Store content in a searchable knowledge base (BM25 over FTS5). Splits markdown by headings, keeps code blocks intact, and persists the raw chunks. The full content stays in storage \u2014 retrieve any section on-demand via ctx_search; nothing is summarized or truncated. WHEN: - Documentation from...
AI agents use ctx_index to create or update resources in Context Mode — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Context Mode environment.
ctx_index writes and persists data to a storage/knowledge base, splitting and indexing content for later retrieval. It is a reversible write operation (data can be purged via ctx_purge), with medium severity since an agent could store large or sensitive content into the knowledge base, affecting subsequent searches and context.
From the tool's definition 'Store content in a searchable knowledge base' and 'persists the raw chunks' and 'The full content stays in storage'
Documented attack patterns abuse exactly the kind of access ctx_index gives an agent:
PolicyLayer is an MCP gateway — it sits between your AI agents and Context Mode, and nothing reaches the server without passing your rules. This is the rule we recommend for ctx_index:
{
"version": "1",
"default": "deny",
"tools": {
"ctx_index": {
"limits": [
{
"counter": "ctx_index_rate",
"window": "minute",
"max": 30,
"scope": "grant"
}
]
}
}
}ctx_index stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.
Free to start. No card required.
Store content in a searchable knowledge base (BM25 over FTS5). Splits markdown by headings, keeps code blocks intact, and persists the raw chunks. The full content stays in storage \u2014 retrieve any section on-demand via ctx_search; nothing is summarized or truncated. WHEN: - Documentation from Context7, Skills, or MCP tools (API docs, framework guides, code examples) - API references (endpoint details, parameter specs, response schemas) - MCP tools/list output (exact tool signatures and descriptions) - Skill prompts and instructions that are too large to keep verbatim in conversation - README files, migration guides, changelog entries - Any content with code examples you may need to reference precisely later WHEN NOT: - Log files, test output, CSV, or build output \u2014 use ctx_execute_file, which processes in-sandbox without persisting bytes - Single-use ephemeral content you will not query later \u2014 keep it inline if it fits, or ctx_execute_file it RETURNS: Indexing metadata: chunk counts (total, code-bearing), source label, and the exact ctx_search call shape to query the indexed content. Raw content is NOT echoed back \u2014 it lives in storage, retrievable via ctx_search(source:. It is categorised as a Write tool in the Context Mode MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Context Mode MCP server in PolicyLayer and add a rule for ctx_index: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Context Mode. Nothing to install.
ctx_index is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the ctx_index rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for ctx_index. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
ctx_index is provided by the Context Mode MCP server (mksglu/context-mode). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Start from Context Mode, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.
Free to start. No card required.
11 Context Mode tools catalogued and risk-classified — across an index of 43,000+ MCP servers.