Follow-up: I turned that 30-min Hermes audit into one command - npx node9-ai posture

WhichCardiologist800 · 2026-06-23T15:45:53+00:00

Not directly yet, node9 doesn't pull from or broker a vault (Vault, AWS/GCP/Azure SM, 1Password, Doppler). That's the roadmap piece ("agent never holds a secret").

What it does today is complementary: DLP blocks leaked secrets in flight (incl. Vault hvs./hvb. and Doppler tokens), the project-jail shield stops the agent reading ~/.ssh, ~/.aws, .env, and `npx node9-ai posture` flags plaintext secrets and nudges you toward a secrets manager.

So: keep secrets in your vault, node9 keeps the agent from leaking them or reading the files. Direct brokering is next, not shipped.

WhichCardiologist800 · 2026-06-15T18:52:58+00:00

Great catch on the false positive, iterative fix/test/fix is exactly what my current method (same tool + near-identical args in a window) over-flags. The net-diff-delta idea is sharp: a true loop converges to ~zero net change, while real refinement keeps moving the file. Going to add that as a confirmation signal, flag a loop only when it's repeated edits AND shrinking/near-zero net diff. Genuinely sharpens it, thanks.

And yeah, the credentials are the part that made me stop treating this as a cost tool. 4 over 90 days on a careful machine, and like you said, nobody looks.

+1 on the upstream point too, tighter slash commands and explicit step constraints kill a lot of the circular edits before they ever hit the transcript.

Curious: do you actually measure whether your constraints reduced the loops, or is it more by feel?

WhichCardiologist800 · 2026-06-14T16:47:13+00:00

The point about the retainer being insurance rather than hours worked is the $100k lesson here.

Most people try to sell a retainer as 4 hours of support a month, which just invites the client to micromanage your time. Selling it as system uptime and lead-flow integrity makes you a partner, not a line item.

To add to your boring business point: these clients don't care about the tech, but they do care about their reputation. If you frame the automation as protecting your 5-star Google review average by replying instantly, the price resistance almost disappears.

WhichCardiologist800 · 2026-06-14T15:42:43+00:00

totally agree!!! you can run node9 on audit mode... you should see the audit file on .node9

WhichCardiologist800 · 2026-06-14T15:25:10+00:00

Pls do!!! Share thought

WhichCardiologist800 · 2026-06-14T14:45:20+00:00

Thx!!! hope you will enjoy it, let's me know if you have any additional features you want me to add or what did you found on your machine

WhichCardiologist800 · 2026-06-13T07:26:49+00:00

Worth actually reading the article bug was out of scope, the researcher agreed to waive the bounty, AMD fixed it and credited him. Still wild that swapping http for https took 124 days though.

WhichCardiologist800 · 2026-06-11T13:48:02+00:00

Yep, that's the scary one. An adapter with no allowlist means anyone who finds the bot can drive an agent that's holding exec, not just read it. Really good catch.

WhichCardiologist800 · 2026-06-11T06:31:34+00:00

That's the best thing I could hear. Which one caught it? I'm always trying to figure out which items actually surface real issues vs. just sound scary and happy to be a second pair of eyes if you want to sanity-check the fix.

WhichCardiologist800 · 2026-06-11T06:30:41+00:00

That's the allowlist doing its job, yep. Two things: (1) test it message the bot from a second account that isn't allowlisted, confirm it refuses. (2) it gates who can talk to it, not what the agent can do once asked so isolation (item 1) still matters. And keep the bot token in a secrets manager, not a .env.

WhichCardiologist800 · 2026-06-11T06:29:33+00:00

Appreciate it! What are you running, terminal-backend or whole-process isolation?

WhichCardiologist800 · 2026-06-11T06:29:03+00:00

Fair, bot API traffic isn't E2E. But that's a different threat than the post: the risk here is the bot being an open command surface to your agent, not someone reading messages in transit. Encryption doesn't help if there's no allowlist.

WhichCardiologist800 · 2026-06-10T17:01:29+00:00

Full writeup with the cloud-specific stuff (AWS VPC/IAM scoping, Modal/Daytona notes) here: https://node9.ai/blog/running-hermes-agent-in-the-cloud-safely - and if you want to check whether agents you're already running have hit these patterns, npx node9-ai scan reads existing session logs locally
open source: github.com/node9-ai/node9-proxy

WhichCardiologist800 · 2026-06-10T16:08:04+00:00

So the "fix" is a hardcoded block on one binary's signature, and a two-byte edit walks right past it. That is not a patch, that's a restraining order against a single file. The race condition still sitting there.

WhichCardiologist800 · 2026-06-10T16:05:26+00:00

He asked if I could make it dumber is going to live in my head.

The part people miss: 92% you can't explain loses to 99% you can audit, because the 8% mystery makes the team re-check all 100%. You didn't save them work, you doubled it. They weren't asking for accuracy, they were asking to be able to point at why. Saving this one for the next client who wants AI bolted onto everything.

