Kontext CLI
VerifiedAuthorization platform that secures AI agent actions with local policies and scoped credentials.
What is Kontext CLI?
Kontext is a local-first authorization system designed specifically for AI agents. It intercepts tool calls to apply allow/deny decisions based on policy rules and an on-device judge model before any action executes.
The system combines hard-coded deterministic policies with probabilistic evaluation using a local llama.cpp runtime. Audit logs capture every decision, tool invocation, and outcome for review or compliance needs.
It targets developers and security teams who run agents locally or in managed environments and need fine-grained access control without sending sensitive context to external services.
What you can build with Kontext CLI
Secure local agent sessions
Run agents like Claude Code with Kontext in enforce mode to block risky commands before execution while keeping all decisions on the local machine.
Audit agent behavior
Generate detailed logs of agent actions, policy outcomes, and credential usage for security reviews or incident investigations without uploading data.
Inject scoped credentials
Replace placeholders in environment files with short-lived OAuth tokens at runtime so agents can access approved services without storing secrets.
Install Kontext CLI
brew install kontext-security/tap/kontextbrew install kontext-security/tap/kontext- 1Install via Homebrew with the provided tap.
- 2Run 'kontext start' to launch a protected local session in observe mode.
- 3Switch to enforce mode by setting KONTEXT_MODE=enforce before starting.
- 4Open the local dashboard URL shown at startup to review recorded decisions.
- 5Add --managed flag when hosted identity and credential exchange are required.
Kontext CLI: pros & cons
Pros
- +Strong local-first design with no mandatory cloud dependency
- +Combines deterministic policies and on-device risk scoring
- +Provides RFC 8693 compliant credential exchange for agents
- +Generates comprehensive audit trails suitable for compliance
Cons
- –Currently limited to the Claude Code adapter
- –Probabilistic checks require downloading and running a local GGUF model
- –Advanced enterprise features need separate managed deployment
Frequently asked questions
No, the default local session works entirely offline after the initial model download.
User reviews
Verified reviews from the community shape this listing's rating.
Loading reviews…
Similar agents
Other general-purpose options worth comparing.
