Node9

The evidence shows opt-in shield packs, read-only default CI permissions, a non-root sandbox, scoped mounts, deny-by-default egress, and a rule preventing inline self-approval from bypassing routed cloud approval. Least privilege and user confirmation are therefore handled thoroughly. The README also distinguishes local processing from post-login transmission, identifies the redacted --ship snapshot, audit-log location, and scanned directories, and says secrets are redacted before storage, making data flows and external effects unusually explicit. Dependency controls include commit-pinned CI actions, production and engine audits, overrides, and an extractor-version integrity gate; points are deducted because regular npm dependencies use version ranges and neither a lockfile nor audit results are supplied. Logout, uninstall, pin reset, and disposable containers provide partial reversal, but there is no comprehensive configuration restoration, audit-data recovery, or rollback for project edits. Author, repository, related-project, and licensing attribution are present, but publisher identity is unverified and the organizational responsibility chain is incomplete.

The README, SECURITY.md, package metadata, and CI describe a broadly coherent interception, approval, and auditing product. CI is configured for Node 20/22, Windows/Linux, builds, type checking, unit tests, coverage, and end-to-end tests. The material inconsistency is that the README claims Node.js 18+ while package.json requires >=20, reducing self-consistency and dependency guidance. npm and Homebrew distribution plus build and audit workflows support ordinary availability, but the supplied evidence lacks a lockfile, offline dependency strategy, and complete behavior for unavailable services. Failure handling includes a distinct audit DID-NOT-RUN state, conservative fallback when a base commit cannot be read, fail-closed corrupt pin state, and an uninstall failure message. It lacks a systematic error catalog, documented exit codes, and broad troubleshooting examples, so failure messaging is not thorough.

The source clearly addresses individual machines, team approval, CI, MCP, Python agents, live monitoring, historical review, and container isolation. Boundaries are unusually candid: local code execution can bypass the daemon, Phase 1 is Claude-first, agent credentials remain inside the container, Response DLP alerts rather than blocks, and some posture findings remain the user's responsibility. Trigger precision is supported by concrete Git, SQL, shell, cloud-service, and MCP operations, plus Bash AST analysis, stateful handling, and explicit approval routing. Environment support covers macOS/Linux installation, cross-platform npm, Windows CI, many agents, and Docker, but the Node-version contradiction and absence of a complete sandbox/platform compatibility matrix prevent full environment-fit credit.

The README has strong organization across discovery, protection, review, installation, shields, approval, sandboxing, MCP, data interpretation, and internals. It supplies extensive command and output examples and candid limitations. Apache-2.0 metadata matches the complete LICENSE, earning full license credit. Installation covers Homebrew/npm, initialization, login, diagnosis, and a Node prerequisite, but the Node 18+ versus >=20 conflict and limited upgrade/removal recovery guidance warrant deductions. Naming is mostly stable, though node9-ai and @node9/proxy are both presented without fully explaining their release relationship. semantic-release configuration and a concrete package version support managed releases, but no changelog or migration record is supplied. SECURITY.md provides a security contact and response targets, while package metadata identifies an author and issue tracker; maintenance ownership is still incomplete because the publisher is unverified and no team continuity or general support commitment is shown.

Outputs include terminal scorecards, JSON, PR comments, check runs, a live dashboard, reports, audit logs, and actionable remediation commands, making findings directly usable for human response and CI gating. Combining retrospective discovery, pre-execution governance, DLP, MCP change quarantine, and container egress controls offers clear marginal value over a logging-only or single-rule tool. Adoption costs are reduced by local operation, account-free baseline protection, token-free public-repository scans, and opt-in shields. Full cost-benefit credit is withheld because hook overhead, background scanning, Docker requirements, approval latency, dashboard login, and Pro boundaries are not quantified, and effectiveness was not executed or independently tested in this static review.

Many claims map to concrete commands, configuration fields, paths, workflow steps, permissions, and threat boundaries; core product descriptions are structurally corroborated across README, SECURITY.md, package metadata, and workflows. Deductions apply because all supplied sources are project-controlled and no implementation files or independent reports substantiate the displayed scores, runtime performance, blocking efficacy, atomic writes, AST obfuscation resistance, or self-scan badge result. The documentation does distinguish Phase 1 scope, alerts from blocks, conservative fallbacks, and responsibility boundaries, but some promotional security conclusions remain intermingled with design claims and example output rather than consistently separating demonstrated facts from intended behavior.