# SecureNow (npm · securenow)

Production security for Node.js apps: investigate live attacks, block IPs, tune detections.

- Trust score: 73/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- remote · `api.securenow.ai`: 39/100, [markdown](https://verifymcp.io/servers/ai-securenow-securenow/api.md), [page](https://verifymcp.io/servers/ai-securenow-securenow/api)
- npm · `securenow`: 73/100 (this document), [markdown](https://verifymcp.io/servers/ai-securenow-securenow/securenow.md), [page](https://verifymcp.io/servers/ai-securenow-securenow/securenow)

## Channel facts

- Registry: `npm`
- Package: `securenow`
- Version: `8.12.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 37 of 195 dependencies flagged as unhealthy (8 deprecated).
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (ISC).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 78/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 12261 tokens (~129/item across 95 items; 90 tools + 5 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 91 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the SecureNow MCP server?

SecureNow runs locally as an npm package, launched with npx -y securenow. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add ai-securenow-securenow -- npx -y securenow
```

### Cursor

```json
{
  "mcpServers": {
    "ai-securenow-securenow": {
      "command": "npx",
      "args": [
        "-y",
        "securenow"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ai-securenow-securenow": {
      "command": "npx",
      "args": [
        "-y",
        "securenow"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add ai-securenow-securenow -- npx -y securenow
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-securenow-securenow": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "securenow"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ai-securenow-securenow --command npx --arg -y --arg securenow
```

### Hermes

```yaml
mcp_servers:
  ai-securenow-securenow:
    command: "npx"
    args: ["-y", "securenow"]
```

### Netclaw

```json
{
  "McpServers": {
    "ai-securenow-securenow": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "securenow"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add ai-securenow-securenow -t stdio -c npx -a -y securenow
```

### Other

```json
{
  "mcpServers": {
    "ai-securenow-securenow": {
      "command": "npx",
      "args": [
        "-y",
        "securenow"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-23 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-21 (score 72, +1)

- [functional regression] Dependency health: 0.96 → 0.91

### 2026-10-19 (score 71)

First indexed and scored.

## MCP tools (90)

### `securenow_auth_status` (~27 tokens)

SecureNow Auth Status

Show local SecureNow credential source, selected app, and masked runtime API key.

### `securenow_apps_list` (~20 tokens)

List Applications

List SecureNow applications for the authenticated user.

### `securenow_apps_create` (~117 tokens)

Create Application

Create a SecureNow application. Write action; requires confirmation. Each app is billed $99/month on subscribed accounts (free during the 14-day trial). Confirm with the user before creating apps.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `hosts` (array): Optional hostnames/domains for this application.
- `instanceId` (string): Optional ClickHouse instance id.
- `name` (string, required): Application name.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_apps_info` (~30 tokens)

Get Application By Key

Get details for an application by app key.

Input parameters:

- `key` (string, required): Application key UUID.

### `securenow_firewall_apps` (~26 tokens)

List Firewall Apps

List applications with firewall toggle and SecureNow AI IPDB threshold state.

### `securenow_firewall_status` (~71 tokens)

Firewall Status

Show firewall blocklist/allowlist status for the authenticated account.

Input parameters:

- `appKey` (string): Optional application key UUID to scope the status check.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.

### `securenow_firewall_enable` (~95 tokens)

Enable App Firewall

Turn the per-app firewall ON. Write action; requires confirmation.

Input parameters:

- `appKey` (string, required): Application key UUID.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_firewall_disable` (~95 tokens)

Disable App Firewall

Turn the per-app firewall OFF. Write action; requires confirmation.

Input parameters:

- `appKey` (string, required): Application key UUID.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_firewall_set_threshold` (~117 tokens)

Set SecureNow AI IPDB Threshold

Set the per-app SecureNow AI IPDB confidence threshold. Write action; requires confirmation.

Input parameters:

- `appKey` (string, required): Application key UUID.
- `confidenceMinimum` (number, required): Minimum SecureNow AI IPDB confidence score.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_firewall_test_ip` (~86 tokens)

Test Firewall IP Decision

Check whether an IP would be blocked by the firewall.

Input parameters:

- `appKey` (string): Optional application key UUID to test the app/environment toggle and scoped lists.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `ip` (string, required): IPv4 address to test.

### `securenow_traces_list` (~108 tokens)

List Traces

List recent traces for one or more applications.

Input parameters:

- `appKeys` (required): Application key or comma-separated/list of application keys.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `from` (string): Start time as ISO 8601, optional.
- `limit` (number): Maximum traces to return.
- `to` (string): End time as ISO 8601, optional.

### `securenow_traces_show` (~80 tokens)

Show Trace

Show spans for a trace id scoped to one or more app keys.

Input parameters:

- `appKeys` (required): Application key or comma-separated/list of application keys.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `traceId` (string, required): Trace id.

### `securenow_logs_list` (~117 tokens)

List Logs

List recent logs for one or more applications.

Input parameters:

- `appKeys` (required): Application key or comma-separated/list of application keys.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `from` (string): Start time as ISO 8601, optional.
- `limit` (number): Maximum logs to return.
- `severity` (string): Optional severity filter.
- `to` (string): End time as ISO 8601, optional.

### `securenow_logs_for_trace` (~74 tokens)

Logs For Trace

Show logs correlated to a trace id.

Input parameters:

- `appKeys` (required): Application key or comma-separated/list of application keys.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `traceId` (string, required): Trace id.

### `securenow_notifications_list` (~35 tokens)

List Notifications

List security notifications.

Input parameters:

- `limit` (number): Maximum results to return.
- `page` (number): Page number.

### `securenow_notifications_unread` (~17 tokens)

Unread Notification Count

Return unread notification count.

### `securenow_notifications_read` (~62 tokens)

Mark Notification Read

Mark a notification as read. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Notification id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_notifications_get` (~35 tokens)

Get Notification

Get one notification/case with alert context, clusters, and IP investigations.

Input parameters:

- `id` (string, required): Notification id.

### `securenow_notifications_batch_get` (~38 tokens)

Get Notifications Batch

Fetch multiple notification/case records in one request.

Input parameters:

- `ids` (array, required): Notification ids to fetch, up to 50.

### `securenow_human_actions_list` (~67 tokens)

List Human Action Queue

List approval-gated human decisions prepared by SecureNow AI, ordered by urgency.

Input parameters:

- `limit` (number): Maximum results to return.
- `page` (number): Page number.
- `search` (string): Optional search over IP, rule, path, or verdict.

### `securenow_human_actions_grouped_list` (~77 tokens)

List Grouped Human Actions

List Requires Human work as root-cause groups with batch-safety preview instead of one row per IP/action.

Input parameters:

- `limit` (number): Maximum results to return.
- `page` (number): Page number.
- `search` (string): Optional search over IP, rule, path, action, or verdict.

### `securenow_alert_review_runs_list` (~158 tokens)

List Alert Review Root Causes

List pending alert-review runs as root-cause groups with batch-action preview, rather than row-by-row noisy alert triage.

Input parameters:

- `groupKey` (string): Compatibility alias for rootCauseKey.
- `includeRuns` (boolean): Whether to include compact matching run rows in the response.
- `limit` (number): Maximum results to return.
- `maxScan` (number): Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.
- `page` (number): Page number.
- `rootCauseKey` (string): Optional root-cause group key to filter to one group.
- `search` (string): Optional search over rule, route, IP, evidence, or proposed guard.

### `securenow_alert_review_runs_count` (~76 tokens)

Count Alert Review Runs

Count pending alert-review rows and the root-cause groups they collapse into.

Input parameters:

- `maxScan` (number): Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.
- `search` (string): Optional search over rule, route, IP, evidence, or proposed guard.

### `securenow_alert_review_run_get` (~77 tokens)

Get Alert Review Run

Fetch one pending-review alert run with its root-cause key, evidence-quality score, and similar open siblings.

Input parameters:

- `id` (string, required): Notification id for the alert review run.
- `maxScan` (number): Maximum pending-review rows to scan for similar siblings. Defaults to 500, capped at 1000.

### `securenow_alert_review_run_resolve` (~305 tokens)

Resolve Alert Review Run

Close one pending alert-review row with an auditable no-write decision report.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `id` (string, required): Notification id for the alert review run.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_alert_review_run_dismiss` (~306 tokens)

Dismiss Alert Review Run

Dismiss one pending alert-review row with an audit report and no enforcement write.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `id` (string, required): Notification id for the alert review run.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_alert_review_run_keep_alive` (~332 tokens)

Keep Alert Rule Active

Mark the noisy/paused alert rule as reviewed, keep it active, and close the pending alert-review row with an audit report.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `id` (string, required): Notification id for the alert review run.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewNote` (string): Optional rule-review note. Defaults to reason.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_alert_review_run_apply_group_decision` (~516 tokens)

Apply Alert Review Group Decision

Apply one verified no-write decision report to every currently matching alert-review row in a root-cause group, leaving non-matching rows open.

Input parameters:

- `allowMixed` (boolean): Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `groupKey` (string): Compatibility alias for rootCauseKey.
- `ips` (array): IP addresses affected by this case-level decision report.
- `maxRows` (number): Maximum rows to close in this batch. Defaults to 100, capped at 250.
- `maxScan` (number): Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `notificationIds` (array): Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `previewOnly` (boolean): When true, returns the eligible rows without writing.
- `prototypeRunId` (string): Optional notification id whose root-cause key should be used.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `rootCauseKey` (string): Root-cause group key from securenow_alert_review_runs_list.
- `search` (string): Optional search filter applied before grouping.
- `status` (string): Resolution status: resolved or dismissed. Defaults to resolved.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_alert_review_apply_group_decision` (~501 tokens)

Apply Alert Review Group Decision

Compatibility alias for securenow_alert_review_run_apply_group_decision.

Input parameters:

- `allowMixed` (boolean): Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `groupKey` (string): Compatibility alias for rootCauseKey.
- `ips` (array): IP addresses affected by this case-level decision report.
- `maxRows` (number): Maximum rows to close in this batch. Defaults to 100, capped at 250.
- `maxScan` (number): Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `notificationIds` (array): Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `previewOnly` (boolean): When true, returns the eligible rows without writing.
- `prototypeRunId` (string): Optional notification id whose root-cause key should be used.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `rootCauseKey` (string): Root-cause group key from securenow_alert_review_runs_list.
- `search` (string): Optional search filter applied before grouping.
- `status` (string): Resolution status: resolved or dismissed. Defaults to resolved.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_alert_review_group_similar` (~96 tokens)

List Similar Alert Review Runs

Fetch the current rows in one alert-review root-cause group for preview before a batch decision.

Input parameters:

- `groupKey` (string): Compatibility alias for rootCauseKey.
- `maxScan` (number): Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.
- `rootCauseKey` (string): Root-cause group key from securenow_alert_review_runs_list.

### `securenow_human_action_report` (~65 tokens)

Get Human Action Report

Fetch the full IP investigation report, investigation steps, proofs, metadata, and AI decision for one human action row.

Input parameters:

- `ip` (string, required): IP address from the human action row.
- `notificationId` (string, required): Notification id from the human action row.

### `securenow_human_action_block` (~368 tokens)

Approve AI Block Recommendation

Approve the AI-prepared block decision for an IP and optionally attach a structured decision report to the IP history. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `ip` (string, required): IP address to block.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `note` (string): Audit note explaining why the AI block was approved.
- `notificationId` (string, required): Notification id from the human action row.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `riskScore` (number): Optional risk score.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.
- `verdict` (string): Optional final verdict text.

### `securenow_human_action_decision_report_add` (~351 tokens)

Record Human Action Decision Report

Attach a structured analyst/MCP decision report to one Requires Human IP row without changing its status. Use for rate-limited, skipped, ambiguous, rule-tuning-needed, or already-handled rows. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `ip` (string, required): IP address for the report.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `notificationId` (string, required): Notification id from the human action row.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_human_action_close_no_write` (~346 tokens)

Close Human Action Without Enforcement

Close one Requires Human IP row with an auditable no-write decision report. Use for ambiguous, skipped, rule-tuning-needed, new-rule-needed, rate-limited, or already-handled rows.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `ip` (string, required): IP address for the row to close.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `notificationId` (string, required): Notification id from the human action row.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_human_action_false_positive` (~461 tokens)

Mark Human Action False Positive

Mark an AI-prepared human action as a scoped false positive and optionally attach a structured decision report to the IP history. Write action; requires confirmation.

Input parameters:

- `aiConfidence` (number): AI confidence for audit metadata.
- `applyToExisting` (boolean): Whether to apply to existing matching IP investigations.
- `conditions` (array): Restrictive false-positive conditions. Prefer app/rule/path/method/status/user-agent/body scope.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `createExclusion` (boolean): Whether to create a restrictive exclusion rule.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `ip` (string, required): IP address to mark as false positive.
- `ips` (array): IP addresses affected by this case-level decision report.
- `matchMode` (string): Condition match mode: all or any.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `notificationId` (string, required): Notification id from the human action row.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `ruleScope` (string): Scope: this_rule, specific_rules, all_existing, or any_rule.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `targetRuleIds` (array): Specific rule ids when ruleScope is specific_rules.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_human_case_action_update` (~373 tokens)

Update Case-Level Human Action

Approve, reject, execute, or fail a case-level proposed action such as tune_rule or create_exclusion. Write action; requires confirmation.

Input parameters:

- `actionKey` (string, required): Proposed action key from the row, for example tune_rule:...
- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `notificationId` (string, required): Notification id from the case-action row.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `result` (object): Optional structured result/audit details.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `status` (string, required): New status: proposed, approved, rejected, executed, or failed.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_human_case_decision_report_add` (~321 tokens)

Record Case Decision Report

Attach a structured analyst/MCP decision report to a notification/case without changing IP status or proposed action state. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `decisionReport` (object): Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.
- `decisionSummary` (string): Short decision summary to record on the IP/case history.
- `evidence` (array): Evidence strings that support the decision.
- `ips` (array): IP addresses affected by this case-level decision report.
- `methods` (array): HTTP methods reviewed for this decision.
- `missingProof` (array): Proof that was missing when the row is skipped or ambiguous.
- `notificationId` (string, required): Notification id from the case-action row.
- `outcome` (string): Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.
- `paths` (array): Paths/endpoints reviewed for this decision.
- `reason` (string, required): Short human-readable reason for the write action.
- `recommendations` (array): Follow-up recommendations to record with the decision.
- `reviewedHistory` (array): History/proofs reviewed before deciding.
- `statusCodes` (array): HTTP status codes reviewed for this decision.
- `traceIds` (array): Trace IDs reviewed for this decision.
- `userAgents` (array): User agents reviewed for this decision.

### `securenow_ip_lookup` (~32 tokens)

IP Intelligence Lookup

Look up SecureNow IP intelligence for an IP address.

Input parameters:

- `ip` (string, required): IPv4 address.

### `securenow_ip_traces` (~74 tokens)

IP Traces

Fetch traces associated with an IP address.

Input parameters:

- `appKeys`: Application key or comma-separated/list of application keys.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `ip` (string, required): IPv4 address.

### `securenow_forensics_query` (~124 tokens)

Run Forensics Query

Run a natural-language forensic query. Write scope because it creates an async query job.

Input parameters:

- `applicationId` (string): Optional application database id.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `instanceId` (string): Optional ClickHouse instance id.
- `query` (string, required): Natural-language forensic query.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_forensics_library` (~18 tokens)

Forensics Query Library

List saved forensics queries.

### `securenow_analytics_summary` (~30 tokens)

Analytics Summary

Fetch response analytics summary.

Input parameters:

- `instanceId` (string): Optional ClickHouse instance id.

### `securenow_automation_rules_list` (~25 tokens)

List Automation Rules

List blocklist automation rules with app/environment scope and stats.

### `securenow_automation_defaults_ensure` (~90 tokens)

Ensure Default Automation Rules

Create or refresh SecureNow default risk-score automation rules for the current account. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `forceEnableExisting` (boolean): Re-enable existing SecureNow default rules if the customer disabled them. Defaults to false.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_automation_rule_get` (~28 tokens)

Get Automation Rule

Fetch one automation rule.

Input parameters:

- `id` (string, required): Automation rule id.

### `securenow_automation_rule_create` (~225 tokens)

Create Automation Rule

Create a blocklist automation rule. Write action; requires confirmation.

Input parameters:

- `actions` (array, required): Action array, for example [{ "type":"addToBlocklist", "config":{ "reason":"...", "ttlHours":24 }}].
- `applicationKeys` (array): Application keys when not applying to all applications.
- `applicationsAll` (boolean): Apply to all applications.
- `conditionLogic` (string): AND or OR.
- `conditions` (array, required): Condition array. Fields include abuseConfidenceScore, riskScore, alertName, alertTag, attackType, path, environment.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `description` (string): Optional rule description.
- `environments` (array): Deployment environments when not applying to all environments.
- `environmentsAll` (boolean): Apply to all environments.
- `name` (string, required): Rule name.
- `reason` (string, required): Short human-readable reason for the write action.
- `status` (string): Initial rule status: active or disabled. Defaults to active.

### `securenow_automation_rule_update` (~179 tokens)

Update Automation Rule

Update a blocklist automation rule. Write action; requires confirmation.

Input parameters:

- `actions` (array): Action array.
- `applicationKeys` (array): Application keys when not applying to all applications.
- `applicationsAll` (boolean): Apply to all applications.
- `conditionLogic` (string): AND or OR.
- `conditions` (array): Condition array.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `description` (string): Optional rule description.
- `environments` (array): Deployment environments when not applying to all environments.
- `environmentsAll` (boolean): Apply to all environments.
- `id` (string, required): Automation rule id.
- `name` (string): Rule name.
- `reason` (string, required): Short human-readable reason for the write action.
- `status` (string): active or disabled.

### `securenow_automation_rule_dry_run` (~58 tokens)

Dry-Run Automation Rule

Preview automation matches without writing blocklist entries.

Input parameters:

- `id` (string, required): Automation rule id.
- `limit` (number): Maximum notifications to scan.
- `sampleLimit` (number): Maximum sample matches to return.

### `securenow_automation_rule_execute` (~73 tokens)

Execute Automation Rule

Execute an automation rule and add matching IPs to the blocklist. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Automation rule id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_automation_rule_delete` (~64 tokens)

Delete Automation Rule

Delete an automation rule. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Automation rule id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_rate_limit_list` (~117 tokens)

List Rate Limits

List rate-limit remediation rules with app/environment scope.

Input parameters:

- `appKey` (string): Optional application key scope.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `limit` (number): Maximum results to return.
- `page` (number): Page number.
- `search` (string): Optional IP/path/name search.
- `status` (string): Rule status: active, disabled, removed, or all. Defaults to active.

