node9 MCP server
io.github.node9-ai/node9·v2.26.2·216 starsAccess control for AI agents and MCP servers: allow, hold for approval, or block each tool call
216 stars3.6k downloads/wk
Reviews
Write oneNobody has reviewed node9 yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
node9 tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it
- Code scan2 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 2 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
How node9 compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 91/100
- higher than 85% of 48,273 servers
- GitHub stars
- 216
- more than 95% of 28,534 servers
- Downloads a week
- 3,639
- more than 95% of 11,915 servers with a package
Install node9 in Claude Code, Cursor or VS Code
Runs npx -y node9-ai on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add node9 -- npx -y node9-ai
What the publisher says
From the node9 repository's README, as published. We do not edit it. Read it on GitHub
🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database.node9 decides what they may do with each one.
Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · one record across twelve agents
Works with Claude Code · Codex CLI · Antigravity (agy) · GitHub Copilot CLI · Gemini CLI · Cursor · Windsurf · VSCode · Claude Desktop · Opencode · Pi · Hermes Agent · any MCP server.
What it looks like
A real Claude Code session with node9 installed. Every tool call is checked before it runs. Building a page and editing a button run. A request to the cloud metadata address is blocked, and the agent gets the reason and carries on. Deleting files waits for your approval, right in the chat.
Install
brew tap node9-ai/node9 && brew install node9 # macOS / Linux
npm install -g node9-ai # any platformThen, in any project:
node9 # first run: choose dashboard connection or local protection
node9 posture # scores this machine 0-100: what a compromised agent could read, reach and run
node9 login # optional: adds this machine to a shared dashboardRequires Node.js 22+.
On a new interactive terminal, node9 guides you through setup. Local protection needs no account. The checklist shows recommended shields, DLP/PII, optional network egress review, and the background service. Usage statistics are sent only if you accept the separate prompt. The summary lists configured agents and any setup steps that need attention.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
node9: common questions
- Is node9 MCP server safe?
- Yes, by our scan: it is graded A (91/100). Read the node9 safety report
- How do I install node9?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does node9 need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is node9 maintained?
- The last commit was 34 days ago (2026-09-29). The latest release is v2.26.2.
- How does node9 compare with other MCP servers?
- safety score 91/100 (higher than 85% of 48,273 servers); github stars 216 (more than 95% of 28,534 servers); downloads a week 3,639 (more than 95% of 11,915 servers with a package). Full comparison.