Context Mode

Overview

From the repository's own README, as read at the audited commit.

# context-mode> Save 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and native Cursor v1.7+ hook routing for context protection.## What it doescontext-mode is an MCP server + hook bundle that keeps long-running Cursor agent sessions from blowing through their context window. Three pillars:- **Sandboxed execution** — `ctx_execute`, `ctx_execute_file`, `ctx_batch_execute` run code in 11 languages (Node, Python, Bun, Deno, Ruby, Go, Rust, Java, C, C++, Shell). Only `stdout` enters the agent's context, so analysing huge files no longer floods the window.- **FTS5 knowledge base** — `ctx_index`, `ctx_search`, `ctx_fetch_and_index` store research, command output, and web content in SQLite FTS5 with BM25 ranking. The agent searches its own memory instead of re-reading files.- **Native Cursor hooks** — registers `preToolUse`, `postToolUse`, `sessionStart`, `afterAgentResponse`, and `stop` so context-mode can intercept Shell / Read / Grep / WebFetch and redirect them to the sandbox before they pollute context.## InstallAfter clicking **Install** in the Cursor Plugins panel, the plugin registers an MCP server that runs `npx -y context-mode`. The first invocation downloads the package from npm; subsequent invocations are cached.If you prefer pinning a global install (faster cold start):```bashnpm i -g context-mode```The plugin manifest will pick up the global binary automatically.## Try it locally before Marketplace acceptanceWhile the plugin is awaiting Marketplace review, you can install itdirectly from the repo. Cursor does **not** follow Windowssymlinks/junctions for plugin folders, so use a mirror copy on Windowsand a symlink elsewhere.**Windows (PowerShell):**```powershellgit clone https://github.com/mksglu/context-mode.gitcd context-moderobocopy . "$env:USERPROFILE\.cursor\plugins\local\context-mode" /MIR `  /XD node_modules .git build insight web tests scripts .vscode `  /XF *.log .gitignore *.bundle.mjs.map`

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add og --env CLAUDE_CODE_MAX_OUTPUT_TOKENS=${CLAUDE_CODE_MAX_OUTPUT_TOKENS} --env JWT_SECRET=${JWT_SECRET} --env MY_CUSTOM_API_KEY=${MY_CUSTOM_API_KEY} --env PI_CONTEXT_MODE_PRICE_OUTPUT_PER_TOKEN=${PI_CONTEXT_MODE_PRICE_OUTPUT_PER_TOKEN} -- npx -y [email protected]

{
  "mcpServers": {
    "og": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "CLAUDE_CODE_MAX_OUTPUT_TOKENS": "${CLAUDE_CODE_MAX_OUTPUT_TOKENS}",
        "JWT_SECRET": "${JWT_SECRET}",
        "MY_CUSTOM_API_KEY": "${MY_CUSTOM_API_KEY}",
        "PI_CONTEXT_MODE_PRICE_OUTPUT_PER_TOKEN": "${PI_CONTEXT_MODE_PRICE_OUTPUT_PER_TOKEN}"
      }
    }
  }
}

Exposed tools (18) 10 read · 6 write · 2 destructive

Blast radius: 2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Details

Source

mksglu/context-mode

npm

og@1.0.0

Transports

stdio

Credentials it reads

CLAUDE_CODE_MAX_OUTPUT_TOKENSJWT_SECRETMY_CUSTOM_API_KEYPI_CONTEXT_MODE_PRICE_OUTPUT_PER_TOKENSLACK_BOT_TOKENSSH_AUTH_SOCK

License

NOASSERTION

Stars

23,423 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (11 observation(s))

Network

declared (6 observation(s))

Shell

declared (10 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (25)

atob( ... /exec(

payload.mjs

const displayName = exec(

exec(sql: string): any {

exec(sql: string): any {

/exec(?:Sync|File|FileSync)?\(\s*(['"`])(.*?)\1/g,

/exec(?:Sync|File|FileSync)?\(\s*(['"`])(.*?)\1/g,

if (a === 169 && b === 254) return "block"; // link-local incl. 169.254.169.254 (IMDS)

context-mode.session-reset, ctx_purge

.mcp.json.codex.example

.mcp.json.example

.ignore

console.log(`  1 token (post-dedup)            : ${dedup.deduped.toFixed(1)} μs/query`);

"../../.ssh/id_rsa",

"../../.ssh/id_rsa",

export { default } from "../../../build/adapters/pi/extension.js";

import { parseJsonc } from "../../util/jsonc.js";

import { resolveClaudeConfigDir } from "../../util/claude-config.js";

import { checkPluginCacheIntegritySync } from "../../util/plugin-cache-integrity.js";

import { hashProjectDirCanonical } from "../../session/db.js";

- **Cloud metadata + link-local**: `169.254.0.0/16` (incl. AWS/GCP/Azure IMDS endpoint `169.254.169.254`) hard-blocked even if a hostname resolves to it (DNS-rebinding defense).

expect(classifyIp("169.254.169.254")).toBe("block");

expect(classifyIp("::ffff:169.254.169.254")).toBe("block"); // IMDS via IPv4-mapped

imds: classifyIp("169.254.169.254"),

baseUrl = `http://127.0.0.1:${addr.port}`;

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 4031d1c9f64f · full audit: observations/trust-audit/mcp-server/mksglu__context-mode.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions