Kontext is a runtime security platform for organisations whose staff use AI agents such as coding assistants. It finds the agents running across a company’s endpoints, shows what they can reach and decides, call by call, whether each action an agent wants to take should be allowed.
The problem it targets is that agents act quickly and with whatever access the user has. Instead of granting broad permissions up front, Kontext sits in the agent’s environment and checks every tool call against policy before it runs, so a security team can stop a destructive command without stopping the agent.
At A Glance
| Vendor | Kontext (Cobrowser Technology GmbH) |
|---|---|
| Category | Runtime security and authorisation for AI agents |
| Identities covered | AI coding agents and workplace agents on managed endpoints |
| Deployment | Endpoint daemon, installed with Homebrew or through MDM, reporting to a workspace |
| Agentic AI | Pre-tool-use policy enforcement for Claude Code, Codex and Claude Cowork |
| Investors | 42CAP, a16z CSX, HTGF |
| Market classification | Agentic AI Identity; also Authorisation |
What Kontext Does
Kontext narrows access control down to one question: should this specific agent action be allowed right now? Broad permissions granted in advance cannot answer that, because the same agent may run a harmless test one minute and a force push the next. Kontext answers it at the moment of the call, using who is running the agent, on which endpoint and with what input. Teams can begin by watching what their rules would have blocked and move to enforcement once they trust them.
Products
Kontext Platform
The Kontext platform gives security and IT teams one place to see and govern agent activity. It discovers coding assistants, workplace agents and custom-built agents across endpoints and cloud environments, and every agent found is marked Managed, Unmanaged or Unsupported, so it is clear which ones Kontext can actually control. Policies decide Allow or Deny for each tool call and start in an Observing state, and presets such as Block GitHub force pushes and Protect Git history give teams ready-made rules for common risky operations, each preset adding a forbid rule for one kind of operation.
Beyond enforcement, the platform flags tool calls that deserve a human review and prices the model requests behind them, which helps teams that need to explain agent spend as well as agent risk. The dashboard is organised into Home, Explore, Risk, Cost and Authorization pages, and administration can be automated through an API.
How It Works
Agents send each tool call to the Kontext daemon on the endpoint, which makes the policy decision locally and records both the decision and the outcome.
| Component | What it does |
|---|---|
| Endpoint daemon | Runs on each computer where agents are used and decides on tool calls without a round trip to the cloud. |
| Workspace | Receives the daemon’s records and holds the team’s policies. A workspace has one mode that applies to all its endpoints. |
| Decision model | Each tool call becomes a request made up of the endpoint, agent, tool, tool input and session. A call is denied if any forbid rule matches, allowed if a permit rule matches, and denied by default when nothing matches. |
| Modes | In observing mode policies only record what they would have blocked. In Enforce mode a Deny stops the call before it runs. |
| Deployment | Individual users install the daemon themselves with a personal API key, while enterprise workspaces roll it out centrally. |
Policies act on the requested tool call, so they do not inspect what a running script does or code executed by an interpreter such as Python.
Identities And Systems Covered
| AI coding agents | Claude Code, Codex and Claude Cowork, with blocking at the pre-tool-use stage. |
|---|---|
| Other agents | About 20 more are detected, including Cursor, Gemini CLI, GitHub Copilot CLI, Windsurf and OpenCode. |
| Tool calls | Shell commands, file edits and MCP tool use. |
| Endpoints | Computers with Kontext installed, managed one by one or through MDM. |
Agentic AI Capabilities
Kontext hooks into each agent’s own lifecycle events:
| Claude Code | Session start and end, pre-tool-use, post-tool-use, failed tool use, stop and subagent stop. |
|---|---|
| Codex | Session start, pre-tool-use, post-tool-use, prompt submission and stop. |
| Blocking | Tool calls are stopped only at pre-tool-use, and only when an enforced policy covers that agent and endpoint. |
| Claude Cowork | Sessions that run on the endpoint are listed and governed; sessions running in Anthropic’s cloud appear as Unmanaged. |
Company Background
| Company | Kontext is built by Cobrowser Technology GmbH. |
|---|---|
| Headquarters | Munich, Germany. |
| Founders | Jens Ernstberger and Michel Osswald. |
| Funding | A reported $4 million round led by 42CAP, announced on 24 September 2026. |
Note: This overview is compiled from Kontext’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.