Stop risky AI-agent actions before they run

AI agents do more than suggest code. They run shell commands, read files, call services, change infrastructure, and interact with production systems.

Kontext puts local policy between AI agents and the tools they call. It observes supported actions, evaluates policy before consequential actions run, and records the decision and outcome in an authorization ledger.

Start in observe mode. See what policy would stop. Move supported boundaries into enforcement when you are ready.

Policy evaluation errors allow the tool call, including in enforce mode, and remain visible as failures in the activity record. Completed policy denies and unavailable required approvals still block. This error fallback does not change behavior when the daemon is unavailable or enforcement has no usable policy.

• Local decisions: policy evaluation happens alongside the agent.
• Pre-action enforcement: matching actions can be denied at supported synchronous hooks.
• No wrapper command: install Kontext once and continue using your agents normally.
• Attributable evidence: preserve the agent, session, action, policy decision, and outcome.
• Managed rollout: distribute policy and review redacted records across an organization.

Kontext currently supports Claude Code, Claude Cowork, and Codex. Exact event and enforcement coverage varies by agent—see the agent support matrix.

Managed Claude hooks recognize Cowork sessions with either full or shortened session directory names, preserving their Cowork identity in activity records.

---

Quickstart

Install Kontext

brew install kontext-security/tap/kontext

Connect this Mac

Create an install token in the Kontext dashboard, then run:

kontext setup

The optional local risk model needs llama.cpp: run brew install llama.cpp, then kontext setup --with-local-llm.

Setup:

• stores the install token in the macOS login keychain;
• installs hooks for supported agents;
• starts the local Kontext daemon;
• connects the installation to your Kontext organization.

Verify the installation:

kontext doctor

Then keep using Claude Code or Codex normally. You do not need to launch the agent through a separate wrapper.

Self-serve setup currently supports macOS. Managed and cloud environments can run the same local runtime when they provide a supported hook contract, storage, and daemon lifecycle.

---

What changes after setup?

Without pre-action policy, an agent action executes before a security team can review its logs:

agent requests an action
        |
        v
action executes
        |
        v
activity appears in a log

With Kontext:

agent requests an action
        |
        v
Kontext receives it through a supported hook
        |
        v
local policy evaluates the action
        |
        +---- allow ----------> action continues
        |
        +---- would deny -----> action continues and evidence is recorded
        |                       (observe mode)
        |
        +---- deny -----------> action is stopped before execution
                                (enforce mode)
        |
        v
decision and outcome enter the authorization ledger

This creates a decision point before the action, not only a record after it.

---

Observe first. Enforce when ready.

Blocking every unfamiliar action on day one creates noise and interrupts developers. Allowing every action indefinitely leaves policy as passive monitoring.

Kontext separates rollout into two modes:

Observe mode

Observe mode records the policy decision without interrupting the agent.

Use it to answer:

• Which tools are agents calling?
• Which actions would current policy deny?
• Which repositories, files, and systems are involved?
• Where would enforcement interrupt legitimate work?
• Which event surfaces can actually stop the action?

Enforce mode

Enforce mode returns a real denial when a deterministic policy matches at a supported synchronous pre-action hook.

Policies can define boundaries around actions such as:

• destructive commands;
• sensitive-file access;
• production-system operations;
• credential access;
• data exports.

Enforcement is intentionally limited to event surfaces where the agent waits for Kontext before continuing. Kontext does not claim that receiving an event means it can stop every action from that agent.

---

Know what happened—and why

Every supported event that reaches Kontext can contribute evidence to the local authorization ledger.

A record can include:

• the agent and session;
• the lifecycle or tool event;
• the tool name and available input;
• the local policy decision;
• the policy responsible for that decision;
• the available action outcome;
• redacted evidence for later review.

Kontext records tool activity and decision evidence. It does not capture model reasoning or reconstruct full conversation history.

Managed deployments can export redacted records to the Kontext dashboard for organization-wide review, retention, and investigation.

Ledger exports and idle heartbeats report the running daemon's CLI release as device.cli_version, separately from the package marker in device.deployment_version (or its self-serve fallback). A package marker update does not change the reported CLI release until a daemon running the new binary sends telemetry.

---

Policy where the agent runs

The decision path stays local:

Claude Code / Cowork / Codex
              |
              v
        supported hook
              |
              v
     local Kontext runtime
              |
        +-----+------+
        |            |
        v            v
  policy decision   local ledger
        |
        v
 allow / would deny / deny

A hosted service does not need to answer every tool call.

Managed deployments add organization configuration, policy rollout, record export, identity, and retention. They do not move the synchronous decision path out of the agent environment.

---

Supported agents

“Supported” means more than accepting an event. Kontext documents which events it receives, which events can block, and how each integration is installed.

Agent	What Kontext records	Pre-action blocking	Installation
Claude Code	Session lifecycle, pre-tool-use, successful and failed post-tool-use	Pre-tool-use	Installed by kontext setup
Codex	Session start, pre-tool-use, post-tool-use, prompt submission, stop	Pre-tool-use	Installed by kontext setup; hooks must be trusted in Codex
Claude Cowork	Claude Code-compatible session and tool events	Pre-tool-use	Configure the hook inside the Cowork environment