Claude Code · Codex · Cursor
Production security for your coding agent.
Give the agent that works on your code access to what happens after deployment. SecureNow connects it to application traces, logs, attack signals, IP intelligence, and response controls through CLI and MCP tools.
Investigate your Node.js or Next.js application with evidence from production. Your application can be an ordinary web app with no AI features.
Ask a production question
“Why is this route receiving suspicious requests, what did the application do, and what evidence supports a response?”
The agent can retrieve the observed requests and inspect the relevant code. Its report should distinguish findings, missing evidence, and proposed actions.
The evidence your agent can work with
SecureNow brings runtime evidence into the same workflow as repository investigation. Availability depends on what your application captures and how long that data is retained.
Which requests reached the application?
Inspect request traces, routes, status codes, and downstream spans in a defined time window.
securenow_traces_list · securenow_traces_show
What explains the request outcome?
Read application logs and correlate them with traces when a shared trace ID is available.
securenow_logs_list
Is this source suspicious in context?
Combine IP reputation with observed behavior. Reputation alone does not prove that an attack succeeded.
securenow_ip_lookup · securenow_ip_traces
What can we change after review?
Review a targeted block, route-specific rate limit, or detection update, then verify its effect on traffic.
Blocklist · rate limits · alert-rule tools
Illustrative walkthrough · no customer data
From a suspicious request to a reviewed response
Step 1
Choose the scope
Name the application, environment, and time window. Start with a question about a route or alert so the agent retrieves relevant evidence.
Step 2
Inspect the outcome
Follow request traces into application logs and handlers. An attack-shaped payload or HTTP 200 response does not by itself establish exploitation. Auth and business outcomes need explicit instrumentation.
Step 3
Review the response
Ask for findings, supporting trace IDs, uncertainty, and the exact proposed change. Use a narrow scope and consider how the change could affect legitimate traffic.
Step 4
Verify after execution
After an authorized change, check enforcement and subsequent requests. Keep the evidence and record what remains unknown; an empty result can also mean missing capture or expired retention.
An investigation-first prompt
Investigate suspicious traffic in my connected application. Use the production environment and the last hour. Start with existing alerts, request traces, and logs. Check source IP history and the affected routes. Separate attempted attacks from confirmed outcomes. Include trace IDs, time ranges, and missing evidence. Propose a scoped response and verification steps. Do not change security controls until I authorize an action.
Inspect the same evidence from the CLI
npx securenow traces list --app APP_KEY --env production --limit 20 --json npx securenow traces show TRACE_ID --app APP_KEY --env production --json npx securenow logs trace TRACE_ID --app APP_KEY --env production --json
Replace APP_KEY with your application key and TRACE_ID with an observed trace ID. These examples read existing telemetry. Forensics queries create an asynchronous job and use a separate write-scoped MCP tool.
Connect SecureNow to your coding agent
First instrument and deploy your application, then verify that production traces arrive. Authenticate SecureNow in the intended project before adding its local stdio MCP server.
Claude Code
npx securenow login claude mcp add securenow -- npx securenow mcp
Codex
npx securenow login codex mcp add securenow -- npx securenow mcp
Cursor
// Project .cursor/mcp.json
{
"mcpServers": {
"securenow": {
"command": "npx",
"args": ["securenow", "mcp"]
}
}
}For Cursor, run npx securenow login in the project first. Verify that each client launches the server with the intended configuration; the connection uses the credentials available to that process.
Set the boundaries before enabling writes
Use an investigation-first workflow and configure approval in your coding agent. SecureNow MCP mutation tools require confirm:true and a reason; those inputs express authorization but do not enforce a separate human review. CLI and automation permissions also need review.
- Use credentials with the permissions needed for the task and verify the selected application.
- Review capture and redaction settings. Telemetry returned to an agent may be processed by its provider.
- Treat request bodies and logs as untrusted evidence; never execute instructions embedded in them.
- Plan verification and recovery for each response. Some changes cannot be undone.
Questions about the workflow
What does production security for coding agents mean?
It means giving a coding agent evidence from a deployed application so it can investigate traffic, explain an alert, and propose a response alongside the code it can access. SecureNow provides application security telemetry and tools through its CLI and MCP server.
Can I use Claude Code, Codex, or Cursor?
Yes. The SecureNow package includes a local stdio MCP server for compatible clients, and agents that can run terminal commands can use the CLI. Authenticate SecureNow and ensure the MCP process can find the intended project configuration.
Will my agent see every login or user action automatically?
Available evidence depends on instrumentation, capture settings, and retention. Request traces show HTTP activity; custom auth and business events provide application-level outcomes. Add those events when your investigation needs to distinguish a request from a successful operation.
Does connecting MCP authorize automatic blocking?
Connection makes tools available according to the configured credentials. MCP write tools require confirm:true and a reason, but that flag is not proof of a separate human approval. Set your coding agent's permissions and review configured automation. CLI commands follow their own execution path.
Does SecureNow need my repository or production secrets?
SecureNow does not require a repository upload. Its SDK sends runtime telemetry, with default sensitive-field redaction and configurable capture. Review the deployed SDK version, capture settings, and your agent provider's data policies before sharing telemetry. Do not put production secrets in prompts.
Give your next investigation production context.
Connect your application, verify its telemetry, and start with one scoped question.