Agentic Threat Coverage · node9 documentation

Agentic Threat Coverage

Where node9 sits against the ten threats in OWASP's Top 10 for Agentic Applications, with the evidence, and with the gaps.

4 strong4 moderate2 partial0 out of scope
ASI01Agent Goal HijackPartial

Content arriving from a tool is scanned before the agent acts on it, and what a tool returns is checked for secrets on the way back.

Response scanning on the return path. Prompt scanning on Claude Code, Codex, Copilot CLI, OpenCode and Pi.

The injection detector ships inactive and warns rather than blocks when enabled. Turning it on is a setting, not a release.

ASI02Tool MisuseStrong

Every tool call is parsed into its structure before it runs, so policy can allow one form of a command and refuse another rather than matching text. Each MCP server carries its own permissions.

Fifty-seven rules in ten bundles. Six governance handles over specific command shapes, two of which an admin may only tighten. Per-server permissions that only a person can grant.

ASI03Identity and Privilege AbuseStrong

Every decision is attributed to an agent, a person and a machine. Credential files are refused with nothing configured, and the cloud metadata address cannot be reached whatever the policy says.

Nine agents wired with identity. The credential jail and the metadata floor are always on with no switch. Fifty-eight named provider credentials checked in every tool argument.

ASI04Supply Chain VulnerabilitiesModerate

The agent surface committed to a repository is scanned before anything runs: unpinned MCP servers, tokens in settings files, hooks that fetch and run remote code, and instruction files carrying a payload.

node9 scan-repo, with --base to report only what a change introduced. Skill pinning refuses a skill file that changed since you pinned it.

The script a hook points at is not read, and skills and subagents are not pulled in. Skill pinning ships inactive.

ASI05Unexpected Code ExecutionModerate

Commands are understood rather than matched, so an inline execution or a dynamic eval is recognised as what it is and not as a string that happens to contain a word.

Inline execution and eval detection. Pipe chains are analysed as a whole rather than stage by stage.

node9 reads the call the agent made. It does not read the contents of a script that call runs, nor the subprocesses that script spawns.

ASI06Memory and Context PoisoningModerate

Instruction files an agent loads without being asked are checked for concealed characters and for a fetch piped into a shell, and a session that has touched untrusted content carries that forward.

Instruction file checks in scan-repo. Session taint tracked and clearable. Skill pinning notices a file that changed.

A file a person attaches to the conversation never becomes a tool call, so nothing here sees it.

ASI07Insecure Inter-Agent CommunicationPartial

Traffic to MCP servers passes through a gateway, each server has its own permissions, and a tool description that changes after you approved it is noticed.

MCP gateway and MCP server. Per-server permissions. Detection of a tool description that changed mid-session.

No signing of messages between agents, and no scanning of a server's response before the agent reads it.

ASI08Cascading FailuresModerate

An agent repeating the same call is cut off before it becomes a bill, and one switch stops every agent in the organisation at once.

The loop cut-off refuses the fifth identical call inside the window, before policy is consulted. Panic mode blocks every action across every workspace.

There is no spend ceiling. What is stopped is a runaway loop, not a rising total.

ASI09Human and Agent Trust ExploitationStrong

A refused action is not a dead end: node9 returns the reason and the agent tries another way, so a person is not trained to approve things simply to make work continue. When a human is needed, four channels race and the first answer resolves it, including a teammate answering from the dashboard.

Four approval channels plus approval inside the agent's own conversation. Persistent Always Allow decisions are listed and revocable. Every decision recorded with its arguments and outcome.

node9 pause approves everything for its duration. It is recorded, and it is the one control that turns the rest off.

ASI10Rogue AgentsStrong

What an agent can reach is bounded, what it already reaches is mapped, and a planted decoy proves a read happened even when nothing else saw it.

Destination allowlist plus a metadata floor with no off switch. node9 blast maps current reach. Decoy credentials that are worthless to whoever takes them. Panic mode across the fleet.

Why four of these say Moderate and two say Partial
A table that reads Strong all the way down is an advertisement. Each grade here is what was measured, and the gap under each one is the honest half: a detector that ships off, a script whose contents are not read, a spend total that is not capped, a file a person attaches by hand. They are written here because anyone evaluating a security tool will find them anyway, and finding them in our own document is a different experience from finding them after we said otherwise.

Every count on this page is read from the shipped defaults, the rule bundles and the governance handles rather than asserted. Coverage was measured against node9 2.13.0.