RELATED 01
ai-rulez
Manage one project's AI coding rules, skills and agents, and generate configs for many coding tools
167GitHub stars
17k/wknpm downloads
65popularity score
node9
Inspect and tighten a local node9 agent-governance setup from inside an AI conversation
Official · Node9 AI JavaScript Local · stdio SecurityDeveloper tools
69 popularity score ★ 225 ↓ 3.5k/wk
Connect your client
Local (npm)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
Claude CodeTerminal
claude mcp add node9 -- npx -y node9-ai mcp-serverClaude Desktopclaude_desktop_config.json
{
"mcpServers": {
"node9": {
"command": "npx",
"args": [
"-y",
"node9-ai",
"mcp-server"
]
}
}
}Cursor~/.cursor/mcp.json
{
"mcpServers": {
"node9": {
"command": "npx",
"args": [
"-y",
"node9-ai",
"mcp-server"
]
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"node9": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"node9-ai",
"mcp-server"
]
}
}
}Codex~/.codex/config.toml
[mcp_servers.node9]
command = "npx"
args = ["-y", "node9-ai", "mcp-server"]Gemini CLITerminal
gemini mcp add --scope user node9 npx -- -y node9-ai mcp-serverWhat it does
node9 is mainly a command-line gate that sits in the hooks of coding agents such as Claude Code, Codex CLI, Gemini CLI and Cursor. It checks each tool call before it runs and either lets it through, holds it until a person approves, or blocks it. It ships with rules for things like reads of ~/.ssh, ~/.aws and .env files, destructive git, SQL without a WHERE clause and piped curl-to-shell, and it keeps an audit log of every call.
The same npm package also starts an MCP server over stdio with `mcp-server`. That server does not do the gating. It lets an assistant look at the local node9 setup: protection status, the merged configuration, active rules and shields, the audit log, past agent sessions, a posture score for the machine, and a dry-run of how a given command would be judged. The assistant can also add protection: turn on a shield, add a block or review rule, switch on egress control, or deny a host.
The source (src/mcp-server/index.ts at v2.30.1) defines 18 tools, each tagged read-only, add or weaken. The two weakening tools, `node9_shield_disable` and `node9_approver_set`, are refused over MCP unless `"mcpAllowWeakening": true` is set in ~/.node9/config.json. No tool loosens egress; that is CLI-only. On a machine joined to a node9 workspace, every tool that writes local policy is refused and the assistant is pointed to the web dashboard.
What it needs
| Runtime | Node.js 22+ |
|---|---|
| Runs on | macOS, Windows, Linux |
| Also |
|
Node.js 22 or newer (npx runs the package). The server reports on and edits a local node9 installation, so node9 should be set up first (`npm install -g node9-ai` or Homebrew, then `node9` or `node9 setup`). Local use needs no account; joining a team dashboard with `node9 login` is optional.
Limits
- Not covered Reports on and adjusts node9 only. The gating happens in the agent hooks that node9 setup installs, not in this server.
- Not covered node9_shield_disable and node9_approver_set return an error unless mcpAllowWeakening is true in ~/.node9/config.json.
- Not covered Egress can be tightened over MCP but never loosened. Allowing a host or turning egress off is CLI-only.
- Not covered node9_rule_add accepts only block or review verdicts and no tool removes a rule.
- Size cap node9_audit_get returns 20 entries by default, at most 100 with limit.
- Limit With egress control off (the default), curl -d @file is not judged as a read of that file. Egress control covers shell commands only.
- Not covered On a workspace-joined machine every tool that writes local policy is refused and points to the dashboard.
The MCP server only reports on and adjusts node9; the gating itself happens in the agent hooks that node9 setup installs. `node9_shield_disable` and `node9_approver_set` return an error unless `mcpAllowWeakening` is true in ~/.node9/config.json, and egress can be tightened but never loosened over MCP. `node9_rule_add` takes only block or review verdicts and cannot remove rules. `node9_audit_get` returns 20 entries by default, at most 100. With egress control off (the default), a command that sends a file straight to the network (curl -d @file) is not treated as a read of it; egress control covers shell commands only. On a workspace-joined machine all policy-writing tools are refused.
Who it suits
Suits developers who already run node9 to govern coding agents and want the assistant to explain why a call was blocked, check the audit record, or tighten policy without leaving the chat. It is of little use on its own: without node9's hooks installed, there is little for it to report. It runs entirely on your machine and needs no API key. Teams that want central policy and approvals use the node9 dashboard (via `node9 login`), where local policy writes from this server are refused by design.
Tools 18
12 only read, 6 change things. A ? marks an optional parameter.
node9_status- Shows mode, daemon and pause state, active shields and whether agent hooks are wired
node9_config_get- Returns the merged node9 configuration, including approvers, timeouts and DLP settings
node9_shield_list- Lists the available service rule packs and which are switched on
node9_shield_enablechanges- Switches on a service shield such as postgres, aws, github or filesystem
service: string node9_shield_disablechanges- Switches off a shield; refused unless mcpAllowWeakening is set
service: string node9_approver_list- Lists the approval channels (native, browser, cloud, terminal) and their state
node9_approver_setchanges- Turns one approval channel on or off; refused unless mcpAllowWeakening is set
channel: enumenabled: boolean node9_audit_get- Reads recent audit log entries, filterable by outcome, 20 by default and up to 100
limit?: numberfilter?: enum node9_policy_get- Lists every active rule with its tool, verdict, conditions and reason
node9_scan- Goes through past Claude and Gemini agent history and reports what node9 would have caught
drill_down?: boolean node9_report- Summarises tool calls, blocks, DLP findings and agent cost for today, 7 days, 30 days or the month
period?: enumno_tests?: boolean node9_session- Lists recent agent sessions, or gives the full tool trace of one session
detail?: string node9_posture- Scores how exposed this machine is to a compromised agent, with a fix per finding
agent?: string node9_explain- Dry-runs a tool call or shell command through the policy and shows the verdict and trace
tool?: stringargs?: string node9_rule_addchanges- Adds a block or review rule matched by regex to the global config
name: stringtool: stringfield: stringpattern: stringverdict: enumreason: string node9_egress_status- Shows egress mode, allow and deny host lists and the always-blocked address ranges
node9_egress_protectchanges- Turns on or strengthens outbound network control in review or block mode
mode?: enum node9_egress_denychanges- Adds a host or wildcard to the egress deny list
host: string