Give your coding agent eyes into production security.
SecureNow shows Claude Code, Cursor, and Codex what's attacking your live app — and gives them the controls to stop it. Your agent investigates the attackers, traces, and IPs, then proposes a block, a rate limit, or a new detection for you to approve.
One npm package · about 2 minutes to set up · no proxy, no DNS changes
The prompt has your agent install SecureNow, connect MCP, and run a first security baseline.
- 14 days free
- No credit card
- Every feature
›what's attacking production right now?
securenow_forensics_querylast 1h · production
Credential stuffing on POST /api/login
63 IPs · 19 accounts targeted · 11 on known-bad lists
securenow_ip_lookup ×11reputation + history
Proposed
→Block the 11 known-bad IPs for 24h
→Rate-limit POST /api/login · 5/min per IP
securenow_blocklist_addconfirm: true · reason
securenow_rate_limit_create_from_text
✓Done · logged to Agent Audit · reversible
See SecureNow end to end.
Install it in three commands, then watch it protect, investigate, and threat-model a Node.js app — from the dashboard, the CLI, and your coding agent.
Your agent can read your code. It can't see who's attacking it.
Coding agents ship and fix code all day, but production is invisible to them. Scanners hunt for your .env file, bots hammer your login, and payloads aim at your database — and without production evidence, you find out late, if at all.
Without SecureNow
- Your agent guesses from the code
- Attacks hide in raw logs nobody reads
- Blocking an IP means a proxy or WAF change
- Nobody is watching at 3 a.m.
With SecureNow
- Your agent queries live attacks, traces, and IP history
- Detections and AI investigations surface what matters
- Block, rate-limit, or challenge from your agent, enforced inside your app
- The firewall and your detections keep watching
Ask in plain English. Your agent does the security work.
The SecureNow MCP server gives your coding agent 90 tools — 44 to read, 46 to act — plus the full CLI. Once SecureNow is connected, paste any of these into your agent.
What's attacking production right now?
Queries your live traffic and groups the attackers by IP, route, and pattern.
securenow_forensics_queryIs anyone brute-forcing /api/login?
Counts failed logins per IP — and per account if you send login events — then checks each IP's reputation.
securenow_forensics_querysecurenow_ip_lookupBlock those IPs for 24 hours.
Adds them to your blocklist with an expiry. The write only runs with confirm: true and a reason.
securenow_blocklist_addRate-limit POST /api/login to 5 per minute per IP.
Turns the sentence into a rate-limit rule. Requests over the limit get HTTP 429.
securenow_rate_limit_create_from_textAlert me when one IP fails login 5 times in a minute.
Writes the SQL detection, validates it, and ships it in test mode so you can dry-run it first.
securenow alerts rulesWork the security queue.
Reviews the decisions SecureNow's AI prepared and proposes a block, a rate limit, or a false positive for each.
securenow_human_actions_listConnect your agent in seconds.
npx securenow login claude mcp add securenow -- npx securenow mcp
// .cursor/mcp.json
{ "mcpServers": { "securenow":
{ "command": "npx", "args": ["securenow", "mcp"] } } }npx securenow login codex mcp add securenow -- npx securenow mcp
Using Claude Desktop or another MCP client? Point it at https://api.securenow.ai/mcp with an API key. No MCP? Any agent that can run shell commands can drive the securenow CLI.
About two minutes from one prompt to protected.
No proxy, no DNS change, no infrastructure work. SecureNow runs inside your Node.js app.
- 1
Paste one prompt
Your agent installs the package, signs you in, adds the preload flag (or runs init for Next.js and Nuxt), verifies telemetry, and connects MCP.
- 2
SecureNow watches production
The firewall blocks known-bad IPs from the first request. Detections run on your live traffic, and alerting IPs get an AI investigation.
- 3
Your agent investigates and responds
Ask anything. Review the evidence with trace IDs. Approve a block, a rate limit, or a new detection — every write is confirmed and logged.
Add SecureNow production security to this project. Docs: https://www.npmjs.com/package/securenow 1. Install the package: npm i securenow 2. Connect my SecureNow account: npx securenow login (I'll finish the sign-in in the browser; it writes .securenow/runtime.json and .securenow/admin.json.) 3. Wire the runtime: run npx securenow init for Next.js or Nuxt; for other Node servers (Express, Fastify, NestJS, Koa, Hapi) add -r securenow/register to the start script. 4. Keep the .securenow/*.json credential files out of git (don't ignore the whole .securenow/ folder). 5. Verify: npx securenow doctor, npx securenow test-span, npx securenow status. 6. Connect the SecureNow MCP server to yourself, for example: claude mcp add securenow -- npx securenow mcp 7. Run a first production-security baseline and summarize what you find. Do not block traffic or change security policy without asking me first.
Everything your agent sees, you can see too.
The same evidence and the same controls, in the browser — for the moments you'd rather click than type.
Every app and API in one place
Live status, hosts, and tech stack for each app, across production, staging, and preview.
Real dashboard screens. App names, emails, and IPs are replaced with demo values.
Protect, investigate, and threat-model in one loop.
Use it from the dashboard, the CLI, or your coding agent.
Firewall
Known-bad IPs from a live threat feed, refreshed hourly, blocked in-process with HTTP 403. No proxy, no DNS change.
How the firewall worksDetections on live traffic
SQL rules over your traces and events — written by your agent, validated, and tested before they go live.
AI investigations
Alerting IPs get a reputation check, a trace and log review, and a verdict with a proposed action.
IP and range blocking
Block an IP or a CIDR range everywhere or on one route, with an optional expiry and full history.
Rate limits
Per IP or global, by route and method, written from a plain-English sentence. Over the limit: HTTP 429.
Bot challenge
An invisible proof-of-work check between rate limit and block. People pass in about a second; simple bots don't.
Login and session protection
Stream sign-ins with track(), tag sessions with guard(), and revoke a stolen session in one command.
Forensics
Ask questions about your traffic in plain English and get the query, the rows, and a chart.
Threat modeling
A free audit your own agent runs locally across 25 categories, with ready-to-run detections.
Run a free auditYour agent proposes. You decide.
Handing an agent production controls should feel safe. These guardrails are built in; your agent's own approval settings add another layer.
Read-only runbooks by default
The built-in agent runbooks prepare write calls for you to review instead of executing them.
Confirmation on every write
MCP write tools refuse to run without confirm: true and a reason.
Every agent action logged
Writes land in Agent Audit, so you can see what changed, when, and why.
Reversible responses
Blocks expire or lift in one command, rate limits come off, and revoked sessions can be restored.
Fails open by default
If SecureNow is unreachable, your app keeps serving requests. You can choose fail-closed instead.
You decide what's automatic
Keep responses approval-based, or let high-confidence detections and automation rules block on their own.
One plan. Every feature. Per app.
Try everything free for 14 days on your whole account — every app, every feature, no credit card. Then $99 per app per month.
SecureNow
Everything included$99/ app / month
Full production security for each app you connect. No tiers, no feature gates, no per-investigation fees.
Start 14-day free trial14 days. No credit card. Every feature.
Billed per app — add or remove apps any time.
e.g. 3 apps = $297/month
Every app gets
- Production attack detection on live traffic
- Firewall — known-bad IPs refreshed hourly, blocklists, rate limits
- Traces & logs with security context (7-day history)
- Custom detection rules
- Slack & email alerts
- AI investigations, with no per-run fees
- MCP server + CLI for Claude Code, Codex & Cursor
- Human-approved blocking & rate limits
- Team members
No free tier: when the trial ends, everything pauses until you subscribe — including the firewall.
SecureNow never needs your source code.
It works from runtime signals in your instrumented app. Credentials, cookies, card numbers, email addresses, and one-time codes are redacted inside your app before telemetry leaves it. What your agent receives is also subject to its provider's data policies.
- Default field redaction; configurable capture
- Configurable firewall outage behavior
- Read vs. write MCP tools, clearly separated
- MCP writes require confirmation and a reason
- Encrypted in transit and at rest
- Delete your data anytime
Built by an engineer who has seen real attacks.
Lhoussine Omary
Founder, SecureNow · ex-SAP · ethical hacker
I build SecureNow from the attacker's side of the table. Ex-SAP engineer and an ethical hacker credited by some of the largest security teams in the world for finding and responsibly disclosing real vulnerabilities. SecureNow is the tool I wanted as a founder: practical protection without hiring a security team.
Credited for responsible disclosure by
Questions before you install.
Which coding agents work with SecureNow?
Claude Code, Cursor, and Codex connect with one command or one config entry. Claude Desktop and any other MCP client can use the hosted server at https://api.securenow.ai/mcp with an API key. Agents that can run shell commands can also drive the securenow CLI directly.
Do I need a coding agent to use SecureNow?
No. The dashboard, CLI, detections, alerts, and blocking all work on their own. The agent workflow is where SecureNow shines, though: your coding agent already understands your code, and SecureNow gives it the production side — attacks, traces, IP intelligence, and response controls.
Can my coding agent change production security controls without me?
Only with the permissions you give it. MCP write tools require confirm: true and a reason, the built-in runbooks are read-only until you allow writes, and every write is logged in Agent Audit. Keep your agent's approval prompts on to review each change. Separately, the firewall and any automation rules you enable enforce on their own.
Does SecureNow read my source code?
No. SecureNow works from runtime signals in your instrumented app and does not require a repository upload. Your coding agent handles repository access under its own permissions and data policies, including when it runs the threat-modeling prompts.
What does my agent see about my users?
Request metadata, traces, logs, and security events from your app. Sensitive fields — credentials, cookies, card numbers, email addresses, one-time codes — are redacted inside your app before telemetry leaves it. Review capture settings such as request bodies to match your policies; data returned to your agent is also subject to its provider's policies.
Do I need to change my infrastructure?
No. SecureNow runs inside your Node.js app: one npm package and a preload flag, or npx securenow init for Next.js and Nuxt. No DNS move, no proxy, no load-balancer rules. It runs on the Node.js runtime; the Edge runtime isn't supported.
Will it slow down my app?
Telemetry exports asynchronously. The firewall's outage behavior is configurable: its default fail-open mode allows requests when SecureNow is unavailable, while fail-closed mode can reject them. Measure the integration with your own traffic and choose the behavior your application needs.
How is SecureNow different from an observability MCP server?
Observability MCP servers give agents errors, traces, and metrics. SecureNow is built around attacks: it detects them in your traffic, investigates the IPs and sessions involved, and gives your agent response controls — blocks, rate limits, challenges, detection rules, and session revocation through the CLI — that take effect inside your app.
Does my application need AI or LLM features?
No. SecureNow gives your coding agent evidence about a deployed web application: requests, traces, logs, attack signals, and response controls. Claude Code, Codex, or Cursor can investigate an ordinary Node.js or Next.js application using the same workflow.
How much does SecureNow cost?
$99 per app per month, with every feature included: attack detection, the firewall, traces and logs, custom detections, alerts, AI investigations with no per-run fees, the MCP server and CLI, and team members. Each app on your account is billed separately — three apps cost $297 per month — and you can add or remove apps any time, prorated.
What happens when the 14-day trial ends?
The trial covers your whole account — every app and every feature — with no credit card. There is no free tier, so when the trial ends, everything pauses until you subscribe, including the firewall.
Give your agent eyes into production in about two minutes.
14 days. No credit card. Every feature. Then $99 per app per month.