Help & Support · node9 documentation
Help & Support
Get unstuck quickly.
Frequently Asked Questions
Does Node9 send my AI agent's conversation to the cloud?
Not in local mode. Node9 evaluates the concrete tool call parameters — tool name and arguments — and does not transmit conversational context or AI-generated prose to any remote service. The Response DLP scanner does read Claude's local JSONL conversation history on disk to flag secrets in model output, but that scan stays on your machine. Cloud mode (node9 login <key>) only streams intercept metadata for tool calls, never the conversation.
What is the difference between local mode and cloud mode?
Local mode (node9 login --local) sets approvers.cloud to false, keeping all policy decisions on your machine — nothing is sent to the cloud. Cloud mode (node9 login <key>) sets approvers.cloud to true, streaming intercept events to Mission Control and allowing your policy to be managed centrally from the Cloud Policy Studio. Cloud mode is opt-in.
My agent is being blocked too aggressively. What should I do?
Check your dangerousWords list first — overly broad keywords cause false positives. Also review ignoredTools: add the tool names your agent uses for read-only operations so they pass through without inspection. Run node9 status to confirm which config file is active, and node9 explain <tool> '<args-json>' to see exactly which rule fires.
How do I use Node9 with multiple AI agents (Claude + Gemini) on the same machine?
Run node9 addto claude and node9 addto gemini separately (or run node9 setup to do both interactively). Both agents will share the same Node9 policy config. If you need different policies per agent, create separate project directories each with their own node9.config.json, and use NODE9_API_KEY or named profiles to assign different workspaces.
What is the config hierarchy? Which file takes priority?
Node9 merges per-field across layers — it does not pick a single winning file. Layers from lowest to highest precedence: 1) hardcoded defaults, 2) ~/.node9/config.json (global), 3) ./node9.config.json (project), 4) active shields (~/.node9/shields.json), 5) Cloud Policy Studio (when approvers.cloud is enabled). Most fields are merge-or-additive (smartRules, sandboxPaths, ignoredTools, toolInspection); dangerousWords replaces rather than merges. See the Configuration section for the full per-field merge table.
How do I check what Node9 is doing right now?
Run node9 status for current mode, active profile, connected workspace, and audit-event counts. node9 audit prints the formatted audit trail; node9 tail streams every tool call live; node9 report summarizes allowed/blocked/DLP/cost over a time window. The raw log is at ~/.node9/audit.log.
Can I run Node9 without a cloud account?
Yes. Run node9 login --local to set approvers.cloud to false. Node9 will enforce your local config policy, write an audit log to ~/.node9/audit.log, and never connect to the cloud. You can also install and use node9 setup / node9 addto without ever running node9 login.
Does Node9 work with Cursor, Windsurf, or other coding assistants?
Yes. Node9 ships dedicated wiring for Claude Code, Gemini CLI, Cursor, Codex, Windsurf, and VS Code — run node9 addto <agent> to register it. For any other MCP-compatible tool, register the Node9 MCP server manually with command `node9` and args `["mcp-server"]` in that tool's MCP settings, or wrap an existing MCP server with `node9 mcp-gateway --upstream "..."`.