TL;DR - npx node9-ai scan reads your existing Claude / Cursor / Codex / Gemini sessions and shows a security score in 10 seconds. No install, no signup. If the score scares you, node9 init wires live protection.

Your AI agent has read 47 files today. It tried to run 3 commands you'd have blocked. You found out because of this blog post - not because anything broke.

This is the 10-minute path from "I have an AI agent" to "I know what it's doing and the dangerous things are blocked." Three commands cover 90% of the value:

npx node9-ai scan      # see what your agents already did
node9 init             # protect future sessions
node9 doctor           # verify it's wired correctly

Below: each command, what it does, and how to read what it shows.

Step 1 - Scan your existing history (3 minutes)

npx node9-ai scan

What it does: reads the JSONL session files Claude Code, Codex, Gemini CLI, and Cursor already write to your disk. Runs entirely local - no install, no signup, no network calls. Takes about 10 seconds.

Reading the output. The scan prints a panel dashboard ordered by severity - Critical → High → Medium → Recommended action - so the worst stuff is at the top:

node9 dashboard  ·  scanned last 90 days
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Spend & activity ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
╭─────────────────────────────────────╮ ╭─────────────────────────────────────╮
│ COST                                │ │ ACTIVITY                            │
│ Total           $16.7K              │ │ Sessions        42                  │
│ Claude          $16.6K              │ │ Tools           16,508              │
│ Gemini          $2.32               │ │   Shell         8,027               │
│ Codex           $29.20              │ │ Tools / session ~393                │
│ Wasted on loops ~$0.22              │ │ Cost / session  ~$397               │
│                                     │ │ Top agent       Claude (31)         │
╰─────────────────────────────────────╯ ╰─────────────────────────────────────╯
━━━━━━━━━━━━━━━━━ Critical (5 secrets leaked + 3 ops blocked) ━━━━━━━━━━━━━━━━━━
╭─────────────────────────────────────╮ ╭─────────────────────────────────────╮
│ CREDENTIAL LEAKS                    │ │ WOULD HAVE BLOCKED                  │
│  21d JWT          [Bash]      clau… │ │ ✗ block-read-env×1 needs shield:pr… │
│  15d Bearer Token [Bash]      clau… │ │ ✗ block-read-ssh×1 needs shield:pr… │
│   8d GitHub Token [Bash]      clau… │ │ ✗ block-eval-rem…×1  needs shield:… │
│   4d GitHub Token [Bash]      clau… │ │ → install node9 + enable shields a… │
│ → DLP · node9 mask  (runtime + cl…) │ │                                     │
╰─────────────────────────────────────╯ ╰─────────────────────────────────────╯
━━━━━━━━━━━━━━━━━━━━━━━ High (5 paths reachable on disk) ━━━━━━━━━━━━━━━━━━━━━━━
╭──────────────────────────────────────────────────────────────────────────────╮
│ BLAST RADIUS                                                                 │
│ ✗  ~/.ssh/id_rsa                       RSA private key                       │
│ ✗  ~/.ssh/id_ed25519                   Ed25519 private key                   │
│ ✗  ~/.config/gcloud/credentials.db     Google Cloud credentials              │
│ ✗  ~/.npmrc                            npm auth token                        │
│ → project-jail shield blocks agent reads of these paths                      │
╰──────────────────────────────────────────────────────────────────────────────╯
━━━━━━━━━━━━━━━ Medium (46 ops flagged · 393 loops · 20% wasted) ━━━━━━━━━━━━━━━
╭─────────────────────────────────────╮ ╭─────────────────────────────────────╮
│ REVIEW QUEUE                        │ │ AGENT LOOPS                         │
│ review-git-destructive×23   default │ │ Edit      ×2,663        79%         │
│ review-sudo           ×13   default │ │ Bash      ×658          20%         │
│ review-force-push     ×5    default │ │ Write     ×51           2%          │
│ review-read-c… ×3 needs shield:pro… │ │ Top stuck:                          │
│ review-chmod-7…×1  needs shield:fi… │ │ ×126   …/src/cli/commands/scan.ts   │
│ → runtime approval                  │ │ → live loop-detector                │
╰─────────────────────────────────────╯ ╰─────────────────────────────────────╯
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Recommended action ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
╭──────────────────────────────────────────────────────────────────────────────╮
│ SHIELDS                                                                      │
│ project-jail    catches 5 ops       → +53 pts (25 → 78)                      │
│ bash-safe       catches 1 op                                                 │
│ filesystem      catches 1 op                                                 │
│ github          catches 1 op                                                 │
│ aws · docker · k8s · mongodb · postgres · redis  (no hits - install proacti…)│
│ → node9 shield enable project-jail   (start here - +53 pts)                  │
╰──────────────────────────────────────────────────────────────────────────────╯

