Security: your agent permissions stay in charge

Short answer: code from ctx_execute runs as you, with the same access you have, and your agent still asks you before each call. It runs in your project, the Context Mode hooks read your deny rules first, and only what the code prints reaches the model.

Free · Local · Private · Yours to keep

Context Mode Engine is source-available under the Elastic License 2.0. Use it, copy it, change it and share it at zero cost, for as long as you follow the licence terms. It runs on your machine, sends zero usage data, and keeps your data in ~/.context-mode.

The question: who runs the code?

Context Mode Engine asks your agent to run small scripts with ctx_execute. A fair question follows: what can that code do, and who decides? The answer is short. You decide, with the same permissions you use today.

Your agent asks first, as before

Each ctx_execute call is a normal tool call. Your agent shows it to you and asks, as it does for any other tool. Your allow list, your deny list and your agent's own sandbox stay in force. Keep your agent's permission prompts on.

The hook reads your deny rules first

On Claude Code, the PreToolUse hook reads your deny rules before any rule of its own. It reads these files, in this order:

• .claude/settings.local.json in your project,
• .claude/settings.json in your project,
• settings.json in your user Claude folder.

It applies the rules to Bash and Read calls. A deny rule you write for Claude Code also stops the same command when it comes through Context Mode.

{
  "permissions": {
    "deny": ["Bash(git push:*)", "Read(./.env)"]
  }
}

Set CONTEXT_MODE_REQUIRE_SECURITY=1 for a strict mode. By default, a settings file with bad JSON gives a warning, and the hook goes on. With this variable set, the hook denies each tool call until you fix the file.

The code runs as you, in your project

Context Mode starts the code as a process on your machine, as your user. It starts in your project folder. The code reads your files and uses your network, as any command you type does.

• Context Mode passes the command as a list of arguments, and skips the shell.
• It removes preload variables from the environment: NODE_OPTIONS, BUN_OPTIONS, DENO_OPTIONS and similar names. Other variables, such as your API keys, pass to the code.
• It writes the script to a temp folder outside your project and deletes it after the run.
• At the timeout, or when you stop it, it ends the whole process tree.

Here "sandbox" means the place where the output stays, out of the context. The model reads only what the code prints.

URL fetch reaches public addresses only

When your agent asks ctx_index to fetch a URL, Context Mode checks the address first. It blocks private and link-local addresses, such as 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16 and 169.254.0.0/16. It checks each address a host name points to, connects to the address it checked, and checks again at each redirect, for at most 5 hops. This check covers ctx_index. Code in ctx_execute uses your network as you do.

Setup backs up what it touches

The setup command backs up every file it touches under ~/.context-mode/backups. It writes only the files in its plan. It rolls back an agent whose check ends with an error. It keeps CLAUDE.md, AGENTS.md and your other instruction files as they are. Doctor and the debug report remove secrets by their structure before they print.

What you get

You stay in charge. Your agent asks you before each call, your deny rules apply first, and the code runs as you, in your project. Context Mode adds one thing: the output stays on your machine, and the model reads a short reply.