Protect your Node.js app without a license.

1. Install and inspect

Use Node.js 20 or newer in a persistent Node process. The alpha supports an Express middleware and a Next.js App Router Route Handler adapter in the Node runtime.

node --version
npm install @network-decode/node-guard@0.2.0-alpha.12
npm ls @network-decode/node-guard
npx nodeguard init
npx nodeguard doctor nodeguard.policy.json
npx nodeguard policy validate nodeguard.policy.json

init creates an OBSERVE policy and refuses to overwrite one. doctor reports process-local state and cannot verify your proxy configuration for you.

2. Verify source and simulate decisions

Your app must verify the real client IP through its trusted ingress, then record only events it has confirmed, such as a failed login. Do not accept an IP, subject, or tenant ID from an arbitrary request body or forwarding header. The included synthetic fixture matches the generated OBSERVE policy.

cp node_modules/@network-decode/node-guard/examples/auth-observations.json ./observations.json
npx nodeguard policy test nodeguard.policy.json observations.json --at 2026-11-03T18:00:00Z
npx nodeguard inspect nodeguard.policy.json

Expect one OBSERVE result for the fixture source and no live restriction. The simulator does not send traffic or modify your running app. Replace the fixture with sanitized events from your own integration before deciding to enforce.

Read the Express setup or Next Route Handler guide before connecting a live app.

3. Enable app limits only after review

Set the policy mode to ENFORCE, provide a protected-source callback, and test a noncritical client. The middleware returns a temporary 429 for THROTTLE or 403 for DENY; the operator can release a source or return the policy to OBSERVE. A restart clears the in-memory restriction.

This alpha does not provide shared counters across workers or hosts, automatic attack classification, host firewall or XDP rules, Exchange sharing, or a production reliability guarantee. Do not rely on it as the sole security control for critical applications.

Explore the alpha.12 security tools

These local tools help you review application security decisions. Run the bundled workflow to see a signed synthetic observation move through verification, policy comparison, and simulated replay.

node node_modules/@network-decode/node-guard/examples/security-tools-workflow.mjs