What each panel means:

Spend & activity - total agent cost and tool-call volume across all your sessions, broken down by agent. "Wasted on loops" is the dollar value of redundant tool calls (agent re-edited the same file N times instead of moving on).
Credential leaks - plaintext secrets found in your local session text. The number on the left is how long ago the leak happened. Treat any non-zero count as a key-rotation event.
Would have blocked - dangerous tool calls Node9 would have prevented if installed. Each entry points at the specific shield that catches it.
Blast radius - credential files an agent could read right now. SSH keys, GCP / AWS credentials, npm publish tokens, .env files in $PATH. Reachability is the current state of your disk, not what's already happened.
Review queue - operations that triggered review-level rules (destructive git, sudo, chmod 777). The "×N" is how many times the pattern fired.
Agent loops - by tool type, what percentage of your tool calls are repeats on the same target. "Top stuck" names the file the agent got stuck on the most.
Recommended action - shields ranked by how many of your existing findings they'd catch + the projected score lift. Start with whichever buys you the most points.

Drilling into specific findings

node9 scan --compact          # one-screen summary for sharing or tweeting
node9 scan --drill-down       # per-finding detail with file paths and timestamps
node9 scan --narrative        # condensed severity-tier scorecard

If you found credentials in your scan, rotate them immediately and run:

node9 mask                    # redact plaintext secrets from local session files

This rewrites the JSONL files in place to redact found secrets. The agent loses the secret from its context. The file on disk no longer leaks.

Step 2 - Install for live protection (3 minutes)

# macOS or Linux via Homebrew
brew tap node9-ai/node9 && brew install node9

# or via npm (any platform)
npm install -g node9-ai

# Then wire it into your existing AI agents
node9 init

What node9 init does: detects which AI agents you have installed (Claude Code, Codex, Copilot CLI, Gemini CLI, Antigravity, Hermes, OpenCode, Pi, Cursor, Windsurf, VS Code, Claude Desktop, plus MCP servers in your config), and wires Node9 into each:

Claude Code, Codex, Copilot CLI, Gemini CLI, Antigravity, Hermes - a pre-execution hook that runs Node9's policy check before every tool call
OpenCode, Pi - a node9 plugin that does the same job inside the agent
Cursor, Windsurf, VS Code, Claude Desktop - these expose no hook API, so Node9 wraps the MCP servers in their config and sees those tool calls, and nothing the editor does on its own
Generic MCP servers - adds the Node9 stdio proxy as the entry point; the agent connects to Node9 which forwards (filtered) to the upstream server

After init:

node9 doctor

doctor verifies everything is wired correctly. Output should look like:

✓ Claude Code hook installed at ~/.claude/settings.json
✓ Codex MCP gateway configured
✓ Gemini CLI hook installed
✓ Audit log writable at ~/.node9/audit.log

If any line shows ✗, run node9 heal <agent> to reinstall a hook an agent update wiped, or re-run node9 init.