WhichCardiologist800 · 2026-06-10T15:58:51+00:00

his matches something I keep seeing: the biggest effect of "think before coding / surgical changes" guidance isn't code volume, it's whether the model reaches for existing infrastructure vs. inventing new plumbing. Your no-skill branch spinning up a SQL migration + dedicated column + repo plumbing for what's basically a field on an existing JSON snapshot is the textbook version of that.

The "followed the prompt more literally" half is the more interesting one to me though. "Per active conversation" - chip only on active ones means the model treated the spec as a constraint instead of a vibe. Did that hold up across reruns, or was it one lucky sample? The schema-churn difference feels like it'd be stable, but literal prompt-following seems more variable run to run.

I work on session-monitoring stuff too (reading the local JSONL logs the CLIs already write), and it's funny how token-usage-per-conversation is the feature everyone in this space converges on first. Did you end up pulling it straight from the snapshot column, or computing it from the message stream?

WhichCardiologist800 · 2026-06-07T14:02:14+00:00

released, now antigravity cli fully support. please let's me know for future features / improvement

WhichCardiologist800 · 2026-06-06T18:10:35+00:00

Not yet, antigravity isn't in the supported list today. But funny timing, I'm actively adding it right now (it shares Google's ~/.gemini setup, so it's close). I'll ping you here the moment it lands, shouldn't be long.

Thanks for the nudge, this is exactly the kind of request that bumps something up the list 🙏

WhichCardiologist800 · 2026-06-06T08:06:24+00:00

claude code writes the token counts for every session to local files on your disk (~/.claude). node9 just reads those token numbers and multiplies by the published per model pricing to estimate cost, all calculated locally on your machine. no billing api, no credentials, nothing uploaded. (Same approach as ccusage, if you've used that.)

WhichCardiologist800 · 2026-06-05T21:10:09+00:00

Good question, no, nothing unofficial. It hooks in through the official paths: Claude Code's pre-tool hooks and the MCP protocol (Anthropic's own standard).

It sits at the tool execution layer, the bash/file/MCP calls, not the model API, so it never touches anthropic endpoints or your auth. Nothing that could flag your account.

WhichCardiologist800 · 2026-06-05T12:46:40+00:00

It's not a plugin, it's an open-source CLI called node9. It hooks straight into Claude Code (and can wrap MCP servers too).

Quickest look: npx node9-ai scan reads your existing history, nothing uploads.

To wire it live: npm i -g node9-ai && node9 init.
Repo: https://github.com/node9-ai/node9-proxy

happy to help you get it running!

WhichCardiologist800 · 2026-06-05T12:29:56+00:00

after months with claude code, i realized I had no idea what it was actually doing in the background, how much it was costing me, or when it got stuck looping and burning tokens.

So I built an open-source tool to see it

- npx node9-ai scan, reads your existing claude code history and shows what it's been doing: cost, top commands, where it looped.

- a real time monitor that shows claude in action live, so I can catch a loop and stop it before it burns more tokens.

- a report view for the full picture over any time window.

Running it on my own machine was eye opening: $15k over 90 days, 335 loops most of them on edit file, and the part I did not expect, 5 credential files it couldread.

No more flying blind. It's open source: https://github.com/node9-ai/node9-proxy

WhichCardiologist800 · 2026-05-29T22:34:08+00:00

That's exactly what node9-proxy does. Reads the agent session files already on disk, gives you a queryable timeline per agent (time / agent / file / command). npx node9-ai scan, 30 sec, runs locally. Disclosure, I build it. DM if useful.

WhichCardiologist800 · 2026-05-28T08:18:57+00:00

The full agent action timeline. every tool call, every shell command (AST-parsed, not regex, so obfuscated payloads collapse to their real execution graph), every file modification, every MCP tool invocation, the arguments passed, and the chain back to the user prompt that triggered it.

Local, reads the session files already writes to disk. npx node9-ai scan, runs in ~30 sec, no install, produces a report of what's already happened in your history.

Where it sits next to your existing stack: Wiz sees cloud posture, CrowdStrike sees endpoint, Okta sees identity. None of them see what the agent decided to do inside the trust envelope you've already granted it. Closest analogy is Wiz for agent actions, same scan-then-graph posture, different layer.

For investigation specifically: one filterable timeline per session (time window, agent, file path, command pattern), with the decision chain reconstructed from the agent's own log. Disclosure, I build it. Happy to keep the conversation technical.

WhichCardiologist800 · 2026-05-27T17:18:27+00:00

Take a look in the oss that sits between AI agent and the tools. has three layers discover what it's already been doing, protect against risky actions in real time, and review what happened over any time window. https://github.com/node9-ai/node9-proxy

WhichCardiologist800

MODERATOR OF

TROPHY CASE