### `securenow_rate_limit_get` (~30 tokens)

Get Rate Limit

Fetch one rate-limit remediation rule.

Input parameters:

- `id` (string, required): Rate-limit rule id.

### `securenow_rate_limit_test` (~110 tokens)

Test Rate Limit Match

Check whether an IP/path/method would match an active rate-limit rule.

Input parameters:

- `appKey` (string): Optional application key scope.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `ip` (string, required): IPv4 address to test.
- `method` (string): HTTP method to test. Defaults to GET.
- `path` (string): Request path to test. Defaults to /.

### `securenow_rate_limit_remove` (~66 tokens)

Remove Rate Limit

Remove a rate-limit remediation rule. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Rate-limit rule id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_rate_limit_parse` (~82 tokens)

Parse Rate Limit Text

Use SecureNow AI to convert natural language into a rate-limit remediation draft without creating it.

Input parameters:

- `draft` (object): Optional existing draft fields to preserve or resolve phrases such as "this IP".
- `text` (string, required): Natural-language rate-limit request, e.g. "rate limit /api/login to 2 attempts per minute for this IP".

### `securenow_rate_limit_create_from_text` (~86 tokens)

Create Rate Limit From Text

Create a rate-limit remediation rule from natural language. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `draft` (object): Optional existing draft fields or scope hints.
- `reason` (string, required): Short human-readable reason for the write action.
- `text` (string, required): Natural-language rate-limit request.

### `securenow_alert_rules_list` (~23 tokens)

List Alert Rules

List alert rules, including system rules and app scope.

### `securenow_alert_rule_get` (~27 tokens)

Get Alert Rule

Fetch one alert rule.

Input parameters:

- `id` (string, required): Alert rule id.

### `securenow_alert_rule_versions` (~85 tokens)

List Alert Rule Versions

List a rule's configuration version history (newest first). Each material update (SQL/instant/settings), duplicate, and rollback is a version. Lazily seeds a v1 baseline for rules created before versioning.

Input parameters:

- `id` (string, required): Alert rule id.
- `limit` (number): Maximum results to return.
- `page` (number): Page number.

### `securenow_alert_rule_version_get` (~68 tokens)

Get Alert Rule Version

Fetch one version's full material snapshot (name/severity/mode/schedule/throttle/instant/exclusions and the resolved detection SQL) for diffing before a rollback.

Input parameters:

- `id` (string, required): Alert rule id.
- `version` (number, required): Version number to fetch.

### `securenow_alert_rule_rollback` (~141 tokens)

Roll Back Alert Rule

Restore a prior version's full configuration onto a custom alert rule (re-validates the detection SQL first) and record it as a new version. Append-only history — you can roll back a rollback. System (read-only template) rules cannot be rolled back. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Alert rule id (must be a custom, non-system rule).
- `reason` (string, required): Short human-readable reason for the write action.
- `version` (number, required): Version number to restore. List options with securenow_alert_rule_versions.

### `securenow_alert_rule_update` (~215 tokens)

Update Alert Rule

Update alert rule scope/status/schedule/throttle or record a review action. Write action; requires confirmation.

Input parameters:

- `alertChannelIds` (array): Alert channel ids.
- `applications` (array): Application keys when applicationsAll is false.
- `applicationsAll` (boolean): Scope rule to all applications.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `description` (string): Rule description for custom rules.
- `id` (string, required): Alert rule id.
- `name` (string): Rule name for custom rules.
- `reason` (string, required): Short human-readable reason for the write action.
- `reviewAction` (string): Rule review action, e.g. keep_active or saved_new_version.
- `reviewNote` (string): Review note.
- `reviewNotificationId` (string): Notification id tied to this review.
- `schedule` (object): Schedule patch.
- `status` (string): Active, Disabled, or Paused.
- `throttle` (object): Throttle patch.

### `securenow_alert_rule_query_update` (~215 tokens)

Update System Alert Rule Query

Admin-only: update the shared public query mapping behind a system alert rule for all customer copies. Write action; requires confirmation.

Input parameters:

- `applyGlobally` (boolean): Must be true. Updates the shared public query mapping used by all system rule copies.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `expectedCurrentSqlHash` (string): Optional SHA-256 hash of the current SQL to prevent stale overwrites.
- `id` (string, required): Alert rule id. Must be a system rule.
- `reactivatePausedCopies` (boolean): Whether to reactivate paused noisy copies after the query is tuned.
- `reason` (string, required): Short human-readable reason for the write action.
- `reviewNote` (string): Optional review note. Defaults to reason.
- `reviewNotificationId` (string): Optional notification id tied to this review/tuning action.
- `sqlQuery` (string, required): Full replacement SQL query. System SQL must keep __USER_APP_KEYS__ for tenant scoping.

