Badges · node9 documentation

Badges

Drop-in markdown for showing that a project's agent-security surface is checked by node9 on every pull request.

Two badges ship. One is for any project that runs the node9 Action. The other is reserved for node9's own repository, because the claim it makes is only honest there.

scanned by node9

scanned by node9

It says that the repository's committed agent configuration, meaning CI workflows, agent settings, MCP servers and instruction files, is inspected on every pull request, and it links a reader back to node9 so they can judge what the badge is worth.

Only display it if the check actually runs
The honest CI wiring is the signal and the badge is only a surface for it. A badge on a repository that does not run the check is misleading, and it devalues the badge for everyone who does.
The minimum wiring
# .github/workflows/agent-security.yml
name: node9 agent-security
on: pull_request
permissions:
  contents: read
  pull-requests: write
  checks: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: node9-ai/node9-proxy@v2
        with:
          fail-on: high # 'never' to comment without gating
fail-on: never still counts as running the check: the badge claims the surface is inspected, not that merges are blocked.

Copy the markdown

[![scanned by node9](https://img.shields.io/badge/scanned%20by-node9-a855f7?style=flat&labelColor=%231A1A2E&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNCAxNCI+PHBhdGggZmlsbD0iI0Y1RTlGRiIgZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik03IDAuNCAxLjYgMi41djQuMmMwIDMuMSAyLjMgNS42IDUuNCA2LjkgMy4xLTEuMyA1LjQtMy44IDUuNC02LjlWMi41TDcgMC40Wm0wIDEuNSAzLjkgMS41djMuM2MwIDIuMy0xLjYgNC4yLTMuOSA1LjMtMi4zLTEuMS0zLjktMy0zLjktNS4zVjMuNEw3IDEuOVptMCAyLjJhMS45IDEuOSAwIDAgMC0xIDMuNXYxLjZoMlY3LjZhMS45IDEuOSAwIDAgMC0xLTMuNVoiLz48L3N2Zz4K)](https://github.com/node9-ai/node9-proxy)

Put it with the other status badges at the top of the README. It follows the standard shields.io layout, so it sits cleanly beside CI, coverage and licence badges. Link it to the node9 repository so a reader can click through and find out what it asserts; linking to your own passing run instead is also fine.

node9 self-scanned

node9 self-scanned

Reserved for node9's own repository. It says that node9 runs its own Action against its own source on every pull request and gates merges on the result, and it links to the workflow that does it so the claim is checkable in one click. On any other project, use the badge above: this wording is only honest here.

Brand

PartValue
Label background#1A1A2E
Message background#a855f7
LogoA shield glyph in #F5E9FF, inlined as an SVG data URI

shields.io renders an inlined SVG verbatim rather than tinting it, so the fill is baked into the glyph. Do not change the colours or substitute a different logo. The consistency is the point: a badge is only recognisable if it looks the same everywhere.