SecureNow
NPM · SECURENOW · 2 COMPONENTS
Production security for Node.js apps: investigate live attacks, block IPs, tune detections.
Available components
Last scanned (23 hours ago)
Scores higher than 41% of npm servers
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 37 of 195 dependencies flagged as unhealthy (8 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (ISC).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 12261 tokens (~129/item across 95 items; 90 tools + 5 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 91 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Oct 26 +1
- Dependency health: 0.96 → 0.91 ▼ functional
- 19 Oct 26 71
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Oct 2026 · Analysed npm/securenow@8.12.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 195 packages
| Packages resolved | 195 |
|---|---|
| Deprecated | 8 |
| Stale | 29 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
securenow_alert_review_apply_group_decision Apply Alert Review Group Decision ~501
Compatibility alias for securenow_alert_review_run_apply_group_decision.
| Name | Type | Req | Description |
|---|---|---|---|
| allowMixed | boolean | – | Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| decisionReport | object | – | Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations. |
| decisionSummary | string | – | Short decision summary to record on the IP/case history. |
| evidence | array | – | Evidence strings that support the decision. |
| groupKey | string | – | Compatibility alias for rootCauseKey. |
| ips | array | – | IP addresses affected by this case-level decision report. |
| maxRows | number | – | Maximum rows to close in this batch. Defaults to 100, capped at 250. |
| maxScan | number | – | Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000. |
| methods | array | – | HTTP methods reviewed for this decision. |
| missingProof | array | – | Proof that was missing when the row is skipped or ambiguous. |
| notificationIds | array | – | Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group. |
| outcome | string | – | Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other. |
| paths | array | – | Paths/endpoints reviewed for this decision. |
| previewOnly | boolean | – | When true, returns the eligible rows without writing. |
| prototypeRunId | string | – | Optional notification id whose root-cause key should be used. |
| reason | string | yes | Short human-readable reason for the write action. |
| recommendations | array | – | Follow-up recommendations to record with the decision. |
| reviewedHistory | array | – | History/proofs reviewed before deciding. |
| rootCauseKey | string | – | Root-cause group key from securenow_alert_review_runs_list. |
| search | string | – | Optional search filter applied before grouping. |
| status | string | – | Resolution status: resolved or dismissed. Defaults to resolved. |
| statusCodes | array | – | HTTP status codes reviewed for this decision. |
| traceIds | array | – | Trace IDs reviewed for this decision. |
| userAgents | array | – | User agents reviewed for this decision. |
No output schema declared.
No examples provided.
securenow_alert_review_group_similar List Similar Alert Review Runs ~96
Fetch the current rows in one alert-review root-cause group for preview before a batch decision.
| Name | Type | Req | Description |
|---|---|---|---|
| groupKey | string | – | Compatibility alias for rootCauseKey. |
| maxScan | number | – | Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000. |
| rootCauseKey | string | – | Root-cause group key from securenow_alert_review_runs_list. |
No output schema declared.
No examples provided.
securenow_alert_review_run_apply_group_decision Apply Alert Review Group Decision ~516
Apply one verified no-write decision report to every currently matching alert-review row in a root-cause group, leaving non-matching rows open.
| Name | Type | Req | Description |
|---|---|---|---|
| allowMixed | boolean | – | Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| decisionReport | object | – | Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations. |
| decisionSummary | string | – | Short decision summary to record on the IP/case history. |
| evidence | array | – | Evidence strings that support the decision. |
| groupKey | string | – | Compatibility alias for rootCauseKey. |
| ips | array | – | IP addresses affected by this case-level decision report. |
| maxRows | number | – | Maximum rows to close in this batch. Defaults to 100, capped at 250. |
| maxScan | number | – | Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000. |
| methods | array | – | HTTP methods reviewed for this decision. |
| missingProof | array | – | Proof that was missing when the row is skipped or ambiguous. |
| notificationIds | array | – | Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group. |
| outcome | string | – | Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other. |
| paths | array | – | Paths/endpoints reviewed for this decision. |
| previewOnly | boolean | – | When true, returns the eligible rows without writing. |
| prototypeRunId | string | – | Optional notification id whose root-cause key should be used. |
| reason | string | yes | Short human-readable reason for the write action. |
| recommendations | array | – | Follow-up recommendations to record with the decision. |
| reviewedHistory | array | – | History/proofs reviewed before deciding. |
| rootCauseKey | string | – | Root-cause group key from securenow_alert_review_runs_list. |
| search | string | – | Optional search filter applied before grouping. |
| status | string | – | Resolution status: resolved or dismissed. Defaults to resolved. |
| statusCodes | array | – | HTTP status codes reviewed for this decision. |
| traceIds | array | – | Trace IDs reviewed for this decision. |
| userAgents | array | – | User agents reviewed for this decision. |
No output schema declared.
