Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

Analysis · October 14, 2026 · repo

mksglu/context-modemcpclaude-codeagent-memoryagent-security

Context-Mode Makes Your Coding Agent Search Its Tool Output Instead of Reading It

The context savings are real. The word "sandbox" means something narrower than you'd guess, and that's the part to understand before you install it.

Coding agents don't usually run out of intelligence in a long session. They run out of room.

Every tool call pours its raw result into the conversation. A browser snapshot, a page of GitHub issues, an access log. The agent reads all of it, keeps all of it, and an hour later it's forgetting what file it was editing because the window is full of log lines it needed once.

The fix is to stop pouring output in at all, and let the agent search it instead.

context-mode is a source-available plugin for coding agents built around that idea. It's on Trendshift's daily board again this week, so it's worth understanding what it actually does, and what its "sandbox" does and doesn't protect.

The problem it names

The project's README puts numbers on the bloat (README, v1.0.169). By its own measurements, a Playwright snapshot (a dump of what a web page looks like to the agent) costs 56 KB of context. Twenty GitHub issues cost 59 KB. One access log, 45 KB. The README claims that "after 30 minutes, 40% of your context is gone."

Those are the project's figures, not an independent test. But anyone who has watched a Claude Code session hit its limit after a few big tool calls will recognize the shape.

The idea: print the answer, index the rest

context-mode is an MCP server. MCP (Model Context Protocol) is the standard way to give an agent extra tools; an MCP server is a small program that offers those tools. context-mode adds tools that run work for the agent and hand back only a slice of the result.

The main one is ctx_execute. Instead of reading 47 files to count their lines, the agent writes a short script that does the counting, and only what the script prints comes back into the conversation (how the sandbox works). It supports twelve languages, including JavaScript, Python, Shell and Go.

When output runs past 5 KB and the agent says what it's looking for, context-mode doesn't paste it back. It indexes the full output and returns only the matching sections. The index is SQLite's built-in full-text search, ranked with BM25, the same classic relevance scoring many search engines use (knowledge base).

Here's the shift in plain terms. Normal agents treat tool output like a book they have to read cover to cover. context-mode treats it like a library: the agent asks a question and gets the page it needs.

The README's headline claim is that over a full session, "315 KB of raw output becomes 5.4 KB," and that session time stretches from about 30 minutes to about 3 hours (benchmarks). Again, self-measured. I didn't run them.

Two smaller details show someone thought about how agents misbehave. Fetched web pages are cached for 24 hours by default, so the agent doesn't re-download the same docs every turn (TTL cache). And search calls get throttled: after eight search calls the plain search is blocked and the agent is pushed toward a batched call (throttling). That's a guardrail against an agent searching in circles.

Memory that survives compaction

The second half of the project goes after a different failure. When a coding agent's window fills up, it compacts: it summarizes older messages to make room. Summaries lose things, and the usual casualties are the boring details that matter most, like which file you were in and which task was half done.

context-mode keeps its own log. Every file edit, git operation, task, error and decision you make goes into a local SQLite database (session continuity). When the conversation compacts, it doesn't paste that log back in. It searches it and returns only what's relevant to the current step.

There's a privacy-friendly default hiding in that section too. If you start a fresh session instead of resuming with --continue, the README says the previous session's data is deleted.

What it looks like in a session

The README ships ready-made prompts to try (Try It). One of them:

Clone https://github.com/facebook/react and analyze the last 500 commits:
top contributors, commit frequency by month, and most changed files.
Then run /context-mode:ctx-stats.

Without context-mode, an agent doing that would pull a long git log into the conversation and count by reading. With it, the agent writes a script, the script does the counting, and the README says the whole job comes back as one call and about 5.6 KB of context. The ctx-stats command at the end shows you the per-tool breakdown so you can see where the savings came from.

It's a good first test because you can check the answer. Run the same question with the plugin off and compare both the result and how much of your window it ate.

What "sandbox" means here

This is the part worth reading slowly.

The README calls these "sandbox tools." Each ctx_execute call runs in its own subprocess, so scripts can't see each other's memory. That's real, and it's what keeps raw data out of your context window.

It's not a security boundary, and the README says so if you read far enough. In the security section: ctx_execute and ctx_batch_execute "run arbitrary code and still inherit the process's filesystem access," and the advice is to "treat approving any execution tool as approving arbitrary code, and keep host-level sandboxing enabled" (security notes).

It also passes your credentials through on purpose. Command-line tools like gh, aws, gcloud, kubectl and docker "inherit environment variables and config paths" so they work inside it (credential passthrough). Handy. Also exactly what an attacker would want.

Now put that next to how Claude Code's own sandbox works. Claude Code can wrap the agent's shell commands in an operating-system sandbox that limits which files they write and which hosts they reach. But its docs list "local MCP servers" among the processes that "run with your full access," outside that sandbox (Claude Code sandbox docs).

So when context-mode routes a command away from Claude Code's Bash tool and into ctx_execute, it saves context, and it may also move that command from inside Claude Code's sandbox to outside it.

