Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

Context Mode MCP server

by mksglu/context-modeNOASSERTION licenceAudited 20 Sep 2026 · source 78db051b5773

npm og 1.0.0stdio★ 23,692
✕BLOCKGrade F · 37/100 · 20 Sep 2026 · 78db051
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (37/100). It exposes 18 tools: 10 read, 6 write and 2 destructive. The audit recorded 41 findings (1 critical, 7 high, 1 medium, 31 low). Maintainer's description: Context window optimization for AI coding agents. Sandboxes tool output (98% reduction), persists session memory, and enforces routing across 17 platforms via MCP + hooks.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Context Mode MCP server (mksglu/context-mode)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/mksglu/context-mode

Why this is BLOCK. The audit found 1 critical and 7 high findings; the most severe is Obfuscation / stealth at cli.bundle.mjs:459. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score37/100✕BLOCK F
1 critical7 high1 medium31 low1 info

41 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared11 observations
  • NetworkDeclared6 observations
  • ShellDeclared10 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (41)

Sorted by severity · the 25 most severe of 41 are listed

CRITICALObfuscation / stealthobf.decode_then_exec · cli.bundle.mjs:459
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
atob( ... /exec(
Why
decodes a payload and executes it
Fix
—
HIGHInventory / provenanceinv.suspicious_name · hooks/antigravity-cli/payload.mjs
F-13 Inventory / provenanceCWE-1104Layer L0
payload.mjs
Why
member named after an attack tool
Fix
remove or justify
HIGHCode injectioncode.eval_exec · scripts/heal-better-sqlite3.mjs:197
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const displayName = exec(
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/db-base.ts:64
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(sql: string): any {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/db-base.ts:140
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(sql: string): any {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/security.ts:801
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
/exec(?:Sync|File|FileSync)?\(\s*(['"`])(.*?)\1/g,
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/security.ts:805
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
/exec(?:Sync|File|FileSync)?\(\s*(['"`])(.*?)\1/g,
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHNetwork egressnet.metadata_ip · src/server.ts:3277
F-04 Network egressCWE-200 · CWE-319Layer L1
if (a === 169 && b === 254) return "block"; // link-local incl. 169.254.169.254 (IMDS)
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
context-mode.session-reset, ctx_purge
Why
2 tool(s) can delete or overwrite
Fix
prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenanceinv.hidden_file · .mcp.json.codex.example
F-13 Inventory / provenanceCWE-1104Layer L0
.mcp.json.codex.example
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .mcp.json.example
F-13 Inventory / provenanceCWE-1104Layer L0
.mcp.json.example
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · skills/.ignore
F-13 Inventory / provenanceCWE-1104Layer L0
.ignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInformation disclosuredisclose.log_secret · tests/benchmark.ts:415
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`  1 token (post-dedup)            : ${dedup.deduped.toFixed(1)} μs/query`);
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.credential_store · tests/security.test.ts:600
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"../../.ssh/id_rsa",
Why
touches a credential store
Fix
—
LOWFilesystem / pathfs.credential_store · tests/security.test.ts:615
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"../../.ssh/id_rsa",
Why
touches a credential store
Fix
—
LOWFilesystem / pathfs.traversal · .pi/extensions/context-mode/index.ts:1
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
export { default } from "../../../build/adapters/pi/extension.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/adapters/antigravity-cli/index.ts:25
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { parseJsonc } from "../../util/jsonc.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/adapters/claude-code/index.ts:30
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { resolveClaudeConfigDir } from "../../util/claude-config.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/adapters/claude-code/index.ts:31
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { checkPluginCacheIntegritySync } from "../../util/plugin-cache-integrity.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/adapters/codex/index.ts:31
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { hashProjectDirCanonical } from "../../session/db.js";
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.metadata_ip · README.md:1582
F-04 Network egressCWE-200 · CWE-319Layer L1
- **Cloud metadata + link-local**: `169.254.0.0/16` (incl. AWS/GCP/Azure IMDS endpoint `169.254.169.254`) hard-blocked even if a hostname resolves to it (DNS-rebinding defense).
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · tests/core/server.test.ts:3728
F-04 Network egressCWE-200 · CWE-319Layer L1
expect(classifyIp("169.254.169.254")).toBe("block");
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · tests/core/server.test.ts:3783
F-04 Network egressCWE-200 · CWE-319Layer L1
expect(classifyIp("::ffff:169.254.169.254")).toBe("block"); // IMDS via IPv4-mapped
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · tests/core/server.test.ts:3879
F-04 Network egressCWE-200 · CWE-319Layer L1
imds: classifyIp("169.254.169.254"),
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.raw_ip · tests/core/fetch-cleanup.test.ts:113
F-04 Network egressCWE-200 · CWE-319Layer L1
baseUrl = `http://127.0.0.1:${addr.port}`;
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