No examples provided.
securenow_alert_review_run_dismiss Dismiss Alert Review Run ~306
Dismiss one pending alert-review row with an audit report and no enforcement write.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| decisionReport | object | – | Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations. |
| decisionSummary | string | – | Short decision summary to record on the IP/case history. |
| evidence | array | – | Evidence strings that support the decision. |
| id | string | yes | Notification id for the alert review run. |
| ips | array | – | IP addresses affected by this case-level decision report. |
| methods | array | – | HTTP methods reviewed for this decision. |
| missingProof | array | – | Proof that was missing when the row is skipped or ambiguous. |
| outcome | string | – | Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other. |
| paths | array | – | Paths/endpoints reviewed for this decision. |
| reason | string | yes | Short human-readable reason for the write action. |
| recommendations | array | – | Follow-up recommendations to record with the decision. |
| reviewedHistory | array | – | History/proofs reviewed before deciding. |
| statusCodes | array | – | HTTP status codes reviewed for this decision. |
| traceIds | array | – | Trace IDs reviewed for this decision. |
| userAgents | array | – | User agents reviewed for this decision. |
No output schema declared.
No examples provided.
securenow_alert_review_run_get Get Alert Review Run ~77
Fetch one pending-review alert run with its root-cause key, evidence-quality score, and similar open siblings.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Notification id for the alert review run. |
| maxScan | number | – | Maximum pending-review rows to scan for similar siblings. Defaults to 500, capped at 1000. |
No output schema declared.
No examples provided.
securenow_alert_review_run_keep_alive Keep Alert Rule Active ~332
Mark the noisy/paused alert rule as reviewed, keep it active, and close the pending alert-review row with an audit report.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| decisionReport | object | – | Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations. |
| decisionSummary | string | – | Short decision summary to record on the IP/case history. |
| evidence | array | – | Evidence strings that support the decision. |
| id | string | yes | Notification id for the alert review run. |
| ips | array | – | IP addresses affected by this case-level decision report. |
| methods | array | – | HTTP methods reviewed for this decision. |
| missingProof | array | – | Proof that was missing when the row is skipped or ambiguous. |
| outcome | string | – | Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other. |
| paths | array | – | Paths/endpoints reviewed for this decision. |
| reason | string | yes | Short human-readable reason for the write action. |
| recommendations | array | – | Follow-up recommendations to record with the decision. |
| reviewNote | string | – | Optional rule-review note. Defaults to reason. |
| reviewedHistory | array | – | History/proofs reviewed before deciding. |
| statusCodes | array | – | HTTP status codes reviewed for this decision. |
| traceIds | array | – | Trace IDs reviewed for this decision. |
| userAgents | array | – | User agents reviewed for this decision. |
No output schema declared.
No examples provided.
securenow_alert_review_run_resolve Resolve Alert Review Run ~305
Close one pending alert-review row with an auditable no-write decision report.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| decisionReport | object | – | Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations. |
| decisionSummary | string | – | Short decision summary to record on the IP/case history. |
| evidence | array | – | Evidence strings that support the decision. |
| id | string | yes | Notification id for the alert review run. |
| ips | array | – | IP addresses affected by this case-level decision report. |
| methods | array | – | HTTP methods reviewed for this decision. |
| missingProof | array | – | Proof that was missing when the row is skipped or ambiguous. |
| outcome | string | – | Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other. |
| paths | array | – | Paths/endpoints reviewed for this decision. |
| reason | string | yes | Short human-readable reason for the write action. |
| recommendations | array | – | Follow-up recommendations to record with the decision. |
| reviewedHistory | array | – | History/proofs reviewed before deciding. |
| statusCodes | array | – | HTTP status codes reviewed for this decision. |
| traceIds | array | – | Trace IDs reviewed for this decision. |
| userAgents | array | – | User agents reviewed for this decision. |
No output schema declared.