Step 3 - Enable shields (2 minutes)

Shields are curated rule sets for specific services. Each is opt-in. The starter set you probably want:

node9 shield enable project-jail  # blocks reads of ~/.ssh, ~/.aws, .env outside project root
node9 shield enable bash-safe     # blocks curl|bash, rm -rf /, eval of remote, disk overwrite
node9 shield enable github        # blocks gh repo delete, reviews remote branch deletion

For service-specific shields, enable based on what your agents use:

node9 shield enable postgres      # DROP TABLE, TRUNCATE, DELETE without WHERE
node9 shield enable mongodb       # dropDatabase, drop(), deleteMany({})
node9 shield enable redis         # FLUSHALL, FLUSHDB, CONFIG SET
node9 shield enable aws           # S3 delete, EC2 terminate, IAM changes
node9 shield enable k8s           # blocks namespace delete, delete --all, helm uninstall
node9 shield enable docker        # system prune, volume prune, rm -f containers
node9 shield enable filesystem    # reviews chmod 777 and writes under /etc/
node9 mcp pin list                # pinned MCP tool definitions (rug-pull defense)
node9 mcp gateway --all           # route every MCP server through node9

To see what's enabled and what each one catches:

node9 shield list

Approval mode (optional tweak)

Default policy is sensible - prompt for risky calls, block clearly destructive ones. To override:

node9 init -m strict              # block-by-default; allowlist what you trust
node9 config show                 # the effective config, every layer resolved

Step 4 - The credential jail and egress

The jail is on by default: reads of ~/.ssh, ~/.aws and .env files are blocked before they happen, from any shell reader. Add your own paths, and decide where the agent may send data:

node9 jail add ~/work/secrets   # block reads under this path too
node9 egress watch              # prompt before the agent reaches an unknown host
node9 egress lock               # or block unknown hosts outright

Egress is off until you turn it on, and it gates destinations, not payloads; a secret inside a request to an allowed host is DLP's job. node9 explain Bash 'cat ~/.ssh/id_rsa' shows the verdict without running anything.

Step 5 - See what's happening (anytime)

node9 tail                # live stream of every tool call going through Node9
node9 report              # summary by period (today, this week, this month)
node9 sessions            # session history with prompts, tool traces, costs
node9 blast               # what an AI agent could reach right now (files, creds, env)
node9 dlp                 # credential leak findings in agent response text

The HUD also shows in your Claude Code statusline:

🛡 node9 | standard | [bash-safe] | ✅ 12 allowed  🛑 2 blocked  🚨 0 dlp | ~$0.43

node9 monitor opens the live interactive dashboard in your terminal.

Common scenarios

"My agent tried to force-push and Node9 blocked it. Now what?"

The agent gets a structured error back (blocked: force-push to shared branch). The negotiation loop kicks in - the agent rephrases (e.g., proposes git push --force-with-lease instead, or asks you to confirm). You can also run node9 audit --deny --tail 20 to see the exact commands that were blocked.

"Node9 keeps asking me about every git push. Tedious."

Promote frequent-allows to "always allow":

node9 decisions list             # persistent always-allow / always-deny per tool
node9 trust add github.com       # trusted network destinations

Or write a smart rule in node9.config.json:

{
  "rules": [{ "pattern": "git push origin feat/.*", "action": "allow" }]
}

"An MCP server changed its tools between sessions and Node9 quarantined it."

Run node9 mcp pin update <serverKey>. Review the diff. If the change is legitimate, re-pin. If not, remove the server.

"My agent loaded a credential as plaintext into its context. Help."

Rotate the credential immediately
Run node9 mask to redact local session files
Run node9 shield enable project-jail to prevent future credential reads

Three commands, ~10 minutes, fully open-source. If your scan landed below 50, you're in good company - most heavy AI users do. The point isn't the number; the point is now you know.

Run your scan. Tweet your score with #node9. We'll send a printable scorecard for anything below 40.

Repo: github.com/node9-ai/node9-proxy
Docs: node9.ai/docs

Questions? Open an issue or DM. We're at design-partner stage; every team using it shapes what ships next.

Related posts

Structure or Text: Two Ways to Read a Command, and Why We Needed Both

What Can a Hijacked AI Agent Actually Reach on Your Machine?

The Gate and the Wall: When to Run Your Agent Native vs. Sandboxed with node9