Agentic Threat Coverage · node9 documentation
Agentic Threat Coverage
Where node9 sits against the ten threats in OWASP's Top 10 for Agentic Applications, with the evidence, and with the gaps.
Content arriving from a tool is scanned before the agent acts on it, and what a tool returns is checked for secrets on the way back.
Response scanning on the return path. Prompt scanning on Claude Code, Codex, Copilot CLI, OpenCode and Pi.
The injection detector ships inactive and warns rather than blocks when enabled. Turning it on is a setting, not a release.
Every tool call is parsed into its structure before it runs, so policy can allow one form of a command and refuse another rather than matching text. Each MCP server carries its own permissions.
Fifty-seven rules in ten bundles. Six governance handles over specific command shapes, two of which an admin may only tighten. Per-server permissions that only a person can grant.
Every decision is attributed to an agent, a person and a machine. Credential files are refused with nothing configured, and the cloud metadata address cannot be reached whatever the policy says.
Nine agents wired with identity. The credential jail and the metadata floor are always on with no switch. Fifty-eight named provider credentials checked in every tool argument.
The agent surface committed to a repository is scanned before anything runs: unpinned MCP servers, tokens in settings files, hooks that fetch and run remote code, and instruction files carrying a payload.
node9 scan-repo, with --base to report only what a change introduced. Skill pinning refuses a skill file that changed since you pinned it.
The script a hook points at is not read, and skills and subagents are not pulled in. Skill pinning ships inactive.
Commands are understood rather than matched, so an inline execution or a dynamic eval is recognised as what it is and not as a string that happens to contain a word.
Inline execution and eval detection. Pipe chains are analysed as a whole rather than stage by stage.
node9 reads the call the agent made. It does not read the contents of a script that call runs, nor the subprocesses that script spawns.
Instruction files an agent loads without being asked are checked for concealed characters and for a fetch piped into a shell, and a session that has touched untrusted content carries that forward.
Instruction file checks in scan-repo. Session taint tracked and clearable. Skill pinning notices a file that changed.
A file a person attaches to the conversation never becomes a tool call, so nothing here sees it.
Traffic to MCP servers passes through a gateway, each server has its own permissions, and a tool description that changes after you approved it is noticed.
MCP gateway and MCP server. Per-server permissions. Detection of a tool description that changed mid-session.
No signing of messages between agents, and no scanning of a server's response before the agent reads it.
An agent repeating the same call is cut off before it becomes a bill, and one switch stops every agent in the organisation at once.
The loop cut-off refuses the fifth identical call inside the window, before policy is consulted. Panic mode blocks every action across every workspace.
There is no spend ceiling. What is stopped is a runaway loop, not a rising total.
A refused action is not a dead end: node9 returns the reason and the agent tries another way, so a person is not trained to approve things simply to make work continue. When a human is needed, four channels race and the first answer resolves it, including a teammate answering from the dashboard.
Four approval channels plus approval inside the agent's own conversation. Persistent Always Allow decisions are listed and revocable. Every decision recorded with its arguments and outcome.
node9 pause approves everything for its duration. It is recorded, and it is the one control that turns the rest off.
What an agent can reach is bounded, what it already reaches is mapped, and a planted decoy proves a read happened even when nothing else saw it.
Destination allowlist plus a metadata floor with no off switch. node9 blast maps current reach. Decoy credentials that are worthless to whoever takes them. Panic mode across the fleet.
Every count on this page is read from the shipped defaults, the rule bundles and the governance handles rather than asserted. Coverage was measured against node9 2.13.0.