No examples provided.
securenow_alert_review_runs_count Count Alert Review Runs ~76
Count pending alert-review rows and the root-cause groups they collapse into.
| Name | Type | Req | Description |
|---|---|---|---|
| maxScan | number | – | Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000. |
| search | string | – | Optional search over rule, route, IP, evidence, or proposed guard. |
No output schema declared.
No examples provided.
securenow_alert_review_runs_list List Alert Review Root Causes ~158
List pending alert-review runs as root-cause groups with batch-action preview, rather than row-by-row noisy alert triage.
| Name | Type | Req | Description |
|---|---|---|---|
| groupKey | string | – | Compatibility alias for rootCauseKey. |
| includeRuns | boolean | – | Whether to include compact matching run rows in the response. |
| limit | number | – | Maximum results to return. |
| maxScan | number | – | Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000. |
| page | number | – | Page number. |
| rootCauseKey | string | – | Optional root-cause group key to filter to one group. |
| search | string | – | Optional search over rule, route, IP, evidence, or proposed guard. |
No output schema declared.
No examples provided.
securenow_alert_rule_candidate_test Dry-Run Candidate Alert Rule SQL ~98
Dry-run a candidate SQL/query guard for an alert rule without saving it.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationKey | string | – | Application key to test. |
| candidateSqlQuery | string | yes | Full candidate SQL query to dry-run without saving. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Alert rule id. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_alert_rule_condition_candidate_test Test Alert Rule Condition Candidate ~353
Dry-run a condition-level instant-rule patch without saving it, including seeded benign/attack fixture checks.
| Name | Type | Req | Description |
|---|---|---|---|
| applyGlobally | boolean | – | Required true for system rules, even for admin dry-runs. |
| conditions | array | – | Optional full replacement instant conditions array to test. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| enabled | boolean | – | Whether instant detection would be enabled. |
| executionMode | string | – | Rule execution mode: instant or hybrid when instant detection is enabled. |
| expectedCurrentInstantHash | string | yes | Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get. |
| expectedCurrentRuleHash | string | – | Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get. |
| expectedRuleVersion | number | yes | Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get. |
| fixtures | array | – | Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch. |
| id | string | yes | Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash. |
| matchMode | string | – | Condition match mode: all or any. |
| operations | array | – | Candidate condition operations to test. |
| reason | string | yes | Short human-readable reason for the write action. |
| reviewNote | string | – | Optional review note. Defaults to reason. |
| reviewNotificationId | string | – | Optional notification id tied to this review/tuning action. |
| source | string | – | Instant event source. Currently trace. |
No output schema declared.
No examples provided.
securenow_alert_rule_condition_diff Diff Alert Rule Condition Candidate ~302
Return the current instant conditions, candidate conditions, hashes, and before/after fixture behavior without saving.
| Name | Type | Req | Description |
|---|---|---|---|
| applyGlobally | boolean | – | Required true for system rules, even for admin dry-runs. |
| conditions | array | – | Optional full replacement instant conditions array to diff. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| enabled | boolean | – | Whether instant detection would be enabled. |
| executionMode | string | – | Rule execution mode: instant or hybrid when instant detection is enabled. |
| expectedCurrentInstantHash | string | yes | Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get. |
| expectedCurrentRuleHash | string | – | Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get. |
| expectedRuleVersion | number | yes | Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get. |
| fixtures | array | – | Optional seeded fixtures used to explain benign removals and attack coverage. |
| id | string | yes | Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash. |
| matchMode | string | – | Condition match mode: all or any. |
| operations | array | – | Candidate condition operations to diff. |
| reason | string | yes | Short human-readable reason for the write action. |
| source | string | – | Instant event source. Currently trace. |
No output schema declared.
No examples provided.
securenow_alert_rule_condition_update Update Alert Rule Condition ~400
Patch instant alert-rule conditions with version/hash guards and seeded before/after tests. Compatibility alias for condition-level tuning.
| Name | Type | Req | Description |
|---|---|---|---|
| applyGlobally | boolean | – | Required true for system rules. Updates every customer copy of the system rule. |
| conditions | array | – | Optional full replacement instant conditions array. Use operations for smaller patches. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| enabled | boolean | – | Whether instant detection is enabled. |
| executionMode | string | – | Rule execution mode: instant or hybrid when instant detection is enabled. |
| expectedCurrentInstantHash | string | yes | Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get. |
| expectedCurrentRuleHash | string | – | Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get. |
| expectedRuleVersion | number | yes | Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get. |
| fixtures | array | – | Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch. |
| id | string | yes | Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash. |
| matchMode | string | – | Condition match mode: all or any. |
| operations | array | – | Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update. |
| reactivatePausedCopies | boolean | – | Whether to reactivate paused noisy copies after the condition is tuned. |
| reason | string | yes | Short human-readable reason for the write action. |
| reviewNote | string | – | Optional review note. Defaults to reason. |
| reviewNotificationId | string | – | Optional notification id tied to this review/tuning action. |
| source | string | – | Instant event source. Currently trace. |
No output schema declared.
No examples provided.
securenow_alert_rule_conditions_get Get Alert Rule Conditions ~39
Fetch instant rule conditions with rule version and hash guards for safe condition-level tuning.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Alert rule id. |
No output schema declared.
No examples provided.
securenow_alert_rule_exclusion_add Add Alert Rule Exclusion ~115
Add a restrictive exclusion to one alert rule. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| conditions | array | – | Restrictive exclusion conditions. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Alert rule id. |
| isActive | boolean | – | Whether the exclusion is active. |
| matchMode | string | – | all or any. |
| pathPattern | string | – | Optional path pattern. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_alert_rule_exclusion_remove Remove Alert Rule Exclusion ~77
Remove an alert rule exclusion. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| exclusionId | string | yes | Exclusion id. |
| id | string | yes | Alert rule id. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_alert_rule_exclusions_list List Alert Rule Exclusions ~32
List exclusions embedded on one alert rule.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Alert rule id. |
No output schema declared.
No examples provided.
securenow_alert_rule_get Get Alert Rule ~27
Fetch one alert rule.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Alert rule id. |
No output schema declared.
No examples provided.
securenow_alert_rule_instant_update Update Instant Alert Rule ~567
Patch instant rule conditions/config with version/hash guards and before/after seeded tests. System rules require applyGlobally:true and admin permission. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| applyGlobally | boolean | – | Required true for system rules. Updates every customer copy of the system rule. |
| block | boolean | – | Block the source IP when the instant conditions match. Has no effect while the rule is in test mode. |
| blockConditions | array | – | Optional stricter conditions that must also match before blocking (same shape as conditions). |
| blockMatchMode | string | – | Match mode for blockConditions: all or any (default any). |
| blockTtlHours | number | – | How long an instant block lasts, in hours (default 1, max 168). |
| conditions | array | – | Optional full replacement instant conditions array. Use operations for smaller patches. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| dryRun | boolean | – | When true, validates and runs before/after seeded tests without saving. |
| enabled | boolean | – | Whether instant detection is enabled. |
| executionMode | string | – | Rule execution mode: instant or hybrid when instant detection is enabled. |
| expectedCurrentInstantHash | string | yes | Required SHA-256 hash of the current instant config from securenow_alert_rule_get. |
| expectedCurrentRuleHash | string | – | Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_get. |
| expectedRuleVersion | number | yes | Required current reviewState.reviewVersion from securenow_alert_rule_get. |
| fixtures | array | – | Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch. |
| id | string | yes | Alert rule id. Fetch with securenow_alert_rule_get first to get ruleVersion and instantHash. |
| matchMode | string | – | Condition match mode: all or any. |
| operations | array | – | Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update. |
| reactivatePausedCopies | boolean | – | Whether to reactivate paused noisy copies after the instant rule is tuned. |
| reason | string | yes | Short human-readable reason for the write action. |
| reviewNote | string | – | Optional review note. Defaults to reason. |
| reviewNotificationId | string | – | Optional notification id tied to this review/tuning action. |
| severity | string | – | Optional severity override: critical, high, medium, or low. |
| source | string | – | Instant event source. Currently trace. |
| throttle | object | – | Throttle patch, for example { enabled:true, minutes:15 }. |
No output schema declared.
No examples provided.
securenow_alert_rule_query_update Update System Alert Rule Query ~215
Admin-only: update the shared public query mapping behind a system alert rule for all customer copies. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| applyGlobally | boolean | – | Must be true. Updates the shared public query mapping used by all system rule copies. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| expectedCurrentSqlHash | string | – | Optional SHA-256 hash of the current SQL to prevent stale overwrites. |
| id | string | yes | Alert rule id. Must be a system rule. |
| reactivatePausedCopies | boolean | – | Whether to reactivate paused noisy copies after the query is tuned. |
| reason | string | yes | Short human-readable reason for the write action. |
| reviewNote | string | – | Optional review note. Defaults to reason. |
| reviewNotificationId | string | – | Optional notification id tied to this review/tuning action. |
| sqlQuery | string | yes | Full replacement SQL query. System SQL must keep __USER_APP_KEYS__ for tenant scoping. |
No output schema declared.
No examples provided.
securenow_alert_rule_rollback Roll Back Alert Rule ~141
Restore a prior version's full configuration onto a custom alert rule (re-validates the detection SQL first) and record it as a new version. Append-only history — you can roll back a rollback. System (read-only template) rules cannot be rolled back. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Alert rule id (must be a custom, non-system rule). |
| reason | string | yes | Short human-readable reason for the write action. |
| version | number | yes | Version number to restore. List options with securenow_alert_rule_versions. |
No output schema declared.
No examples provided.
securenow_alert_rule_test Test Alert Rule ~126
Start an alert rule test. Pass mode "dry_run" for a read-only query run; "live" (the server default when mode is omitted) inserts synthetic spans into the app's telemetry.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationKey | string | – | Application key to test. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Alert rule id. |
| mode | string | – | dry_run (read-only, recommended) or live (inserts synthetic spans). |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_alert_rule_test_result Get Alert Rule Test Result ~43
Poll alert rule test status and results.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Alert rule id. |
| testId | string | yes | Alert rule test id. |
No output schema declared.
No examples provided.
securenow_alert_rule_update Update Alert Rule ~215
Update alert rule scope/status/schedule/throttle or record a review action. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| alertChannelIds | array | – | Alert channel ids. |
| applications | array | – | Application keys when applicationsAll is false. |
| applicationsAll | boolean | – | Scope rule to all applications. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| description | string | – | Rule description for custom rules. |
| id | string | yes | Alert rule id. |
| name | string | – | Rule name for custom rules. |
| reason | string | yes | Short human-readable reason for the write action. |
| reviewAction | string | – | Rule review action, e.g. keep_active or saved_new_version. |
| reviewNote | string | – | Review note. |
| reviewNotificationId | string | – | Notification id tied to this review. |
| schedule | object | – | Schedule patch. |
| status | string | – | Active, Disabled, or Paused. |
| throttle | object | – | Throttle patch. |
No output schema declared.
No examples provided.
securenow_alert_rule_version_get Get Alert Rule Version ~68
Fetch one version's full material snapshot (name/severity/mode/schedule/throttle/instant/exclusions and the resolved detection SQL) for diffing before a rollback.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Alert rule id. |
| version | number | yes | Version number to fetch. |
No output schema declared.
No examples provided.
securenow_alert_rule_versions List Alert Rule Versions ~85
List a rule's configuration version history (newest first). Each material update (SQL/instant/settings), duplicate, and rollback is a version. Lazily seeds a v1 baseline for rules created before versioning.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Alert rule id. |
| limit | number | – | Maximum results to return. |
| page | number | – | Page number. |
No output schema declared.
No examples provided.
securenow_alert_rules_list List Alert Rules ~23
List alert rules, including system rules and app scope.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
securenow_allowlist_add Add Restrictive Allowlist IP ~245
Dangerous production action: add an IP/CIDR to the restrictive allowlist. Once active, allowlist mode blocks every IP except listed entries. Do not use this to mark an IP trusted or suppress false positives; use securenow_trusted_add instead. Requires explicit human approval confirming deny-all behavior.
| Name | Type | Req | Description |
|---|---|---|---|
| allowlistDenyAllApproved | boolean | yes | Must be true only after the user explicitly approves deny-by-default allowlist behavior. Do not set this for trusted IPs, monitors, false positives, or investigation cleanup. |
| applicationKeys | array | – | Application keys to scope this allowlist entry to. |
| applicationsAll | boolean | – | Apply to all applications. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| environment | string | – | Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production. |
| expiresAt | string | – | Optional expiry time as ISO 8601. |
| ip | string | yes | IPv4 address or CIDR. |
| label | string | – | Human-readable label. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_allowlist_list List Restrictive Allowlist ~112
List restrictive allowlist entries. If any active entry exists for an app/environment, only listed IPs can reach it and all other IPs are blocked. This is not the Trusted IP list.
| Name | Type | Req | Description |
|---|---|---|---|
| appKey | string | – | Optional application key scope. |
| environment | string | – | Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production. |
| limit | number | – | Maximum results to return. |
| page | number | – | Page number. |
No output schema declared.
No examples provided.
securenow_allowlist_remove Remove Allowed IP ~65
Remove an allowlist entry. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Allowlist entry id. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_analytics_summary Analytics Summary ~30
Fetch response analytics summary.
| Name | Type | Req | Description |
|---|---|---|---|
| instanceId | string | – | Optional ClickHouse instance id. |
No output schema declared.
No examples provided.
securenow_apps_create Create Application ~117
Create a SecureNow application. Write action; requires confirmation. Each app is billed $99/month on subscribed accounts (free during the 14-day trial). Confirm with the user before creating apps.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| hosts | array | – | Optional hostnames/domains for this application. |
| instanceId | string | – | Optional ClickHouse instance id. |
| name | string | yes | Application name. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_apps_info Get Application By Key ~30
Get details for an application by app key.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | Application key UUID. |
No output schema declared.
No examples provided.
securenow_apps_list List Applications ~20
List SecureNow applications for the authenticated user.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
securenow_auth_status SecureNow Auth Status ~27
Show local SecureNow credential source, selected app, and masked runtime API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
securenow_automation_defaults_ensure Ensure Default Automation Rules ~90
Create or refresh SecureNow default risk-score automation rules for the current account. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| forceEnableExisting | boolean | – | Re-enable existing SecureNow default rules if the customer disabled them. Defaults to false. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_automation_rule_create Create Automation Rule ~225
Create a blocklist automation rule. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| actions | array | yes | Action array, for example [{ "type":"addToBlocklist", "config":{ "reason":"...", "ttlHours":24 }}]. |
| applicationKeys | array | – | Application keys when not applying to all applications. |
| applicationsAll | boolean | – | Apply to all applications. |
| conditionLogic | string | – | AND or OR. |
| conditions | array | yes | Condition array. Fields include abuseConfidenceScore, riskScore, alertName, alertTag, attackType, path, environment. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| description | string | – | Optional rule description. |
| environments | array | – | Deployment environments when not applying to all environments. |
| environmentsAll | boolean | – | Apply to all environments. |
| name | string | yes | Rule name. |
| reason | string | yes | Short human-readable reason for the write action. |
| status | string | – | Initial rule status: active or disabled. Defaults to active. |
No output schema declared.
No examples provided.
securenow_automation_rule_delete Delete Automation Rule ~64
Delete an automation rule. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Automation rule id. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_automation_rule_dry_run Dry-Run Automation Rule ~58
Preview automation matches without writing blocklist entries.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Automation rule id. |
| limit | number | – | Maximum notifications to scan. |
| sampleLimit | number | – | Maximum sample matches to return. |
No output schema declared.
No examples provided.
securenow_automation_rule_execute Execute Automation Rule ~73
Execute an automation rule and add matching IPs to the blocklist. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Automation rule id. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_automation_rule_get Get Automation Rule ~28
Fetch one automation rule.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Automation rule id. |
No output schema declared.
No examples provided.
securenow_automation_rule_update Update Automation Rule ~179
Update a blocklist automation rule. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| actions | array | – | Action array. |
| applicationKeys | array | – | Application keys when not applying to all applications. |
| applicationsAll | boolean | – | Apply to all applications. |
| conditionLogic | string | – | AND or OR. |
| conditions | array | – | Condition array. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| description | string | – | Optional rule description. |
| environments | array | – | Deployment environments when not applying to all environments. |
| environmentsAll | boolean | – | Apply to all environments. |
| id | string | yes | Automation rule id. |
| name | string | – | Rule name. |
| reason | string | yes | Short human-readable reason for the write action. |
| status | string | – | active or disabled. |
No output schema declared.
No examples provided.
securenow_automation_rules_list List Automation Rules ~25
List blocklist automation rules with app/environment scope and stats.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
securenow_blocklist_add Add Blocked IP ~209
Add an IP/CIDR to the blocklist, optionally scoped to a route/method. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| appKey | string | – | Optional application key to scope this block. Omit for all apps. |
| confirm | boolean | yes | Required for write actions. Must be true. |
| environment | string | – | Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production. |
| expiresAt | string | – | Optional expiry time as ISO 8601. |
| ip | string | yes | IPv4 address or CIDR. |
| metadata | object | – | Optional metadata. |
| method | string | – | HTTP method scope. Defaults to ALL. |
| pathMatchMode | string | – | Path matching mode. Defaults to prefix. |
| pathPattern | string | – | Optional route/path pattern, for example /admin*. Omit to block all routes. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_blocklist_list List Blocklist ~138
List blocked IPs.
| Name | Type | Req | Description |
|---|---|---|---|
| appKey | string | – | Optional application key scope. |
| approvalStatus | string | – | Optional approval filter: pending, approved, or rejected. |
| environment | string | – | Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production. |
| limit | number | – | Maximum results to return. |
| page | number | – | Page number. |
| search | string | – | Optional IP prefix search. |
| status | string | – | Block entry status: active or removed. Defaults to active. |
| view | string | – | List view: all or operational. |
No output schema declared.
No examples provided.
securenow_blocklist_pending_approve Approve Pending Block ~76
Approve one pending blocklist entry so the firewall enforces it. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| id | string | yes | Pending blocklist entry id. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_blocklist_pending_bulk_approve Bulk Approve Pending Blocks ~84
Approve multiple pending blocklist entries after they have all been reviewed under the same safe policy. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| ids | array | yes | Pending blocklist entry ids to approve. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_blocklist_pending_bulk_reject Bulk Reject Pending Blocks ~86
Reject multiple pending blocklist entries after they have all been reviewed as false positives or stale/ambiguous. Write action; requires confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Required for write actions. Must be true. |
| ids | array | yes | Pending blocklist entry ids to reject. |
| reason | string | yes | Short human-readable reason for the write action. |
No output schema declared.
No examples provided.
securenow_blocklist_pending_list List Pending Block Approvals ~108
List legacy or AI-prepared blocklist entries with approvalStatus=pending. Pending blocks are not enforced until approved.
| Name | Type | Req | Description |
|---|---|---|---|
| appKey | string | – | Optional application key scope. |
| environment | string | – | Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production. |
| limit | number | – | Maximum results to return. |
| page | number | – | Page number. |
| search | string | – | Optional IP prefix search. |
No output schema declared.
No examples provided.
How do I install the SecureNow MCP server?
SecureNow runs locally as an npm package, launched with npx -y securenow. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · securenow
claude mcp add ai-securenow-securenow -- npx -y securenow
What is the SecureNow MCP server?
SecureNow is an MCP server listed in the public MCP registry as ai.securenow/securenow. Production security for Node.js apps: investigate live attacks, block IPs, tune detections. This page covers its npm package (securenow).
Is the SecureNow MCP server safe to use?
SecureNow scores 72 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SecureNow MCP server expose?
SecureNow exposes 90 tools: securenow_auth_status, securenow_apps_list, securenow_apps_create, securenow_apps_info, securenow_firewall_apps, and 85 more. Their descriptions and schemas cost roughly 12,187 tokens of context every time the server is loaded.
Is the SecureNow MCP server still maintained?
SecureNow is still listed as active in the MCP registry. We last reached this channel on 22 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SecureNow MCP server under?
SecureNow declares the ISC licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.