aikido zen node fails with cannot find module @aikidosecurity/firewall error

Not specified by the original author.

TL;DR: Fix: run on Node 16 or newer (a maintainer verified The node:

Zen crashes at startup with Cannot find module node:async_hooks; upgrade to Node 16+

Fix

1. Fix: run on Node 16 or newer (a maintainer verified. Expected: this specific failure stops.

Details

The node: module prefix requires Node 14.18+ (and Zen targets Node 16+). The reporter was on an old Node where node:async_hooks did not exist, so the firewall's context storage module failed at require time. node:16-alpine in Docker works). If you see Cannot find module 'node:...' from any instrumenting library, your Node is too old for the node: prefix, upgrade Node before debugging anything else.

When to use

You hit exactly this: Zen crashes at startup with Cannot find module node:async_hooks; upgrade to Node 16+ in Zen.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Zen (versions mentioned here: 14.18).

Asked in GitHub issue gh:AikidoSec/firewall-node#272: Issue AikidoSec/firewall-node#272 (closed, 4 comments): adding require('@aikidosec/firewall') as the first line crashed the app at startup with Error: Cannot find module 'node:async_hooks'. The verified fix/answer: The node: module prefix requires Node 14.18+ (and Zen targets Node 16+). The reporter was on an old Node where node:async_hooks did not exist, so the firewall's context storage module failed at require time. Fix: run on Node 16 or newer (a maintainer verified node:16-alpine in Docker works). If you see Cannot find module 'node:...' from any instrumenting library, your Node is too old for the node: prefix, upgrade Node before debugging anything else. Source: https://github.com/AikidoSec/firewall-node/issues/272

Not specified by the original author.

TL;DR: If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set AIKIDO_BLOCK=true in the environment.

Fix

1. If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set. Expected: this specific failure stops.

2. must be the very first import, above everything else, or the instrumentation misses modules loaded earlier; (2) if you want per-user rate limiting or user blocking, call. Expected: this specific failure stops.

Details

AIKIDO_BLOCK=true in the environment. The docs recommend running with blocking enabled on staging for about a week before turning it on in production, so you can tune out false positives first. Two related setup points from the same docs: (1) import aikido_zen / require('@aikidosec/firewall') set_user({"id", "name"}) from your auth middleware as soon as the user is identified, otherwise Zen only sees IPs.

When to use

You hit exactly this: Zen does not block attacks by default; set AIKIDO_BLOCK=true to actually stop them in Zen.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Zen.

Documented gotcha from official Aikido Security docs: Official docs (Aikido firewall-python docs/fastapi.md, github.com/aikidosec/firewall-python): documents the gotcha that Zen runs in non-blocking mode by default. When it detects an attack it reports it to Aikido and lets the call continue executing, so attacks are logged but not stopped unless you opt in. The verified fix/answer: If you installed Aikido Zen and attacks are showing up in your dashboard but nothing is actually blocked, that is the default: Zen detects and reports but does not block until you set AIKIDO_BLOCK=true in the environment. The docs recommend running with blocking enabled on staging for about a week before turning it on in production, so you can tune out false positives first. Two related setup points from the same docs: (1) import aikido_zen / require('@aikidosec/firewall') must be the very first import, above everything else, or the instrumentation misses modules loaded earlier; (2) if you want per-user rate limiting or user blocking, call set_user({"id", "name"}) from your auth middleware as soon as the user is identified, otherwise Zen only sees IPs. Source: https://github.com/aikidosec/firewall-python/blob/HEAD/docs/fastapi.md

Not specified by the original author.

Fix memory MCP Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'zod'

TL;DR

The published package forgot to declare zod as a dependency. Install zod next to it (or wait for a fixed release). The server imports zod at startup, so the missing module kills it before the MCP handshake.

The exact error:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'zod' imported from .../dist/index.js

Steps

1. Confirm the missing dependency

Run the server by hand:

npx -y @modelcontextprotocol/server-memory

Success check: it exits immediately with the Cannot find package 'zod' error, and nothing else. That confirms a packaging bug, not your config.

2. Install zod alongside the package

npm install -g zod @modelcontextprotocol/server-memory

or with pnpm:

pnpm add -g zod @modelcontextprotocol/server-memory

Success check: rerunning the server no longer mentions zod; it waits on stdin for the MCP handshake.

3. Restart the client

Fully restart Claude Desktop / Claude Code / Cursor so the server relaunches with zod resolvable.

Success check: the memory tools (create_entities, read_graph, search_nodes) appear and work.

When this applies

• @modelcontextprotocol/server-memory (or server-sequential-thinking) exits instantly with the zod module-not-found error.
• Fresh installs are affected; the published dependencies list only @modelcontextprotocol/sdk.

When it does not apply

• The server starts but read_graph fails with Structured content does not match the tool's output schema: data/entities/0 must NOT have additional properties. That is a schema-validation issue with extra fields in memory.jsonl; strip the non-standard properties from the stored entities.
• Tools fail with JSON parsing errors on Windows. Check the server version; that is a different bug.

Tool compatibility

• @modelcontextprotocol/server-memory npm package (affected published versions)
• @modelcontextprotocol/server-sequential-thinking (same bug)
• Node.js 18+, npx / pnpm dlx launchers
• Claude Desktop, Claude Code, Cursor, Continue

Why it happens

The package's bundled dist/index.js contains import { z } from "zod", but zod was never added to the published dependencies in package.json. npm/pnpm only install declared dependencies, so a fresh install has no zod to resolve and Node throws ERRMODULENOT_FOUND at import time, before any MCP code runs.

Edge cases

• If you install with npx -y (ephemeral cache), the manual zod install can be wiped on cache eviction; a global install of both packages is more durable.
• Do not confuse with the sibling startup failure from the mcp 2.0 SDK rename; that one names McpError, not zod.
• Once a release declares zod properly, the manual install becomes unnecessary; check the changelog before scripting it permanently.

A modelcontextprotocol/servers issue reports that the published npm packages @modelcontextprotocol/server-memory and @modelcontextprotocol/server-sequential-thinking fail immediately on startup because they import zod but zod is not listed in their published dependencies. Repro: pnpm dlx @modelcontextprotocol/server-memory exits with Error [ERRMODULENOT_FOUND]: Cannot find package 'zod' imported from .../dist/index.js. The published dependencies contain only @modelcontextprotocol/sdk. The fix: install zod alongside the package or wait for a release that declares the dependency. Source: https://github.com/modelcontextprotocol/servers/issues/4330