What is Node9?

A security proxy that inspects every AI tool call before it runs.

Think of Node9 as sudo for AI agents. You define the rules once, and every agent on your machine operates within those boundaries automatically: through a pre-execution hook where the agent has one, and through MCP for every MCP server.

Every tool call an agent attempts, running a shell command, editing a file, hitting an API, passes through Node9 first. Node9 checks it against your policy and either allows it, flags it for human review, or blocks it. No code changes to your agent; it just works.

Where the line falls: Node9 governs what the agent does. It does not govern what a person hands the agent. A file you attach to a conversation yourself reaches the model without ever becoming a tool call, so no rule here sees it.

Execution InterceptionCore

Node9 evaluates the concrete command that is about to run, not the model's description of it. On agents that expose a pre-execution hook that is where it sits; on the ones that do not, it governs what goes through their MCP servers.

Policy You Wrote DownPolicy

Define safe zones, block dangerous verbs, or require explicit human approval for destructive commands. Configured in plain JSON, so the rule that fired can be read afterwards rather than inferred.

AI Negotiation LoopSmart

When an action is blocked, Node9 doesn't just crash. It sends a structured explanation back to the AI, instructing it to pivot to a safer alternative.

Universal Agent SupportUniversal

Pre-execution hooks for Claude Code, Codex, Copilot CLI, Gemini CLI, Antigravity and Hermes; a plugin for OpenCode and Pi; MCP governance for Cursor, Windsurf, VS Code and Claude Desktop, which expose no hook API. See each agent's page for what is and is not covered.

Permissions Per ServerApps

Every MCP server the agent talks to gets its own permissions, rather than one setting covering all of them. A server can be allowed to read and refused everything else, and only a person can grant that.

Rules That Ship With ItShields

Ten bundles carrying fifty-seven rules for the things agents actually break: cloud infrastructure, containers, clusters, databases, repositories and the filesystem. Turn on the ones that match what you run.

Where It Can ReachNetwork

The cloud metadata address and the link-local range are refused with nothing configured and no way to turn that off. Beyond the floor, an allowlist decides which destinations the agent may reach at all.

What Leaves In A Tool CallContent

Fifty-eight named provider credentials, from AWS and GitHub keys to Vault tokens and database connection strings, checked in every tool argument and in what comes back. Personal data detection sits beside them, off until you want it.

Decoy CredentialsCanary

A fake key planted on disk that is worthless to whoever takes it and conclusive to you. Every other control asks whether something should be allowed. This one tells you a read already happened, whichever path it took.

What It Cost, In MoneyCost

Five providers priced in dollars rather than token counts, attributed to a person, an agent and a machine. Subscriptions are deducted from usage, so the number is what was actually paid.

Set Once, For Every MachineTeam

Twenty-three settings an admin decides for the whole fleet, one dashboard covering every machine as part of the product rather than a paid tier, and a teammate who can answer a review instead of the person at the keyboard.

Full Audit TrailAudit

Every intercept, allowed, reviewed, or blocked, is recorded locally at ~/.node9/audit.log and optionally in Mission Control.

The Simple Model

AI Agent → makes a tool call → Node9 Proxy → checks your policy → Allow / Review / Block → result returned to agent

What is Node9? · node9 documentation

What is Node9?