Your AI agents can reach Slack, GitHub, email.
And your database.
You decide what your AI agents can do. node9 enforces it before they act. Allow, review, or block each tool call, with every decision on the record.
Your agent works. node9 decides each call.
A real agent task. Every tool call goes to node9 first: allowed, blocked, or held for you.
Jump to a moment
See where your agents have access.
Start with a public repository or check the machine you work on.
Scan a repository
30s · in your browserWhat a repository lets an AI agent do: hijackable workflows, secrets in reach, poisoned instruction files.
Scan your machine
60s · runs locallyWhat a compromised agent could read, reach and run on this machine, scored 0 to 100.
Then to audit what your agents already did. Nothing leaves the machine.
Free scans. No account required.
Explore the open-source CLI- Listed in awesome-ai-security-tools
- OpenSSF Best Practices
- Mapped to the OWASP agentic threat list
- Every pull request scanned by node9
Claude Code at work, node9 in front of every call.
It builds a page. It reaches for the cloud metadata address and node9 blocks it. The work goes on, and a permanent delete waits for your approval, right in the conversation.
A popup on one laptop doesn't govern a fleet.
Your agents run in CI, in the cloud, and on every teammate's machine. The platform is what makes governing all of them possible.
One approval queue
Every risky action, from any agent, on any surface, lands in a single queue and routes to whoever's on call, in Slack or on their phone. No popup nobody's there to click.
Panic mode, org-wide
One switch freezes every agent across every workspace: all actions blocked, the instant something looks wrong. You can't kill twenty laptops by hand.
Your CLI already feeds it
The local node9 on every machine streams its audit to your workspace via Cloud Sync. Security sees what every agent did without SSHing into a single box.
Every project, one glance
A live card per workspace: calls today, active rules, agents, and a pending-approval badge or panic-mode banner the moment it matters.
One tool, every agent, local, CI & cloud
Every tool call passes node9 first.
node9 sits where the agent stops before it acts. It checks the call on your machine, decides, and records the decision.
- Which file is it reading?Credential jail
- Is there a secret or personal data in the call?DLP
- What does the command do, and how risky is it?Shields
- Where is it sending data?Egress and SSRF
- Which MCP tool is it calling, and has the tool changed?MCP pinning
- Install. node9 connects to each agent at the point where it stops before acting.
- Every call is checked before it runs, on your machine: files, secrets, commands, destinations and tools.
- node9 decides: allow, block, or ask you. A blocked agent gets the reason and carries on another way.
- Everything is recorded, and
node9 explainshows why any rule fired.
Start free. Govern as you grow.
Free
Just you, the full product, on your own machine.
- Posture score + history scan
- Full local protection, rules, credential jail, DLP/PII, egress
- Per-tool MCP permissions (your machine)
- Disposable sandbox · native approvals
- Dashboard for one · 30-day audit
Team
Your team, one dashboard governs every machine.
- Everything in Free, for your team of up to 5
- Managed policy + MCP permissions across the fleet
- One source of truth, synced to every machine
- Slack / team approval routing
- 90-day audit logs
Business
Prove it, and hit the brakes.
- Everything in Team, for up to 25
- Panic mode (kill switch)
- Shadow mode, pilot policy before you enforce
- Audit export (CSV / JSON)
- Weekly team security digest
Enterprise
Security & compliance orgs.
- Unlimited members & API Keys
- SSO (Okta / SAML)
- Central audit export across the fleet
- VPC / on-prem deployment
- Multi-admin quorum approval
- Dedicated support & SLA
Govern every agent your team runs.
Create a workspace to see the platform on your fleet, or start free on your laptop in 60 seconds.
npm install -g node9-ai