Kontext provides runtime control and authorization for AI agents by evaluating every tool call from Claude Code, Codex, and Cowork against security policies before it executes. The platform installs as a lightweight daemon on endpoints or in the cloud, with an observe mode that backtests policies against real agent traffic before enforcement begins. It uses deterministic policy plus a local judge model to make millisecond-level decisions on each action.
Funding
$4M raised to dateRaised to date based on public sources. This may differ from the amount the company actually raised and is based only on what is publicly available on the internet.
ACHFounders
Product
Problem
AI agents can hold valid credentials and use approved tools while taking actions that exceed the authority of their assigned task, such as reading untrusted content that triggers destructive commands or unauthorized data exfiltration. Traditional identity and access tools assume a human is making each decision, leaving organizations without visibility into what agents actually do or a way to stop harmful actions before they execute.
Solution
Kontext provides runtime control and authorization for AI agents by hooking every tool call from Claude Code, Codex, and Cowork before it executes, evaluating each action against deterministic policy plus a local judge model in milliseconds. The daemon installs on the machines where agents run, with no code changes, no gateway, and no added latency. Teams start in observe mode to backtest policies against real agent traffic, then flip to enforce mode where destructive commands never reach the shell and risky actions wait on human approval. Every decision is attributed and exportable, capturing who ran what, where, and why it was allowed, denied, or escalated.
Target Audience
Primary users are security teams and developer organizations running AI coding agents like Claude Code, Codex, and Cowork, as well as enterprises deploying agent applications in cloud or SaaS environments that need runtime visibility and control over agent behavior.
Features
- Enforces policy on every agent tool call, API request, and credential issuance before execution, with decisions in milliseconds
- Runs locally as a daemon on developer machines, cloud workloads, or at the SaaS layer, with no code changes or gateway required
- Observe mode backtests policies against real agent traffic before enforcement, allowing teams to validate rules without blocking work
- Supports layered policies across org, group, user, agent, repo, and branch, with configurable payload capture (omitted, summary, or full)
- Includes Merlin, a local classifier that reads user requests, tool history, and proposed calls to detect prompt injection and misaligned actions with 91.19% accuracy and 47.49 ms inference time
- Integrates with existing credential systems, issuing short-lived or narrowed tokens when an action requires a fresh credential