Solution
The auditor asks what your agents ran. Show one record.
Turn Protect on, and the gateway logs each tool call it blocks. Each rule change goes into a history where each entry's hash covers the one before it.
What are our agents doing right now?
Live shows running sessions and the saving per minute. In your terminal, a line that starts with context-mode · gives what a turn saved.
What did Protect stop?
In each row
- Time, decision, rule
- Tool, program, host
- Project, session, policy version
Never in a row
- Command text
- Flag values
- Environment values
- File contents
Would block: a rule in Monitor records the call and lets it run. Filter, then export as CSV or JSON Lines.
Who loosened that rule, and why?
signed-in person · editor · adds a rule · tightens API key · import · adds a rule · tightens signed-in person · editor · deletes a block rule · loosens · reason kept Each entry's hash covers the one before it.
An API key can only tighten. Edit or delete an entry, and Verify record says where the chain breaks.
Who is stuck, and on what?
222 patterns over events from the free Engine on each machine, with an Insight key. Insight does not read file contents.
Agents run commands all day. Can you say which?
An auditor asks. The answer sits in session files on each laptop, or nowhere.
A block rule is gone. Nobody knows who removed it, or why.
A rule in test mode lets the call run. You need to see which calls it would have stopped.
One path for every request. One record of it.
- 01Point your agents at the gateway
npx @context-mode/cli sets the base URL in each agent's config.
- 02Turn Protect on
Pick a preset. Try a rule in Monitor first: it records the call and lets it run.
- 03Each Protect decision is logged
Once you turn Protect on: the rule, tool and program. A row never holds the command text, flag values, environment values or file contents.
Numbers you can check. An audit log you can show.
Each rule change sits in a history where each entry's hash covers the one before it. Protect checks only requests that go through the gateway; see keep the gateway on. For what each request cost, see Track agent spend. The production run →
Each audit question has one screen.
| Your question | Where you see it | What it holds |
|---|---|---|
| What runs now? | Live | Running sessions, each request as it happens, the saving per minute |
| What did it cost? | Analytics | Tokens, cost and saving over time, by session, project and agent. Not by person yet: there are no team roles. |
| What was blocked? | Protect, Activity | The decision log: time, decision, rule, tool, program, host, project, session. "Would block" means a rule in Monitor recorded the call and let it run. Export as CSV or JSON Lines. |
| What did no rule cover? | Protect, Activity | Programs, sites and tool servers your agents used, most used first, each with Block and Allow |
| Who changed a rule? | Protect, History | Who, how, the rule before and after, the reason, and whether it loosens the policy |
| Who is stuck? | Insight | Blockers, risks and changes, by person, team and project, from the free Engine on each machine, with an Insight key |
Related: secure coding agents, cut agent spend, team standards.
What this uses.
Checks every tool call before it runs. Logs each block and each rule change.
The decision log fields, the History tab and how to verify the hash chain.
How the console's ledger prices each request, and where you see the saving.
How your team works with agents, from free Engine events, answered by role.
Live, Analytics and Protect are in every plan, Free included. For Team, write to sales@context-mode.com.
Know what your agents did. Show it to an auditor.
npx @context-mode/cli connects your agents. 1,000 requests free, no card.