Name: Node9-Proxy
Author: node9-ai

LABSCO SUMMARY

Starts by telling you what already happened, which is the uncomfortable part.

The scan runs before installation and reads only local history, so the first thing you get is an honest account of what your agents have been reaching for - not a promise about the future. Findings are grouped by who can fix them, and each one comes with the command that fixes it, which is what keeps it from being a wall of warnings.

What it is

A guard layer for coding agents. It reads the session history the agents already keep, intercepts tool calls before they run through hooks or an MCP gateway, and writes every decision to a local audit log.

What you get

A retrospective scan of past agent sessions for credential leaks, agent loops, blocked operations and secrets on disk an agent could reach right now
Risky commands held for review or blocked outright, with curated rule packs per service - shells, Postgres, MongoDB, Redis, AWS, Kubernetes, Docker, GitHub and the filesystem
Always-on checks for force pushes, unqualified deletes and updates, piped downloads, and cloud keys appearing in tool arguments or shell config
An MCP gateway that wraps any server transparently, pinning each server's tool definitions and quarantining the session if they change between runs
A repository scan for ways an outsider could hijack an agent wired into CI - injectable workflows, reachable secrets, unpinned servers, poisoned instruction files
A sandbox mode that runs the agent in a disposable container with a kernel-enforced egress allowlist and scoped mounts
Period-windowed reporting - cost per agent, top tools, which shields fired, and what the agent could reach

Requirements

Node.js 18+, installed with Homebrew or npm; node9 init wires up the agents and MCP servers it detects, and node9 doctor checks the result. The repository scan runs against public repositories with no install and no token. The sandbox mode additionally needs Docker.

Setup effort

One command — npm install -g node9-ai

See installation options

USE CASES

01

Finding out what your agents have already touched

Run the scan before installing anything; it reads existing session history locally and reports credential exposure and loops.

02

Stopping the destructive command, not every command

Enable only the rule packs for the services you actually use, so the review prompts stay rare enough to be read.

03

Noticing when an MCP server changes its tools

Run your servers behind the gateway; definitions are pinned on first use and a changed surface quarantines the session until a person approves it.

04

Checking a repository before an agent runs in its CI

Scan the repository for injectable workflows and reachable secrets, and gate pull requests on the same engine.

05

Confining an agent you do not fully trust

Run it in the sandbox: a disposable container, only the folder you mount, only the hosts you allow, with the same policy applied inside.

BEFORE YOU INSTALL

What to know first

Requires

node9 on PATH

INSTALLATION

Connect your client

Add the block to your client, or run the command directly.

Server setup

Configuration file

JSON

{
  "mcpServers": {
    "postgres": {
      "command": "node9",
      "args": [
        "mcp",
        "--upstream",
        "npx -y @modelcontextprotocol/server-postgres <YOUR_POSTGRESQL_URL>"
      ]
    }
  }
}

npm

TERMINAL

npm install -g node9-ai

Node9-Proxy