Context Guardrails are launching soon. This page describes how they will work; availability will be announced on the blog and changelog.

Agents fetch packages, load web pages, install MCP servers, and clone repositories without reviewing any of it. Context Guardrails score every piece of external context before the agent trusts it, so agents keep full capability without inheriting untrusted input.

This feature complements Runtime Guardrails, which decide what an agent may do. Context Guardrails decide what an agent may consume.

What gets scored

Every entity is checked before the agent consumes it:

• Files and repositories — read before the agent trusts their contents.
• URLs and web pages — fetched content, contributor profiles, and vendor pages.
• Packages — npm, PyPI, and other registry artifacts before install.
• MCP servers and skills — tool descriptions and instructions before they enter the context window.
• Email and messages — sender metadata and content patterns before the agent acts on them.

How scoring works

Every entity is scored across four dimensions: who published it, how it behaves, what's actually in it, and who else trusts it. Each check returns a score, a verdict of safe, suspicious, or dangerous, and a confidence level. Cached results come back in under 50ms.

Integrations

At launch, Context Guardrails will work where your agents already run — hooks for Cursor, Claude Code, Codex, and Gemini CLI, wrappers for AI SDK, Mastra, and LangChain, plus an API and CLI.

Next steps

• Runtime Guardrails