register src/index.js
No .env edits, no API keys to paste. Runtime config lives in .securenow/runtime.json; it is never read from environment variables.
"scripts": {
"start": "node -r securenow/register src/index.js",
"dev": "node -r securenow/register --watch src/index.js"
}
Can't change the script? Use NODE_OPTIONS="-r securenow/register" npm start, or the wrapper: npx securenow run src/index.js.
Next.js — npx securenow init creates instrumentation.ts and patches next.config.* when it can do so safely (adds securenow to serverExternalPackages on Next.js 15+). If your config needs human judgment, init prints an agent-ready prompt with the exact edits to merge.
Nuxt 3 — add the module, then run npx securenow init:
export default defineNuxtConfig({
modules: ['securenow/nuxt'],
});
What's captured automatically: HTTP spans (Express, Fastify, NestJS, Koa, Hapi, Next.js, Nuxt, raw http), database spans (Postgres, MySQL, MongoDB, Redis), console.* as logs with trace correlation, request bodies with auto-redaction, multipart metadata (never file content), plus the firewall. Tune everything in .securenow/runtime.json under config.
Production — same file structure, no env vars. Generate a tokenless runtime credentials file and mount it as a deployment secret:
npx securenow credentials runtime --env production
# store the output, mount it at <app-root>/.securenow/credentials.json
Verify any environment with:
npx securenow test-span # send a test span
npx securenow doctor # diagnose config + connectivity
npx securenow status # dashboard summary
SecureNow ships a local stdio MCP server. The server command is npx securenow mcp (also installed as the securenow-mcp bin). Authenticate first with npx securenow login.
Claude Code
claude mcp add securenow -- npx securenow mcp
Codex
codex mcp add securenow -- npx securenow mcp
Cursor — .cursor/mcp.json:
{
"mcpServers": {
"securenow": {
"command": "npx",
"args": ["securenow", "mcp"]
}
}
}
The server resolves credentials by operation type: admin/control-plane tools use .securenow/admin.json, app-scoped runtime reads can use .securenow/runtime.json or an explicit app key. Refresh one lane with npx securenow admin login or npx securenow app connect.
It exposes tools for apps, traces, logs, firewall, IP intelligence, forensics, blocklist/allowlist/trusted IPs, session revocation, rate limits, and the human approval queue — plus bundled docs as MCP resources and ready-made prompts (investigate_ip, work_human_actions, work_alert_review, soc_patrol, secure_project_setup). Read tools are annotated read-only; every write tool refuses to run without confirm: true and a non-empty reason.
Everything the MCP server can do is also a command. Run npx securenow help for the full reference; most read commands take --json for machine-readable output and --app <key> to target another app.
| Command | Description |
|---|---|
securenow ip <address> | IP intelligence (geo, abuse, verdict) |
securenow ip traces <address> | Traces from an IP |
securenow forensics "<query>" | Natural-language forensic query |
securenow traces / traces show <traceId> | Recent traces / trace spans |
securenow traces analyze <traceId> | AI security analysis of a trace |
securenow logs [--since 6h] [--level error] | View logs |
securenow analytics | Response-code analytics |
| Command | Description |
|---|---|
securenow human list / human show <row> | Review AI-prepared decisions awaiting a human |
securenow human block <row> --yes --reason "..." | Approve a proposed block |
securenow blocklist add <ip> [--route /admin*] [--mode prefix] [--duration 24h] [--reason "..."] | Block an IP globally or per-route |
securenow blocklist unblock <id> --reason "..." | Stop enforcement, keep the history |
securenow ratelimit from-text "rate limit /api/login to 5 per minute" --yes | Rate-limit rule from natural language |
securenow challenge add <ip> --route /login | Proof-of-work challenge instead of a hard block |
securenow revoke session <id> / revoke user <id> | Kill stolen sessions (enforced via securenow/sessions) |
securenow trusted add <ip> | Mark an IP as trusted |
| Command | Description |
|---|---|
securenow alerts rules | List alert rules (create, update, test, delete, ...) |
securenow alerts rules validate --sql @rule.sql --app <key> | Compile and dry-run candidate detection SQL |
securenow alerts history | Alert history |
securenow fp / fp ai-fill --description "..." | False-positive exclusions, AI-drafted |
securenow fp dry-run --conditions '[...]' | Test exclusions against the last 3 days of traces |
securenow telemetry schema --json | The machine-readable detection-authoring contract |
securenow telemetry fields --app <key> --since 24h --json | Fields actually observed for your app |
| Command | Description |
|---|---|
securenow firewall status | Firewall layers + blocklist info |
securenow firewall test-ip <ip> [--path /admin/users] | Would this IP be blocked? |
securenow firewall enable / disable [--app <key>] [--env production] | Per-app, per-environment toggle |
| Command | Description |
|---|---|
securenow doctor | Probe OTLP + API, check config |
securenow status | Dashboard summary |
securenow whoami | Admin auth and runtime status |
securenow env | Show resolved config |
securenow test-span | Verify collector connectivity |
securenow log send "Deploy done" --level info | Emit a log from shell/CI |
The free tier includes the in-process IP firewall — no tracing required:
npx securenow run --firewall-only src/index.js
# or as a preload:
node -r securenow/firewall-only src/index.js
It syncs your app's blocklist plus SecureNow's IP database of 500k+ known-bad IPs, refreshed hourly, and blocks in-process with HTTP 403. No proxies, no DNS changes, no network configuration — and it fails open.
password, token, api_key, authorization, cookie, and friends are auto-redacted before leaving your process; multipart file content is never captured. Preview with securenow redact '<json>'.config.firewall.failMode: "open" is the default).confirm: true plus a reason, and human approval is the designed path for mutations — blocks, rate limits, and revocations are proposed, approved, executed, and reversible.More at securenow.ai/security.
14-day free trial. No credit card. Full product.
Details at securenow.ai. Full CLI/SDK reference: npx securenow help plus the SKILL-CLI.md and SKILL-API.md files shipped in this package.
ISC
FAQs
OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend
The npm package securenow receives a total of 0 weekly downloads. As such, securenow popularity was classified as not popular.
We found that securenow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.
Security News
Cloudflare introduces tsrs, a Rust port of TypeScript’s compiler promising faster checks and lower memory use, with the TypeScript team’s help.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.