Kontext is a runtime security tool for AI agents, with the core goal of intervening before risky operations execute. AI agents not only suggest code, but also run shell commands, read files, call services, change infrastructure, and interact with production systems. Kontext places local policy between AI agents and the tools they call, observes supported operations, evaluates policy before important operations execute, and records decisions and outcomes in an authorization ledger.
[Main capabilities]
- Local decisions: policy evaluation and the agent take place in the same environment.
- Pre-execution enforcement: at supported synchronous hooks, matching operations can be denied.
- No wrapper command needed: after installing Kontext once, you can continue using the agent as usual.
- Attributable evidence: retain the agent, session, operation, policy decision, and outcome.
- Managed rollout: distribute policies within the organization and review redacted records.
[Policy evaluation behavior] When policy evaluation errors, the tool call is allowed (including in enforce mode), and it will be visible in the activity record as a failure. Completed policy denials and unavailable required approvals still block operations. When the hook cannot obtain a decision at all (for example, the daemon is down, restarting, responding too slowly, or returning unreadable content), the tool call is not blocked, Kontext returns no decision, and the agent's own permission settings take effect.
[Support scope] Kontext currently supports Claude Code, Claude Cowork, and Codex. The exact events and enforcement coverage vary by agent, so refer to the agent support matrix. Managed Claude hooks can recognize Cowork sessions with full or shortened session directory names and preserve their Cowork identity in the activity record.
[Installation and usage] Self-service installation currently supports macOS. The installation process includes: creating an installation token in the Kontext dashboard, then running the installation command; the optional local risk model requires llama.cpp, and you can first run brew install llama.cpp, then run kontext setup --with-local-llm. The installation process stores the installation token in the macOS login keychain, installs hooks for supported agents, starts the local Kontext daemon, and connects the installation to the Kontext organization. After installation, you can use the relevant commands to verify the installation, and then continue using Claud as usuale Code or Codex, without launching the agent through a separate wrapper.
[Two promotion modes]
- Observation mode: records policy decisions without interrupting the agent. It can be used to understand which tools the agent is calling, which operations the current policy would deny, which repositories/files/systems are involved, where enforcement would interrupt normal work, and which event surfaces can actually block operations.
- Enforcement mode: at supported synchronous pre-execution hooks, returns a real denial when a deterministic policy matches. Policies can define boundaries for destructive commands, sensitive file access, production system operations, credential access, and similar operations. Enforcement is intentionally limited to the event surfaces where the agent waits for Kontext before continuing. Kontext does not claim that receiving an event means it can block all operations from that agent.
[Authorization ledger and records] Every supported event that reaches Kontext can contribute evidence to the local authorization ledger. Records may include: agent and session, lifecycle or tool events, tool names and available inputs, local policy decisions, the policy responsible for that decision, available operation results, and redacted evidence for later review. Kontext records tool activity and decision evidence, but does not capture model reasoning or reconstruct the full conversation history. Managed deployments can export redacted records to the Kontext dashboard for organization-wide review, retention, and investigation.
[Additional capabilities of managed deployments] Managed deployments add: centrally managed deterministic policies, enterprise identity and organizational controls, an observation-to-enforcement promotion process, managed agent and cloud deployment support, redacted evidence export, audit retention, deployment health and backlog monitoring, and onboarding support for security and platform teams. Managed deployments do not move the synchronous decision path out of the agent environment.
[Diagnostics and maintenance] Diagnostic commands can check installed agent hooks, daemon health and version, managed export health, and pending export backlog, exiting with a non-zero status when the configured installation is unhealthy. When the self-service daemon is outdated, the installation token can be rotated by re-running setup. There is also a corresponding command to remove a self-service installation.
[Privacy and data boundaries] Policy decisions are made locally; tool activity and decision evidence are stored locally; sensitive values are redacted locally before storage and managed export. Kontext does not store model reasoning or full conversation history. Managed deployments can export redacted records to the organization dashboard. Learn about runtime and data boundaries through the Guard documentation.
[Authoritative report] kontext report shows discovered agents and permissions as of the last cloud-accepted state, and can use kontext report --json to obtain the raw payload; before the first successful send, it does not report data. In a daemon environment, KONTEXT_AUTHORITY_SCAN=off can be set to disable authority collection and transmission on this Mac.
[Differences from other solutions] Kontext and sandboxes solve different problems: process sandboxes focus on which files, network destinations, credentials, and operating system resources a process can access; what Kontext provides is semantic policy and attribution at supported agent and tool hooks. Kontext does not claim to provide kernel-level isolation, and when the threat model requires process, file system, or network isolation, an appropriate sandbox should be used. Kontext and sandboxes are complementary.
[License and support] Kontext is released under the MIT License. For support channels, see SUPPORT.md; before contributing, please read CONTRIBUTING.md; for vulnerabilities, please report through the security policy. For deployment planning and organizational onboarding, contact michel@kontext.security or schedule a conversation.
[Limitations] Self-service setup currently supports macOS; hosted and cloud environments can run the same local runtime when they provide a supported hook contract, storage, and daemon lifecycle. Enforcement is limited to the event surface where the agent waits for Kontext before continuing. Apart from the above, the materials do not currently provide details on specific supported event types, detailed enforcement coverage for each agent, or more granular pricing or commercial terms.
