node9 with Claude Code

Control modelhooks + MCPSees every tool callyesPrompt scanningyes

node9 sees every tool call Claude Code makes, through a pre-execution hook, and governs its MCP servers too. A risky action is allowed, sent to you for review, or blocked before it runs.

Claude Code is the most fully covered agent.

SurfaceHow node9 is wiredWhat it does
Every tool callPreToolUse hook in ~/.claude/settings.jsonallow / review / block before the tool runs
Every tool resultPostToolUse hookwrites the audit record
Pasted promptsUserPromptSubmit hooksecret pasted into the prompt is caught before it is sent
MCP serversentries in ~/.claude.json are wrapped through the node9 gatewayper-tool allow / review / block
Costreads ~/.claude/projects session logsper-project spend in node9 report

The PreToolUse hook runs in every Claude Code permission mode, including --dangerously-skip-permissions. That was verified with a standalone probe, and it is undocumented behaviour, so treat it as a fact about today's Claude Code rather than a guarantee.

Set it up

node9 agents add claude

node9 init does this for every agent it detects on the machine. Either command is safe to re-run; it repairs a hook that an agent update removed and leaves everything else alone.

What is not covered

  • Tool output is observed, not gated. Claude Code's PostToolUse cannot suppress a result, so a secret or an injected instruction inside a tool result is recorded and the session is tainted for review on the next call; it is not stripped before Claude sees it.

Verify it on this machine

node9 doctor                                   # is the hook (or MCP wrap) actually in place?
node9 explain Bash 'cat ~/.ssh/id_rsa'         # shows the verdict the live hook enforces: BLOCK

node9 explain prints the exact rule that fires and where the decision came from. If doctor says the agent is not wired, the guard is not running, whatever the config looks like.

Every agent, side by side

node9 wires into twelve agents and the depth differs. The coverage matrix shows all of them in one table, including which ones node9 cannot see the shell of.