Repolode
Submit
node9-ai

node9-ai/node9-proxy

Access control for AI coding agents: blocks credential reads, holds risky actions for review, and logs every tool call across Claude Code, Codex, Cursor and MCP servers.

View on GitHubWebsite
Stars
225
Forks
21
Open issues
1
Last commit
9 hours ago

What is it?

node9 sits between an AI agent and the tools it calls, checking each action before it runs. Its credential jail blocks reads of paths such as ~/.ssh, ~/.aws and .env files by default, and it parses shell commands as an AST so wrapping a read does not bypass the rule. Destructive git, SQL without a WHERE clause, curl piped to bash and unauthorised sudo are held or blocked without configuration. Held actions wait for approval inside the agent conversation, and the agent is told why an action was stopped.

Beyond the defaults, node9 offers per-service rule packs for Postgres, MongoDB, Redis, AWS, Kubernetes, Docker, GitHub and the filesystem, secret and PII detection in tool arguments, an optional network egress allowlist, and an MCP gateway that pins tool definitions. It also provides a sandbox mode, a posture score for the local machine, repo scanning for CI workflows an outsider could hijack, and session history. Local enforcement needs no account; an optional login connects a machine to a shared dashboard for team policy and audit.

node9 supports Claude Code, Codex CLI, Gemini CLI, Cursor, Windsurf, VS Code, Claude Desktop and other agents, and can also run as an MCP server. It is installed with npm or Homebrew and requires Node.js 22+.

Key features

  • 01Blocks agent reads of credential paths like ~/.ssh, ~/.aws and .env files.
  • 02Holds destructive git, SQL and shell commands until a human approves them.
  • 03Detects AWS keys, GitHub and Stripe tokens, private keys and PII in tool arguments.
  • 04Wraps any MCP server and pins tool definitions so they cannot change silently.
  • 05Keeps an audit record of every agent action across supported tools.
  • 06Offers an optional network egress allowlist for shell commands.

Use cases

  • Running Claude Code or Cursor on a laptop that holds cloud credentials and SSH keys.
  • Limiting which MCP servers and tools an agent can call in a team setup.
  • Reviewing risky database or shell commands before an agent executes them.
  • Scanning GitHub Actions workflows for paths that could let outsiders hijack an agent.

Quick start

  1. 1

    Install node9 globally with npm

    npm install -g node9-ai
  2. 2

    Run node9 in your project to choose dashboard or local protection setup

    node9
  3. 3

    Check how exposed this machine is with the posture score

    node9 posture

Things to know

  • Requires Node.js 22 or newer.
  • Egress control is off by default, so a command that sends a file straight to the network is not treated as a file read unless you enable it.
  • Egress gating covers shell commands only, not other tools.

In collections

Claude Code tools, skills & pluginsOpen-source AI agent frameworks & appsMCP servers

Topics

#agent-security#ai-agent#mcp#claude-code#access-control#dlp#prompt-injection#devsecops#agentic-ai#ai-agents

FAQ

What is node9-proxy?
Access control for AI coding agents: blocks credential reads, holds risky actions for review, and logs every tool call across Claude Code, Codex, Cursor and MCP servers. node9 sits between an AI agent and the tools it calls, checking each action before it runs. Its credential jail blocks reads of paths such as ~/.ssh, ~/.aws and .env files by default, and it parses shell commands as an AST so wrapping a read does not bypass the rule. Destructive git, SQL without a WHERE clause, curl piped to bash and unauthorised sudo are held or blocked without configuration. Held actions wait for approval inside the agent conversation, and the agent is told why an action was stopped.
Is node9-proxy free to use? What license does it have?
node9-proxy is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is node9-proxy still maintained?
Actively maintained. The last commit to node9-proxy was on Nov 6, 2026.
What can I use node9-proxy for?
Running Claude Code or Cursor on a laptop that holds cloud credentials and SSH keys. Limiting which MCP servers and tools an agent can call in a team setup. Reviewing risky database or shell commands before an agent executes them. Scanning GitHub Actions workflows for paths that could let outsiders hijack an agent.
How do I install node9-proxy?
Install node9 globally with npm: npm install -g node9-ai Run node9 in your project to choose dashboard or local protection setup: node9 Check how exposed this machine is with the posture score: node9 posture
Where can I get node9-proxy?
The source code and installation instructions are on GitHub: https://github.com/node9-ai/node9-proxy

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects