Repository Scanning

The agent surface committed to a repository: workflows, agent settings, MCP servers and instruction files.

This is a different question from everything else in these docs. Nothing is running yet. What is being checked is the configuration a pull request can change without anyone reading it closely: a workflow that feeds a stranger's text to an agent that holds secrets, an unpinned MCP server, a token sitting in a settings file, an instruction file carrying a payload.

Scan one

node9 scan-repo .
node9 scan-repo https://github.com/org/repo

A local path or a GitHub URL. The same checks either way.

Machine output

node9 scan-repo . --json
node9 scan-repo . --markdown

JSON for a pipeline, Markdown when the destination is a pull request comment.

Each run sends node9 an anonymous usage count: the node9 version, the operating system, whether it ran from a terminal, a CI job or the Action, whether the target was a URL or a local path, the worst severity found, whether the scan finished, and either a random install ID (from a terminal) or a hash of the repository's numeric GitHub id (in GitHub CI and the Action). node9 keeps the ID and the hash only inside a count. It never sends the repository name, a path, a finding or any code. Set NODE9_NO_TELEMETRY=1 (or DO_NOT_TRACK=1) to turn it off.

Gating a pull request on what it introduced

A scan that reports every finding in a repository is not useful on a pull request, because the author did not write most of them and cannot act on them. What a reviewer is actually asking is narrower.

New findings only

node9 scan-repo . --base origin/main
node9 scan-repo . --base origin/main --fail-on-introduced

--base scans that ref as well and reports what the working tree introduced on top of it. --fail-on-introduced exits non-zero only for those, so a build fails for what this change added and not for what it inherited.

Add it to your CI

One workflow file, and every pull request gets the scan as a check, a sticky comment listing the findings, and annotations on the lines that caused them. The Action checks the repository out itself and needs no secret: the job token it already has is enough to comment.

.github/workflows/agent-security.yml

name: node9 agent-security
on: pull_request
permissions:
  contents: read
  pull-requests: write
  checks: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: node9-ai/node9-proxy@v2
        with:
          fail-on: high            # never | medium | high | critical
          fail-on-scope: introduced # judge only what this PR added or made worse

fail-on is the severity that fails the check: never comments without gating, high is the usual choice, critical the loosest. fail-on-scope: introduced judges only what the pull request added or made worse, which is what lets a repository that already has findings turn the gate on today; with all the gate judges the repository as it stands. When the base commit cannot be read, the scan falls back to all rather than passing. telemetry: false turns off the anonymous usage count the scan sends.

To try it on a public repository first, without installing anything, use the hosted scan at node9.ai/scan: every result page carries this workflow and a link that opens it, prefilled, in your repository. Once it runs on every pull request, the badge is yours to show.

Repository Scanning · node9 documentation