SkillFoxx

node9 CLI

Access control for agents: rules for what Claude Code, Codex, Cursor and MCP servers may do, review of risky actions before they run, and one audit log

  • 225 ★ on the repository
  • Last commit
  • Apache-2.0
CLI

Extended access

Why this level

  • It embeds into agent hooks and intercepts tool calls
  • It reads configuration, session history and secret paths, and can send a summary to the cloud dashboard
All reasons and checks

node9-ai/node9-proxyAuthor:node9

Install

Manual install

npx node9-ai scan

Checks the machine without installing, nothing is uploaded. A way to assess risk before adopting.

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • It embeds into agent hooks and intercepts tool calls
  • It reads configuration, session history and secret paths, and can send a summary to the cloud dashboard

This is third-party code. Review the repository files before installing.

What it does

node9 sits between the agent and every tool it calls and decides whether to pass an action or hold it. Protection of sensitive paths is on by default: a read of files like ~/.ssh, ~/.aws or .env is stopped, the agent is told why, and the decision comes to you. Commands are parsed as a syntax tree, so wrapping does not bypass a rule. It also scans the machine and repositories for weak spots, shields dangerous database operations, wraps MCP servers, and can run the agent inside an isolated container. Every decision lands in an audit log.

Who it is for. For developers and devops who give agents access to files, databases and services and want to keep it under control.

Good fit when

  • You need to limit what an agent may do with files, commands and MCP servers
  • You want to see and approve risky actions before they run
  • You need one audit log of agent actions for review

Not a fit when

  • You do not give agents access to sensitive data and systems
  • You are not ready for an extra interception layer in the workflow
  • You need the team features with a cloud dashboard but want local-only

Example request

Check this machine for risks if the agent is compromised and enable protection of sensitive paths

Limitations

The base command parsing covers the shell and does not close every leak path; the authors state the limits plainly. Isolated runs need Docker and are aimed first at Claude in the early phase. Team features, the fleet dashboard and audit export belong to the paid node9 Pro and its cloud. Local checks and protection run on your machine.

How to disable. Disconnect the machine with node9 logout, remove the wrappers via node9, and uninstall the node9-ai package if installed via brew or npm.

FAQ

How does node9 stop an action?

It runs in the agent's hook: a held action does not run until you answer, even if the agent was started with permission checks skipped.

Do I need an account?

Local checks and protection work without sign-in. An account and the cloud are for the team dashboard, fleet log and part of node9 Pro.

Discussion

No questions or reviews yet.

CLI tools

A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan

CLIBroad access392

cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials

CLIExtended access4.9K

A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail

CLIExtended access523

An MCP memory server for agents plus a free gate that stops dangerous commands before they run

MCP serverBroad access660

AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F

CLIExtended access1.4K

Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls

CLIBroad access74

README in short

The README opens with a real supply-chain compromise where installed agents were run with protections off and drained keys. node9 is offered as a gate between the agent and tools: default protection of sensitive paths, tree-based command parsing, database shields, MCP wrapping and isolated container runs. It shows commands to check the machine and repositories, an interactive monitor dashboard and an audit log of decisions. Install via brew or npm, with a GitHub Action and a Python SDK, and a separate paid node9 Pro. Apache-2.0 licensed.

README badge

Report a problem