Kontext: free tier, agent policies and enforcement limits
Scoped recheck: 24 October 2026. Official documentation, pricing and privacy review; no account, setup, install, recording or payment test.
Kontext checks supported agent tool calls against workplace rules. It can block calls at a supported control point, but it is not a universal kill switch.
What does Kontext do?
Kontext helps teams discover agents, record tool calls, apply policies and review risk and cost. A tool call is an action such as running a shell command. A policy is a rule that decides whether an action is allowed.
Its docs cover Claude Code and Codex hooks. Endpoint-based Cowork uses Claude Code hooks. Cloud-hosted Cowork cannot be observed by this endpoint setup. Blocking happens at the pre-tool-use hook, not every event or every possible agent.
Is it free?
The current official site still lists Free at US $0 with 5,000 transactions/month, Team at $500/month with 100,000 transactions then $1 per 1,000, and Enterprise custom with unlimited transactions. Removed older rupee conversions instead of presenting a stale exchange rate. These are website prices, not an India checkout or tax-inclusive quote. Ask how transactions are counted, what happens at the cap and which features your workspace includes. Workplace deployment needs organisational permission and data review.
Ask how transactions are counted, what happens at the limit and which features your workspace includes. Workplace use needs organisational permission and data review, including for teams in India.
How to start safely
- Use an authorised workspace. The quickstart requires an owner or admin, macOS, Homebrew and Claude Code or Codex.
- Follow the dashboard's Get started steps and documented Homebrew installation.
- Keep the setup key private. The docs suggest interactive setup to avoid placing it in shell history.
- In Codex, review and trust the Kontext hooks. Until then, Codex sends no events.
- Run the official read-only test and
kontext doctor. Confirm the trace in Explore. - Test a policy in Observe before considering Enforce.
Observe does not block
Observe lets calls run even when a policy would deny them. Enforce stops a Deny at the supported hook. Risk assessment is separate: a later risk finding is not evidence that the action was stopped.
Pause also allows every tool call while recording continues. After the first enforcement, observing policies are dashboard replays against recorded calls, not simultaneous live endpoint policies. Endpoints refresh about once a minute. A locally fixed MDM Observe/Enforce setting overrides dashboard mode; waiting will not clear that mismatch. Confirm a new decision on every endpoint instead of assuming a dashboard switch already reached them.
The CLI v1.8.1 failure table includes request-conversion failures among cases that can run in Enforce unless another request in the same compound command returned Deny. Offline endpoints use valid cached policies without an age limit, even if an update was rejected; changed/paused policy does not reach them until they check in. Kontext does not isolate the filesystem or network at OS level. Without a post-tool event, a recorded decision does not confirm the final outcome.
The docs state an important failure limit. If policy evaluation fails, a call can run even in Enforce unless another request in the same compound command returned Deny. By contrast, an unreachable daemon or no usable policy leads the enforcing hook to deny calls. Test these cases before relying on it for destructive commands.
What data leaves the endpoint?
Policy checks happen locally, but records go to the workspace. Hosted AI assessment can receive redacted tool-call data and nearby context for flagged calls. Even Omitted payload capture still sends redacted summaries and certain flagged context. Secret redaction does not remove every confidential business detail. Review capture settings with your security team.
Resource scanning is on by default and reports MCP servers, plugins, permissions and credential presence, not secret values. Turning the scan off and deleting its resource report does not delete tool-call records or change payload capture. Cost records still send model names, token counts and timing under Omitted mode, while excluding prompt/reasoning/tool content from those usage records. The optional local guardrail model is off by default; hosted assessment still applies to flagged calls as documented.
Uninstalling with the documented setup command preserves local identity and records, leaves the Homebrew binary installed and does not erase workspace activity. Hosted deletion needs the organisation’s retention/deletion process. The privacy policy, updated 5 October, says no stated purpose needs personal data beyond 24 months after account termination, with legal retention and backup-isolation exceptions. That is not an immediate delete-all guarantee, nor a tested per-workspace retention setting. The privacy notice says no knowing collection from under-18s.
What changed since the original AiCoN post?
The 24 October review keeps verified free/paid website pricing and supported-hook limits, removes stale rupee estimates, and adds cached-policy age, locally fixed MDM modes, Observe replay/Pause behaviour, decision-versus-outcome limits and uninstall/retention boundaries. No endpoint, policy, agent, failure, billing or deletion test was performed. Original 7 October publication retained.
Frequently asked questions
Does Observe prevent damage?
No. It records what a policy would do while allowing the call.
Are all agents covered?
No. Verify the agent, runtime and hooks against the docs.
Does local evaluation mean fully offline privacy?
No. Records and some assessment context leave the endpoint.
Who is it for?
Developers and teams able to test policies and manage permissions. It does not replace backups, access limits or code review.
Sources: Product and pricing · Quickstart · Supported agents · Decisions and failures · Data collection · Privacy. Checked 7 October 2026.
Scoped recheck: CLI v1.8.1 failures, cache, rollout and local-mode overrides · Observe replay, outcome limits and no OS isolation · payload, scan, usage and uninstall retention · personal-data retention and minors. Checked 24 October 2026. Source claims, not a hands-on account or deployment test.