### `securenow_alert_rule_instant_update` (~567 tokens)

Update Instant Alert Rule

Patch instant rule conditions/config with version/hash guards and before/after seeded tests. System rules require applyGlobally:true and admin permission. Write action; requires confirmation.

Input parameters:

- `applyGlobally` (boolean): Required true for system rules. Updates every customer copy of the system rule.
- `block` (boolean): Block the source IP when the instant conditions match. Has no effect while the rule is in test mode.
- `blockConditions` (array): Optional stricter conditions that must also match before blocking (same shape as conditions).
- `blockMatchMode` (string): Match mode for blockConditions: all or any (default any).
- `blockTtlHours` (number): How long an instant block lasts, in hours (default 1, max 168).
- `conditions` (array): Optional full replacement instant conditions array. Use operations for smaller patches.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `dryRun` (boolean): When true, validates and runs before/after seeded tests without saving.
- `enabled` (boolean): Whether instant detection is enabled.
- `executionMode` (string): Rule execution mode: instant or hybrid when instant detection is enabled.
- `expectedCurrentInstantHash` (string, required): Required SHA-256 hash of the current instant config from securenow_alert_rule_get.
- `expectedCurrentRuleHash` (string): Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_get.
- `expectedRuleVersion` (number, required): Required current reviewState.reviewVersion from securenow_alert_rule_get.
- `fixtures` (array): Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.
- `id` (string, required): Alert rule id. Fetch with securenow_alert_rule_get first to get ruleVersion and instantHash.
- `matchMode` (string): Condition match mode: all or any.
- `operations` (array): Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update.
- `reactivatePausedCopies` (boolean): Whether to reactivate paused noisy copies after the instant rule is tuned.
- `reason` (string, required): Short human-readable reason for the write action.
- `reviewNote` (string): Optional review note. Defaults to reason.
- `reviewNotificationId` (string): Optional notification id tied to this review/tuning action.
- `severity` (string): Optional severity override: critical, high, medium, or low.
- `source` (string): Instant event source. Currently trace.
- `throttle` (object): Throttle patch, for example { enabled:true, minutes:15 }.

### `securenow_alert_rule_conditions_get` (~39 tokens)

Get Alert Rule Conditions

Fetch instant rule conditions with rule version and hash guards for safe condition-level tuning.

Input parameters:

- `id` (string, required): Alert rule id.

### `securenow_alert_rule_condition_update` (~400 tokens)

Update Alert Rule Condition

Patch instant alert-rule conditions with version/hash guards and seeded before/after tests. Compatibility alias for condition-level tuning.

Input parameters:

- `applyGlobally` (boolean): Required true for system rules. Updates every customer copy of the system rule.
- `conditions` (array): Optional full replacement instant conditions array. Use operations for smaller patches.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `enabled` (boolean): Whether instant detection is enabled.
- `executionMode` (string): Rule execution mode: instant or hybrid when instant detection is enabled.
- `expectedCurrentInstantHash` (string, required): Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.
- `expectedCurrentRuleHash` (string): Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.
- `expectedRuleVersion` (number, required): Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.
- `fixtures` (array): Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.
- `id` (string, required): Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.
- `matchMode` (string): Condition match mode: all or any.
- `operations` (array): Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update.
- `reactivatePausedCopies` (boolean): Whether to reactivate paused noisy copies after the condition is tuned.
- `reason` (string, required): Short human-readable reason for the write action.
- `reviewNote` (string): Optional review note. Defaults to reason.
- `reviewNotificationId` (string): Optional notification id tied to this review/tuning action.
- `source` (string): Instant event source. Currently trace.

### `securenow_alert_rule_condition_candidate_test` (~353 tokens)

Test Alert Rule Condition Candidate

Dry-run a condition-level instant-rule patch without saving it, including seeded benign/attack fixture checks.

Input parameters:

- `applyGlobally` (boolean): Required true for system rules, even for admin dry-runs.
- `conditions` (array): Optional full replacement instant conditions array to test.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `enabled` (boolean): Whether instant detection would be enabled.
- `executionMode` (string): Rule execution mode: instant or hybrid when instant detection is enabled.
- `expectedCurrentInstantHash` (string, required): Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.
- `expectedCurrentRuleHash` (string): Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.
- `expectedRuleVersion` (number, required): Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.
- `fixtures` (array): Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.
- `id` (string, required): Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.
- `matchMode` (string): Condition match mode: all or any.
- `operations` (array): Candidate condition operations to test.
- `reason` (string, required): Short human-readable reason for the write action.
- `reviewNote` (string): Optional review note. Defaults to reason.
- `reviewNotificationId` (string): Optional notification id tied to this review/tuning action.
- `source` (string): Instant event source. Currently trace.

### `securenow_alert_rule_condition_diff` (~302 tokens)

Diff Alert Rule Condition Candidate

Return the current instant conditions, candidate conditions, hashes, and before/after fixture behavior without saving.

