npx node9-ai scan   # 安装前运行，约 10 秒，不上传任何内容
node9 scan          # 安装后运行，输出相同

node9 posture          # 评分卡，附首要风险及每个发现的修复命令
node9 posture --ship   # 将脱敏快照发送至你的 node9 仪表盘（集群视图）

🛡️  Node9 Posture — agent on this host        Score: 100/100  (Good)
  2 advisories below don't affect the score — OS-level exposure, yours to weigh.

  🟢 node9 is already protecting you
  ✅ Secrets        node9 DLP is blocking this
  ✅ Egress         node9 egress is approval-gating this
  ✅ Approval gate  node9 is blocking this
  ✅ Privilege      node9 is approval-gating this

  🔒 node9 reduces these — run the command, the rest is yours
  ⚠️  Isolation     Running directly on the host — no container
                   The agent runs loose on your whole machine, not in a sandbox.
                   → node9 sandbox run <agent>   — jail it: kernel egress + scoped mounts + node9 inside
                   → node9 shield enable project-jail   — or shrink the blast radius, keep host access
  ⚠️  Network exposure  4 services on 0.0.0.0 (node :3000/:4000, PostgreSQL :5432, Redis :6379)
                   Reachable from your whole network, not just this laptop.
                   → node9 shield enable postgres|redis   — node9 blocks DROP TABLE / FLUSHALL
                   → bind to 127.0.0.1 / firewall the port   (your part)

  ✅ Supply chain   no issues found
  ✅ Coverage       no issues found

  Track this across your fleet & keep it green → node9.ai

npx node9-ai scan-repo <owner/repo>   # 任意公开仓库，无需安装
node9 scan-repo .                      # 本地检出——无网络请求
node9 scan-repo <owner/repo> --json    # 机器可读格式

🛡️  node9 scan-repo · node9-ai/agent-security-demo · ⚠️ agent-security risk found
   inspected 2 config file(s), 2 finding(s)

🔴 CRITICAL  Injectable agent workflow — untrusted input reaches a tool-using agent with secrets
   .github/workflows/vulnerable-example.yml · CI-2
     • runs with base-repo secrets (pull_request_target)
     • checks out the untrusted PR head into the workspace root
     • allowed_non_write_users: "*" — any user can trigger the agent
     • no effective actor gate

🔴 CRITICAL  Exfiltratable secrets reachable by an injectable agent
   .github/workflows/vulnerable-example.yml · CI-4
     • agent has arbitrary shell (bare Bash) → can read env and exfiltrate

# .github/workflows/agent-security.yml
- uses: node9-ai/agent-security-action@v1
  with:
    fail-on: high # or 'never' to just comment

node9 monitor              # 按 [2] 查看报告视图
node9 report --period 7d   # 命令行形式，无 TUI

# macOS / Linux
brew tap node9-ai/node9 && brew install node9

# 或通过 npm（任意平台）
npm install -g node9-ai

node9 init       # 自动连接所有检测到的代理和 MCP 服务器
node9 doctor     # 验证所有连接是否正确

node9 shield list    # 显示所有护盾及其状态

{
  "settings": {
    "reviewChannel": "ask", // "ask" = 内联代理提示（默认）| "approver" = node9 自己的审批器
  },
}

cd ~/my-project
node9 sandbox new        # 写入 node9.sandbox.yaml——要挂载的内容和允许的主机
node9 sandbox run        # 构建并启动被隔离的代理（你的项目位于 /workspace）
node9 sandbox tail       # 从宿主机实时查看代理的操作

{
  "mcpServers": {
    "postgres": {
      "command": "node9",
      "args": ["mcp", "--upstream", "npx -y @modelcontextprotocol/server-postgres postgresql://..."]
    }
  }
}

🛡 node9 | standard | [bash-safe] | ✅ 12 allowed  🛑 2 blocked  🚨 0 dlp | ~$0.43
📊 claude-opus-4-7 | ctx [████████░░░] 54% | 5h [██░░░░░░░░] 12% | 7d [█░░░░░░░] 7%
🗂 2 CLAUDE.md | 8 rules | 3 MCPs | 4 hooks

from node9 import configure, protect

configure(agent_name="my-agent", policy="require_approval")

@protect("bash")
def run_command(cmd: str) -> str:
    ...