That's not a guess about a hypothetical. The README describes a reported case (issue #852) where "an agent, denied an out-of-project read by the host sandbox, retried through the MCP sandbox" (boundary containment). The project's fix confines ctx_execute_file to your project folder by default. It describes that guard as a "defense-in-depth layer for the file-read tool, not a full OS sandbox." The general execution tools still have your file access.

The honest one-line version: context-mode's sandbox protects your context window from your tools. It doesn't protect your machine from your agent.

Put this into practice

If the context savings sound worth it, here's a careful way in.

1. Check the requirements. For Claude Code you need v1.0.33 or later. For most other clients the README lists Node.js 22.5 or newer, or Bun (install).

2. Install the Claude Code plugin. Inside a Claude Code session:

/plugin marketplace add mksglu/context-mode
/plugin install context-mode@context-mode

Restart Claude Code or run /reload-plugins, then run /context-mode:ctx-doctor. The README says every check should show [x].

3. Turn on Claude Code's own sandbox first. context-mode's advice and Claude Code's docs agree on this. Run /sandbox, or set "sandbox": { "enabled": true } in ~/.claude/settings.json (sandbox docs). It won't cover ctx_execute, but it keeps everything else your agent runs inside the wall.

4. Write deny rules once. context-mode reads the same permission rules as Claude Code and applies them inside its own tools. If you block sudo in .claude/settings.json, it's blocked in ctx_execute too (security):

{
  "permissions": {
    "deny": [
      "Bash(sudo *)",
      "Read(**/.env*)"
    ]
  }
}

The README says it also splits chained commands, so echo hello && sudo rm -rf /tmp gets blocked on the sudo part.

5. Don't approve execution tools on autopilot. When Claude Code asks to run ctx_execute, the prompt title now reads as code execution ("Run code in a sandbox…"). Treat it like approving a shell command with your full rights, because that's what it is.

6. Measure your own savings. Run a real task, then /context-mode:ctx-stats for a per-tool breakdown. That's the only benchmark that matters for your codebase.

7. If you run it on a shared box or in CI (continuous integration), block private network targets. The fetch tool allows localhost and private network ranges (addresses like 192.168.x.x that only work inside your network) by default so local dev servers work. export CTX_FETCH_STRICT=1 blocks them. That setting covers the fetch tool only, not code you run through ctx_execute (network hardening).

Honest limitations

The license isn't open source. context-mode uses the Elastic License 2.0. You can use, copy, modify and redistribute it, but you can't offer it to others as a hosted or managed service that exposes a substantial part of its features, and you have to keep the license notices (license). Fine for your laptop. Read it before you build a product on it.

"Nothing leaves your machine" has an asterisk. The privacy section says "No telemetry, no cloud sync, no usage tracking" (privacy). The same README lists /context-mode:ctx-insight, which "opens the hosted Insight dashboard" at context-mode.com "in your browser" for "org analytics" (commands). The README doesn't say what that page receives. Check before you run it on client work.

The numbers are the project's own. The 98% reduction, the 30-minute-to-3-hour claim, and the "users" badge all come from the maintainer. The logo row of big-company names in the README links nowhere.

The release pace has slowed. The latest tagged release is v1.0.169, from June 29, 2026 (npm). The latest commit on main, from October 14, updates install stats. The trending spike isn't a new version.

Indexing changes what the agent sees. When context-mode returns "only the relevant matches," something decides relevance. If BM25 misses the line that mattered, the agent never sees it, and it won't know it missed anything.

Who should try it

If your sessions die from tool-output bloat (browser automation, big logs, sprawling repos), context-mode's core idea is the right one, and it's worth a week's trial with ctx-stats open.

Install it with the sandbox on, deny rules written, and one clear idea in your head: it shrinks what your agent reads. It doesn't shrink what your agent can do.

Sources: mksglu/context-mode README at v1.0.169 (tag dated 2026-06-29; main README identical as of 2026-10-14) · context-mode on npm · context-mode issue #852 · Claude Code sandbox docs. Read October 14, 2026.

Medium metadata

  • Title: Context-Mode Makes Your Coding Agent Search Its Tool Output Instead of Reading It
  • Alternate titles: "You Don't Have to Pour Every Tool Result Into Your Agent Anymore" / "Context-Mode Turns Coding Agents Into Search-First Systems"
  • Subtitle options: (1) The context savings are real. The word "sandbox" means something narrower than you'd guess, and that's the part to understand before you install it. [picked, trimmed for Medium if needed] (2) A source-available MCP plugin that keeps logs and snapshots out of your agent's context, and the one security detail its README buries. (3) How to stretch a Claude Code session without trading away your sandbox.
  • Description: context-mode keeps raw tool output out of your coding agent's context and lets it search instead. Here's how it works and what its sandbox doesn't cover.
  • Tags: (1) Claude Code: the primary install target. (2) AI Agents: the broader audience fighting context limits. (3) MCP: the protocol the tool is built on. (4) Developer Tools: practical install and settings. (5) Cybersecurity: the sandbox caveat.
  • Article type: A (spike), built around a trending repo. Publish plan: post at 7 to 8 AM, let Medium distribute for 2 to 6 hours, send to subscribers only if it is performing.