Input parameters:

- `applyGlobally` (boolean): Required true for system rules, even for admin dry-runs.
- `conditions` (array): Optional full replacement instant conditions array to diff.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `enabled` (boolean): Whether instant detection would be enabled.
- `executionMode` (string): Rule execution mode: instant or hybrid when instant detection is enabled.
- `expectedCurrentInstantHash` (string, required): Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.
- `expectedCurrentRuleHash` (string): Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.
- `expectedRuleVersion` (number, required): Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.
- `fixtures` (array): Optional seeded fixtures used to explain benign removals and attack coverage.
- `id` (string, required): Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.
- `matchMode` (string): Condition match mode: all or any.
- `operations` (array): Candidate condition operations to diff.
- `reason` (string, required): Short human-readable reason for the write action.
- `source` (string): Instant event source. Currently trace.

### `securenow_alert_rule_test` (~126 tokens)

Test Alert Rule

Start an alert rule test. Pass mode "dry_run" for a read-only query run; "live" (the server default when mode is omitted) inserts synthetic spans into the app's telemetry.

Input parameters:

- `applicationKey` (string): Application key to test.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Alert rule id.
- `mode` (string): dry_run (read-only, recommended) or live (inserts synthetic spans).
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_alert_rule_candidate_test` (~98 tokens)

Dry-Run Candidate Alert Rule SQL

Dry-run a candidate SQL/query guard for an alert rule without saving it.

Input parameters:

- `applicationKey` (string): Application key to test.
- `candidateSqlQuery` (string, required): Full candidate SQL query to dry-run without saving.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Alert rule id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_alert_rule_test_result` (~43 tokens)

Get Alert Rule Test Result

Poll alert rule test status and results.

Input parameters:

- `id` (string, required): Alert rule id.
- `testId` (string, required): Alert rule test id.

### `securenow_alert_rule_exclusions_list` (~32 tokens)

List Alert Rule Exclusions

List exclusions embedded on one alert rule.

Input parameters:

- `id` (string, required): Alert rule id.

### `securenow_alert_rule_exclusion_add` (~115 tokens)

Add Alert Rule Exclusion

Add a restrictive exclusion to one alert rule. Write action; requires confirmation.

Input parameters:

- `conditions` (array): Restrictive exclusion conditions.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Alert rule id.
- `isActive` (boolean): Whether the exclusion is active.
- `matchMode` (string): all or any.
- `pathPattern` (string): Optional path pattern.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_alert_rule_exclusion_remove` (~77 tokens)

Remove Alert Rule Exclusion

Remove an alert rule exclusion. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `exclusionId` (string, required): Exclusion id.
- `id` (string, required): Alert rule id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_list` (~138 tokens)

List Blocklist

List blocked IPs.

Input parameters:

- `appKey` (string): Optional application key scope.
- `approvalStatus` (string): Optional approval filter: pending, approved, or rejected.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `limit` (number): Maximum results to return.
- `page` (number): Page number.
- `search` (string): Optional IP prefix search.
- `status` (string): Block entry status: active or removed. Defaults to active.
- `view` (string): List view: all or operational.

### `securenow_blocklist_pending_list` (~108 tokens)

List Pending Block Approvals

List legacy or AI-prepared blocklist entries with approvalStatus=pending. Pending blocks are not enforced until approved.

Input parameters:

- `appKey` (string): Optional application key scope.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `limit` (number): Maximum results to return.
- `page` (number): Page number.
- `search` (string): Optional IP prefix search.

### `securenow_blocklist_pending_approve` (~76 tokens)

Approve Pending Block

Approve one pending blocklist entry so the firewall enforces it. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Pending blocklist entry id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_pending_reject` (~75 tokens)

Reject Pending Block

Reject one pending blocklist entry and remove it from enforcement consideration. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Pending blocklist entry id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_pending_bulk_approve` (~84 tokens)

Bulk Approve Pending Blocks

Approve multiple pending blocklist entries after they have all been reviewed under the same safe policy. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `ids` (array, required): Pending blocklist entry ids to approve.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_pending_bulk_reject` (~86 tokens)

Bulk Reject Pending Blocks

Reject multiple pending blocklist entries after they have all been reviewed as false positives or stale/ambiguous. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `ids` (array, required): Pending blocklist entry ids to reject.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_add` (~209 tokens)

Add Blocked IP

Add an IP/CIDR to the blocklist, optionally scoped to a route/method. Write action; requires confirmation.

