Context Fence sits between your AI agent and its MCP tools on your own machine. Every action a schema check, not an LLM judge, so it stays under 10ms. Nothing leaves your machine. That is the point.
The July 18 incident — what happened, why the usual fix doesn't fix it, and where the guard actually lives.
On July 18, a coding agent read the .env file it was never asked to open, then sent what it had read across the wire. The keys left the machine inside an API payload. The usual fix — a cloud gateway and a vendor's deny-list — would have hoped for the best: every call leaves your machine first. Ours doesn't. The guard lives where the agent lives: a gate at the boundary. Nothing leaves.
keep scrolling — the words come in
Everything it was asked — including the parts nobody asked for. Nothing on the machine objected. The keys left inside an API payload.
Route all agent traffic through a cloud gateway and hope the vendor's list of bad things is good enough. Every call leaves your machine first.
On your machine, checking every call before it happens — at the speed of a schema check, not at the speed of a jury.
Each MCP request is checked against local YAML rules before it reaches a tool. No exfil channel, no central server to trust.
Allow- and deny-lists written in YAML, not code. No SDK, no plugin API to learn. Edit the file, the proxy picks it up.
Values that look like keys, env vars, or JWTs are redacted from agent reads before they reach the model. If it walks like a token, it does not pass.
Instructions hiding in tool output get flagged before the agent can act on them. The point is to catch the payload the page already read.
Every decision, allowed or denied, lands in a local SQLite log with the rule that fired. Findable after the fact, the way incident postmortems need.
The proxy runs on your machine and talks to nobody. Uninstall it and nothing else changes; there is no account to deactivate.
A web console for policies across a fleet and synced audit logs. It is on the roadmap, not in the box. Local-only works today without it.
No live customers yet. These are the four shapes of shop we built it for, with what internal testing showed so far.
Agency running client MCP servers
One team of agents was the attack surface for a dozen client repos at once. One wrong read, and the client's secrets move with it.
Per-client policy files on a shared machine, so a denial for one repo is not overruled by another repo's rules.
Every denied call logged with the rule that fired. The agents run exactly as before.
Solo dev shipping with Claude Code agents
One person, one machine, an agent with broad tool access, and production keys in env vars that have to stay in env vars.
Default-deny on the risky calls: git push to non-allowlisted remotes, writes outside the project, reads of env files.
Tripped the fence in the first hour. The SQLite log named the rule and the line of output.
Gateway fronting every MCP endpoint they expose
A production gateway with MCP endpoints pointed at internal files. One missing allowlist entry read like an open door.
Each tool got a per-session allowlist. Requests outside it were denied before any tool code ran.
The denied requests showed up in the log as one repeating line: the same probe, four different paths.
A REPL that could reach the vault
A REPL with a path into the vault. The first command anyone ran was: try to read the auth file.
Commands outside the session scope were refused. The vault path never reached the model.
The refusal arrived as plain text in the REPL. No retry, no workaround, no special case.
bench notes · july 2026
The local core is free and it works today. Paid plans run on the hosted console — policy sync and audit aggregation only, never your traffic — and the prices below are the plan.
Prices are planned for the hosted console, which is still in build. The local core is free and ships today. Prices are shown in your local currency, converted from USD. Read how data is handled in the privacy policy. privacy policy.
Five answers, no hedging. If we have not shipped it yet, we say so.
One honest issue a month: what the fence blocked, what agents did next, and the occasional early-access invite before the crowd.