Kontext CLI
Kontext puts local policy between an agent and its tools: it observes, blocks risky actions and keeps a decision ledger
- 235 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The program installs a local daemon and hooks that see every agent action and in enforce mode can stop their work.
- The install token ties the machine to an organization in the cloud Kontext dashboard.
Install
- Works in
Manual install
brew install --cask kontext-security/tap/kontextThen `kontext setup` with a token from `https://app.kontext.security` and `kontext doctor`. Variant without self-update: `brew install kontext`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The program installs a local daemon and hooks that see every agent action and in enforce mode can stop their work.
- The install token ties the machine to an organization in the cloud Kontext dashboard.
This is third-party code. Review the repository files before installing.
What it does
Kontext is a Go program that intercepts agent actions through supported hooks and evaluates them against local policy. The supported agents are Claude Code, Claude Cowork, Codex, Cursor and Antigravity, with event coverage per agent described in the `docs/coverage.md` matrix. You do not launch the agent through a separate wrapper. It has two modes. In observe mode Kontext records what policy would have stopped and blocks nothing, which shows which tools agents call, which repositories and files are involved and where a denial would interrupt legitimate work. In enforce mode the program returns a real denial when a deterministic rule matches and the action does not run. The decision and outcome land in an authorization ledger with the agent, session and action. Install puts a local daemon and hooks in the home folder without `sudo`. The install token is kept in the macOS login keychain. For organizations there is a dashboard, managed policy rollout and a view of records with secrets redacted.
Who it is for. Security teams and developers on macOS who let agents run commands and change files and want to govern that by policy.
Good fit when
- You first want to see which agent actions policy would stop without disturbing developers.
- Dangerous tool calls must be blocked before execution at synchronous hooks.
- An audit needs records of which agent did which action in which session.
- Policy must be rolled out centrally across an organization with redacted records to review.
Not a fit when
- You need a self-contained setup with no Kontext account: install requires a token from the dashboard.
- You work outside macOS: self-serve setup supports macOS only for now.
- You need a guarantee of blocking on every event: in enforce mode a policy error or an unavailable daemon lets the call through.
Example request
Install Kontext with Homebrew, run `kontext setup` and `kontext doctor`, then keep observe mode and show what policy would stop.Limitations
Self-serve setup currently targets macOS. Take a token in the Kontext dashboard, run `kontext setup` and verify with `kontext doctor`. Only completed policy denials and unavailable required approvals block. A policy evaluation error, a policy that is not ready and an unresolved identity let the call through and are recorded as failures in the ledger, and if the daemon does not respond the call is not blocked and the agent own permissions apply. Interception coverage depends on the agent, because not every one has synchronous hooks for all events. The cask build updates itself every six hours through Homebrew.
How to disable. Remove the app with `brew uninstall --cask kontext-security/tap/kontext` and remove hooks following the project docs. The install token sits in the macOS keychain.
FAQ
How do I install Kontext?
With `brew install --cask kontext-security/tap/kontext`, then `kontext setup` with a token from the dashboard and `kontext doctor` to verify.
Which agents does Kontext work with?
Claude Code, Claude Cowork, Codex, Cursor and Antigravity. The event coverage table is in `docs/coverage.md`.
What is the difference between observe and enforce modes?
Observe records the policy decision and does not interrupt the agent, enforce returns a denial and stops the action before it runs.
Do I need to launch the agent through a wrapper?
No. After install you use agents as usual and hooks connect on their own.
What happens if the Kontext daemon does not respond?
The call is not blocked, Kontext returns no decision and the agent own permission settings apply.
Discussion
No questions or reviews yet.
Related
CLI toolsA control layer for autonomous agents: action policies, review queue, recovery points and config audit for Claude Code and Codex.
Agent Governance Toolkit
Agent Governance Toolkit (Claude Code plugin)
A Microsoft plugin for Claude Code whose hooks inspect prompts and tool calls against a policy and block dangerous commands.
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
A Go CLI that runs a coding agent in an OS sandbox with skills and secrets behind a bridge and isolated files and network.
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
Gryph hooks into Claude Code, Cursor, Codex and other agents, logs every action to a local SQLite database and can block risky commands.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Kontext (this card) | no | 235 | |
| HOL Guard | yes | 1,094 | HOL Guard checks commands, secrets and packages locally through a PyPI package, while Kontext installs a policy daemon with an observe mode and a cloud dashboard for organizations. |
| AgentGuard | no | 494 | AgentGuard installs as a plugin, while Kontext runs as a daemon and hooks for five agents with an authorization ledger. |
README in short
The README covers pre-action policy, observe and enforce modes, Homebrew install, connecting a Mac and managed rollout. MIT license.