The scan runs before installation and reads only local history, so the first thing you get is an honest account of what your agents have been reaching for - not a promise about the future. Findings are grouped by who can fix them, and each one comes with the command that fixes it, which is what keeps it from being a wall of warnings.
A guard layer for coding agents. It reads the session history the agents already keep, intercepts tool calls before they run through hooks or an MCP gateway, and writes every decision to a local audit log.
- A retrospective scan of past agent sessions for credential leaks, agent loops, blocked operations and secrets on disk an agent could reach right now
- Risky commands held for review or blocked outright, with curated rule packs per service - shells, Postgres, MongoDB, Redis, AWS, Kubernetes, Docker, GitHub and the filesystem
- Always-on checks for force pushes, unqualified deletes and updates, piped downloads, and cloud keys appearing in tool arguments or shell config
- An MCP gateway that wraps any server transparently, pinning each server's tool definitions and quarantining the session if they change between runs
- A repository scan for ways an outsider could hijack an agent wired into CI - injectable workflows, reachable secrets, unpinned servers, poisoned instruction files
- A sandbox mode that runs the agent in a disposable container with a kernel-enforced egress allowlist and scoped mounts
- Period-windowed reporting - cost per agent, top tools, which shields fired, and what the agent could reach
Node.js 18+, installed with Homebrew or npm; node9 init wires up the agents and MCP servers it detects, and node9 doctor checks the result. The repository scan runs against public repositories with no install and no token. The sandbox mode additionally needs Docker.
One command — npm install -g node9-ai