# node9

node9 checks an agent’s tool calls and can allow, block, or pause them for approval. Use it to put access rules between an agent and sensitive files or commands.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 219
- Author: node9-ai
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/node9-ai/node9-proxy
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/node9

## What it does

node9 sits between an agent and the tools it invokes. It can block reads from sensitive locations such as `~/.ssh`, `~/.aws`, and `.env` files, and hold destructive actions until you approve them. Shell commands are parsed by structure, so putting a file read inside a pipeline does not hide what the command does. A held action waits without running.

Connect node9 to Claude Code over stdio. From the conversation, an agent can ask for its status, protection posture, audit record, or policy. Node.js 22+ is required; without it, `npx` cannot launch node9. A shared dashboard account is optional, and local protection works without one.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add node9 -- npx -y node9-ai
```

### Codex

**Platform CLI**
```bash
codex mcp add node9 -- npx -y node9-ai
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "node9": {
            "command": "npx",
            "args": [
                "-y",
                "node9-ai"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "node9": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "node9-ai"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add node9 npx -y node9-ai
```

## When to use it
- block an agent from reading SSH keys and `.env` files
- pause file deletion until a person approves it
- inspect shell pipelines for reads of protected credentials
- check node9 status and audit records from an agent conversation

## Example prompts
- Check which node9 rule stopped the last tool call and explain the decision.
- Show the current node9 status and this machine’s protection posture.
- Review the node9 policy before I run a command that deletes files.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md