Input parameters:

- `appKey` (string): Optional application key to scope this block. Omit for all apps.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `expiresAt` (string): Optional expiry time as ISO 8601.
- `ip` (string, required): IPv4 address or CIDR.
- `metadata` (object): Optional metadata.
- `method` (string): HTTP method scope. Defaults to ALL.
- `pathMatchMode` (string): Path matching mode. Defaults to prefix.
- `pathPattern` (string): Optional route/path pattern, for example /admin*. Omit to block all routes.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_remove` (~74 tokens)

Unblock IP (Compat Alias)

Compatibility alias for unblocking a blocklist entry while retaining block report/history. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Blocklist entry id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_unblock` (~84 tokens)

Unblock IP And Keep History

Unblock a blocklist entry so firewall enforcement stops, while retaining the block report, history, and unblock audit trail. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Blocklist entry id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_blocklist_stats` (~17 tokens)

Blocklist Stats

Return blocklist statistics.

### `securenow_allowlist_list` (~112 tokens)

List Restrictive Allowlist

List restrictive allowlist entries. If any active entry exists for an app/environment, only listed IPs can reach it and all other IPs are blocked. This is not the Trusted IP list.

Input parameters:

- `appKey` (string): Optional application key scope.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `limit` (number): Maximum results to return.
- `page` (number): Page number.

### `securenow_allowlist_add` (~245 tokens)

Add Restrictive Allowlist IP

Dangerous production action: add an IP/CIDR to the restrictive allowlist. Once active, allowlist mode blocks every IP except listed entries. Do not use this to mark an IP trusted or suppress false positives; use securenow_trusted_add instead. Requires explicit human approval confirming deny-all behavior.

Input parameters:

- `allowlistDenyAllApproved` (boolean, required): Must be true only after the user explicitly approves deny-by-default allowlist behavior. Do not set this for trusted IPs, monitors, false positives, or investigation cleanup.
- `applicationKeys` (array): Application keys to scope this allowlist entry to.
- `applicationsAll` (boolean): Apply to all applications.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `expiresAt` (string): Optional expiry time as ISO 8601.
- `ip` (string, required): IPv4 address or CIDR.
- `label` (string): Human-readable label.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_allowlist_remove` (~65 tokens)

Remove Allowed IP

Remove an allowlist entry. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Allowlist entry id.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_trusted_list` (~78 tokens)

List Trusted IPs

List trusted IPs. Trusted IPs are for known-safe traffic and do not turn on deny-by-default allowlist mode.

Input parameters:

- `appKey` (string): Optional application key scope.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.

### `securenow_trusted_add` (~188 tokens)

Add Trusted IP

Add a trusted IP/CIDR for known-safe infrastructure, monitors, office/VPN traffic, or scoped false-positive suppression. This does not enable deny-by-default allowlist mode and is the correct tool when an IP should be trusted without blocking other visitors. Write action; requires confirmation.

Input parameters:

- `applicationKeys` (array): Application keys to scope this trusted IP to.
- `applicationsAll` (boolean): Apply to all applications.
- `confirm` (boolean, required): Required for write actions. Must be true.
- `environment` (string): Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.
- `ip` (string, required): IPv4 address or CIDR.
- `label` (string): Human-readable label.
- `note` (string): Optional note.
- `reason` (string, required): Short human-readable reason for the write action.

### `securenow_trusted_remove` (~65 tokens)

Remove Trusted IP

Remove a trusted IP entry. Write action; requires confirmation.

Input parameters:

- `confirm` (boolean, required): Required for write actions. Must be true.
- `id` (string, required): Trusted IP entry id.
- `reason` (string, required): Short human-readable reason for the write action.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/ai-securenow-securenow/securenow#diagnostics

## Score history

- 2026-10-23: 73
- 2026-10-22: 72
- 2026-10-21: 72
- 2026-10-20: 71
- 2026-10-19: 71

## Common questions

### What is the SecureNow MCP server?

SecureNow is an MCP server listed in the public MCP registry as ai.securenow/securenow. Production security for Node.js apps: investigate live attacks, block IPs, tune detections. This page covers its npm package (securenow).

### Is the SecureNow MCP server safe to use?

SecureNow scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the SecureNow MCP server expose?

SecureNow exposes 90 tools: securenow_auth_status, securenow_apps_list, securenow_apps_create, securenow_apps_info, securenow_firewall_apps, and 85 more. Their descriptions and schemas cost roughly 12,187 tokens of context every time the server is loaded.

### Is the SecureNow MCP server still maintained?

SecureNow is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the SecureNow MCP server under?

SecureNow declares the ISC licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/securenow
- Socket report: https://socket.dev/npm/package/securenow
- Repository: https://github.com/securenow-ai/securenow-npm
- Website: https://securenow.ai/cli+mcp
- Changelog RSS feed: https://verifymcp.io/servers/ai-securenow-securenow/securenow.xml
- Changelog JSON feed: https://verifymcp.io/servers/ai-securenow-securenow/securenow.json
- HTML version of this page: https://verifymcp.io/servers/ai-securenow-securenow/securenow