Give your coding agent eyes into production security.
SecureNow connects Claude Code, Codex, and Cursor to your live application security — attacks, routes, users, traces, IP intelligence, and response controls — through one Node.js package, CLI, and MCP server.
Your coding agent knows your code. SecureNow shows it what's happening in production.
> Investigate suspicious login activity from the last hour.
SecureNow found:
- • 1,482 failed login attempts
- • 63 source IPs
- • 19 user accounts targeted
- • 11 IPs match known malicious infrastructure
- • Pattern consistent with distributed credential stuffing
Recommended action:
- → Block 11 high-confidence sources
- → Rate-limit /api/auth/login
- → Review 3 successfully authenticated accounts
Your AI agent built your app. Now let it help secure production.
Your agent can read the code. It can't see the attack happening in production.
Coding agents are brilliant inside the repository and blind beyond it. SecureNow supplies the other half.
Your coding agent already sees
- Your repository
- Dependencies
- Auth implementation
- API handlers
- Database queries
SecureNow adds
- Live requests
- Routes, users & sessions
- Attack patterns
- IP intelligence
- Traces & logs
- Security history
- Block & rate-limit controls
Together → an agent that can investigate your actual production security.
From attack → explanation → response.
Not ten feature cards. One workflow your team will actually run — with your approval gating every change.
Detect
“812 failed login requests across 31 IPs in the last hour.” SecureNow watches production traffic and flags what matters.
Investigate
You ask Claude Code, Codex, or Cursor to look into it. The agent queries SecureNow through MCP.
Correlate
Accounts, IPs, routes, traces, and IP reputation come together into one picture of what's happening.
Decide
“High confidence: distributed credential stuffing targeting 19 accounts.” Evidence, not guesswork.
Respond
The agent proposes blocks, rate limits, or a new detection rule. You approve. It executes. Every action is reversible.
Verify
The agent checks that the attack traffic actually stopped — and keeps the detection in place for next time.
You stay in control
Detection and investigation run automatically. Remediation is proposed, waits for your approval, and is reversible. Once you trust a specific detection, opt it into automatic blocking — rule by rule, on your terms.
Security that speaks your agent's language.
The npm package ships the CLI and the MCP server. Your agent gets read access to attacks, traces, and IP intelligence — and write access to blocks and rules, gated by your approval.
Claude Code
Connect the SecureNow MCP server and let Claude investigate production attacks, propose blocks, and create detections without leaving the terminal.
npx securenow login claude mcp add securenow -- npx securenow mcp
Cursor
Add the SecureNow MCP server to Cursor and ask about live traffic, suspicious IPs, and targeted routes right inside your editor.
// .cursor/mcp.json
{ "mcpServers": { "securenow":
{ "command": "npx", "args": ["securenow", "mcp"] } } }Codex
Give Codex the same production security context — traces, attack history, IP intelligence — through the CLI and MCP tools.
npx securenow login codex mcp add securenow -- npx securenow mcp
Full setup, tool list, and read-vs-write permission model in the CLI & MCP docs.
Explore CLI & MCPOne prompt. Your agent does the rest.
Copy the prompt, paste it into your coding agent, and it wires SecureNow into your app — package, login, framework integration, verification, MCP connection, and a first security baseline. No DNS change, no proxy, no infra work.
- Works with Node.js, Next.js, Express & TypeScript
- Telemetry fails open — never blocks your app
- Never needs your source code
Add SecureNow production security to this project. 1. Install the official package: npm i securenow 2. Connect my SecureNow account: npx securenow login 3. Configure the framework integration (npx securenow init for Next.js, or add -r securenow/register to the start script for Node/Express). 4. Verify telemetry is arriving: npx securenow test-span && npx securenow status 5. Connect the SecureNow MCP tools so you can investigate production. 6. Run a production-security baseline. Do not block traffic or modify security policy without asking me first.
Find it in code. Watch it in production.
Run a free security audit before you ship — your agent finds the weak endpoint in code. Then SecureNow watches that exact endpoint for exploitation attempts in production.
