// SCAN REPORT

Context

31 tools. 13 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 3 Jul 2026

13 can modify or destroy data

18 read-only

31 tools total

Community server · catalogue entry verified 03/07/2026

How to control Context ↓

TOOL MAP

What Context exposes to your agents

Read (18) Write / Execute (11) Destructive / Financial (2)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Context tools

Destructive · High delete_file This tool permanently removes files and directories without the ability to undo the action. Destructive · High git_reset git reset --hard and similar reset modes can permanently discard uncommitted changes and move HEAD to previous commits, destroying work that cannot be recovered without access to the reflog. Execute · High codegraph_build While this tool doesn't directly delete data (Destructive) or move money (Financial), it executes a non-trivial operation that could have significant side effects depending on the directory path provided. Execute · Medium git_branch While listing branches is a Read operation, creating and checking out branches modifies the git repository state (creating new refs, changing HEAD).

13 of Context's 31 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Context

PolicyLayer is an MCP gateway — it sits between your AI agents and Context, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_file": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "codegraph_html": {
    "limits": [
      {
        "counter": "codegraph_html_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "codegraph_affected": {
    "limits": [
      {
        "counter": "codegraph_affected_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Context — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON CONTEXT →

Instant setup, no code required.

FULL CATALOGUE

All 31 Context tools

DESTRUCTIVE 2 tools

Destructive delete_file Delete a local file. Pass recursive:true to delete a directory and its contents. Destructive git_reset Unstage files or reset HEAD. Use mode:file + path to restore a single file.

EXECUTE 4 tools

Execute codegraph_build Scan a project directory and build the knowledge graph from code files. Execute git_branch List, create, or checkout branches. Execute git_pull Pull from remote and merge into current branch. Execute git_push Push current branch to remote.

WRITE 7 tools

Write codegraph_html Generate interactive vis.js HTML graph visualization. Write context Factual memory — decisions, bugs, notes, discoveries.\n Write create_dir Create a directory (and any missing parent directories). Safe to call if already exists. Write git_add Stage files for commit. Pass paths:[ Write git_commit Commit staged changes. Set all:true to auto-stage tracked modified files first. Auto-saves context entry. Write plan Plan storage — saves to project store, optionally writes a .md file to planDir.\n Write write_file Create a new file or overwrite an existing file.

READ 18 tools

Read codegraph_affected BFS traversal: given a node name, find every node that would be affected Read codegraph_arch Return a module map: every file with its exported functions/classes and what it imports. Read codegraph_filter Filter graph nodes by semantic properties. Results sorted by PageRank (most connected first). Read codegraph_nodes List all nodes of a given type, sorted by PageRank (most connected first). Read codegraph_query Ask a structural question about the codebase OR look up a specific node by name — or both in one call. Read codegraph_report Return CODEGRAPH_REPORT.md — god nodes, clusters, surprising connections, suggested questions. Read error_check Diagnose and track terminal errors.\n Read get_symbol_detail Return the source code and location for a single function, class, or method by name. Read git_diff Show file changes. Use staged:true for cached diff. Optionally scope to a path. Read git_log Show recent commit history — hash, author, date, message. Read git_show Show full diff and metadata for a specific commit. Read git_stash Stash or restore work-in-progress changes. Read git_status Show working tree status — current branch, staged, unstaged, and untracked files. Read list_dir List the contents of a local directory. Read read_file Read the text contents of a local file. Read safety_policy Lists which operations require explicit user confirmation before execution Read search Search across all saved context. Three modes:\n Read tool_registry Lists every MCP tool with its side effects and whether it requires user approval.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Context

Can an AI agent delete data through the Context MCP server? +

Yes. The Context server exposes 2 destructive tools including delete_file, git_reset. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Context? +

The Context server has 7 write tools including codegraph_html, context, create_dir. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Context.

How many tools does the Context MCP server expose? +

31 tools across 4 categories: Destructive, Execute, Read, Write. 18 are read-only. 13 can modify, create, or delete data.

How do I enforce a policy on Context? +

Register the Context MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Context tool call.

Deterministic rules across all 31 Context tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON CONTEXT →

Instant setup, no code required.

31 Context tools catalogued and risk-classified — across an index of 43,000+ MCP servers.