18 declared in source · 2 destructive

10 read6 write2 destructive

2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

ToolWhat it doesRisk
context-mode.session-resetSession cleanup on /reset commanddestructive
ctx_purgeDESTRUCTIVE — permanently delete indexed content. CANNOT be undone.\n\ndestructive
context-mode.session-stopSession cleanup on /stop commandwrite
ctx-doctorRun context-mode diagnosticswrite
ctx_batch_executeRun multiple commands and search queries in ONE call. Primary research tool — replaces 30+ individual calls.write
ctx_doctorRun context-mode diagnostics — runtimes, hooks, FTS5, plugin registration.write
ctx_executeExecute code in a sandboxed subprocess. Only stdout enters context. Prefer over Bash for any command producing >20 lines.write
ctx_execute_fileExecute code with a file path. Only printed summary enters context — raw file stays in sandbox.write
context-mode.session-newSession initialization — cleans up old sessions on /new commandread
ctx-statsShow context-mode session statisticsread
ctx-upgradeUpgrade context-mode to the latest versionread
ctx_fetch_and_indexFetch a URL, chunk it, and index — raw HTML never enters context.read
ctx_indexStore content in the FTS5 knowledge base for later search.read
ctx_insightOpen the hosted context-mode Insight dashboard (context-mode.com/insight) in the browser.read
ctx_searchQuery indexed content via FTS5. Pass all questions as an array in ONE call.read
ctx_statsShow context-mode session statistics — token consumption and per-tool breakdown.read
ctx_upgradeUpgrade context-mode to the latest version.read
pingpread

Safer alternatives

NotebookLM Skill✓SAFE

claude-world/notebooklm-skill

NotebookLM does the research, Claude writes the content. Research → Synthesis → Content Creation → Publishing. Claude Code Skill + MCP Server.

1 destructiveGrade B
ShipStatic MCP✓SAFE

shipstatic/mcp

MCP server for instant static site deploys from AI agents — free, no account needed

2 destructiveGrade B
Antigravity Workspace✓SAFE

study8677/antigravity-workspace-template

🧠 RepoBrain (formerly Antigravity) — Give your repo a brain. ChatGPT for your codebase: works in Claude Code, Cursor, Codex, Windsurf & more.

1 writeGrade B

Audit history

  1. ✕BLOCK F 37 / 100

    Source changed, verdict held · 78db051b5773

  2. ✕BLOCK F 37 / 100

    First audit · 4031d1c9f64f

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Context Mode MCP server

What is the Context Mode MCP server?
Context window optimization for AI coding agents. Sandboxes tool output (98% reduction), persists session memory, and enforces routing across 17 platforms via MCP + hooks.
What tools does Context Mode expose?
18 in total: 10 read-only, 6 that write, and 2 that can delete or overwrite (context-mode.session-reset, ctx_purge). Every one is listed on this page with its risk.
Is Context Mode safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (37/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Context Mode need?
It reads CLAUDE_CODE_MAX_OUTPUT_TOKENS, JWT_SECRET, MY_CUSTOM_API_KEY, PI_CONTEXT_MODE_PRICE_OUTPUT_PER_TOKEN, SLACK_BOT_TOKEN and SSH_AUTH_SOCK from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Context Mode run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as og at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (78db051b5773), read on 2026-09-20. The repository is watched and re-audited when it changes.
I already installed Context Mode. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • mksglu/context-mode on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 78db051b5773Observed · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.