Free AI security audit
Run our threat-modeling prompts with your coding agent against your own code, locally. Your source never leaves your machine.
Run a free auditFree Node.js firewall
Block 500k+ known-bad IPs, refreshed hourly. One preload flag, no proxy, no DNS change. Free forever.
Get the free firewallProduction security for your agent
Connect the MCP server and let Claude, Codex, or Cursor investigate what's actually attacking production.
Explore CLI & MCPSimple pricing. 14-day free trial of everything.
Every account starts with the full product for 14 days. No credit card. When the trial ends, the free firewall keeps protecting your app.
Free
$0forever
Audit your code and stop known-bad traffic.
- Local AI security audit (threat-modeling prompts)
- Basic Node.js firewall — 500k+ known-bad IPs, hourly refresh
- IP intelligence lookups
- Full CLI
Pro
Most popular$49per app / month
Full production security for one app.
- Production attack detection on live traffic
- MCP + CLI access for Claude Code, Codex & Cursor
- AI investigations included
- Traces, logs & security context (7-day history)
- Custom detections, blocking & rate limits — human-approved
- Slack & email alerts
- Up to 5M protected requests/month
Team
$149per month
Everything in Pro, for your whole team.
- Up to 5 applications
- 30-day history
- Team members & shared policies
- Higher request allowance
- Audit history of investigations & actions
Scale
Custom
Higher traffic, longer retention, dedicated infra.
- Dedicated, isolated telemetry instance
- Custom retention & request volumes
- Migration & onboarding help
SecureNow never needs your source code.
Your coding agent inspects your code locally. SecureNow only sees production runtime signals — and treats them with the care security telemetry deserves.
- Sensitive fields redacted before telemetry leaves your app
- Fails open — never takes your app down
- Read vs. write MCP tools, clearly separated
- Human approval required for mutations
- Encrypted in transit and at rest
- Delete your data anytime
Built by an engineer who has seen real attacks.
Lhoussine Omary
Founder, SecureNow · ex-SAP · ethical hacker
I build SecureNow from the attacker's side of the table. Ex-SAP engineer and an ethical hacker credited by some of the largest security teams in the world for finding and responsibly disclosing real vulnerabilities. SecureNow is the tool I wanted as a founder: practical protection without hiring a security team.
Credited for responsible disclosure by
Questions before you install.
Do I need Claude Code or Cursor to use SecureNow?
No. The dashboard, CLI, detections, alerts, and blocking all work on their own. But the agent workflow is where SecureNow shines: your coding agent already understands your code, and SecureNow gives it the production side — attacks, traces, IP intelligence, and response controls — through MCP.
Does SecureNow read my source code?
Never. SecureNow doesn't need your source code. Your coding agent reads the repository locally; SecureNow supplies runtime security context from production. The free security audit works the same way — the prompts run against your code on your machine.
Will SecureNow block production traffic on its own?
Not by default. Detection and investigation are automatic; remediation is proposed and waits for your approval, and every action is reversible. Once you trust a specific detection, you can opt it into automatic blocking — but that's your call, per rule.
Do I need to change my infrastructure?
No. SecureNow runs inside your Node.js / Next.js / Express app — one npm package and a preload flag. No DNS move, no proxy, no load-balancer rules.
Will it slow down my app?
Detection runs in-process with sub-millisecond IP checks. Telemetry exports asynchronously and fails open — if our backend is ever unreachable, your app keeps serving requests normally.
How is this different from AI agent-security tools like Arcjet?
They protect the AI application while it executes — tool calls, prompt injection, budgets. SecureNow is the other direction: it makes your AI coding agent capable of securing your production application, which doesn't need any LLM functionality at all. Your agent is the operator, not the protected workload.
What happens when the 14-day trial ends?
Your account drops to the Free tier: the basic firewall keeps protecting your app and the CLI keeps working, but hosted telemetry, detections on live traffic, and AI investigations pause until you pick a plan. No credit card is needed for the trial.
Your coding agent is ready to investigate.
Install SecureNow, connect the MCP server, and ask what's attacking your app right now. 14-day free trial, no credit card.