LeanCTX Context Intelligence

The evidence shows default project path jailing, secret-path denial, workspace-trust gating, role permissions, and local audit events. Telemetry is opt-in, the proxy is disabled by default and loopback-bound, and update checks, model downloads, and proxy flows are disclosed; sensitive-data handling and data-flow transparency are therefore thorough. Shell, cloud commands, and high-risk tools can be denied, but an authorized ctx_execute has full user-level shell reach, onboarding may operate without prompts, and project configuration, proxies, and addons enlarge the attack surface, so least privilege, confirmation, and external-effects handling do not receive full marks. Unwrap, immediate disablement, content recovery, and snapshot restoration are described, but there is no uniform transactional rollback for configuration changes, command side effects, or addon installation, so rollback is 2. Dependency auditing, cargo deny, checksums, and pinning are described and partly supported by workflow evidence, but no lockfile, audit output, or current vulnerability inventory is supplied, and HuggingFace models lack cryptographic pinning; dependency security is 2. The repository owner, license copyright holder, and security contact are clear, but enterprise publisher identity is unverified and broader organizational provenance is not established, so attribution is 2.

The README, security policy, and tests jointly support the local client, HTTP tool manifests, adapter conversion, error parsing, and helpful ImportErrors for optional dependencies. Live tests also define a manifest-drift gate, but require an environment URL and optional frameworks, so dependency availability and failure messages score 2. Self-consistency scores 1: the README says 79 MCP tools while the object description says 76, and the security document's claim of 29 dependencies and limited network use sits uneasily beside extensive server, proxy, model-download, and ecosystem functionality. “Local-only” also requires numerous later qualifications. The static material does not establish that all broad claims are synchronized at this revision.

The material gives concrete journeys for onboarding, daily coding, memory, code comprehension, multi-repository work, lifecycle operations, and regulated deployments, spanning many agents, models, and SDKs; audience and scenarios are thorough. Capability boundaries are unusually explicit about PathJail, roles, the differing constraints of ctx_shell and ctx_execute, the proxy's MITM role, and the absence of kernel sandboxing, earning 3. Activation offers agents-only mode, wrap commands, explicit proxy enablement, and workspace trust, but zero-prompt onboarding, transparent shell hooks, and automatically merged configuration can make some triggers less conspicuous, so trigger precision is 2. Multiple platforms and installation channels are covered, with Windows residual risks and container mitigations disclosed, but production TLS, external models, optional frameworks, and package-manager requirements create environment prerequisites, so environment fit is 2.

The README has strong navigation, capability sections, quick starts, scenarios, SDK examples, troubleshooting, and reference pointers, supporting full marks for architecture, installation notes, and examples. SECURITY thoroughly records residual risks, mitigations, and regulated-environment configurations, so known limitations earns 3. The complete Apache-2.0 text, copyright notice, and README label agree, earning 3 for license. Naming is generally stable and the client tests expose a contract version, but “AI Value Gate/Lean Context,” the 76/79 tool-count drift, and changing version examples show terminology and inventory drift, so naming stability is 2. A changelog is linked and version changes plus a last-updated date are noted, but the changelog itself and a compatibility policy are absent from the supplied evidence, so versioning is 2. A security email, private-advisory route, response target, and copyright holder are identified, but publisher identity remains unknown and no formal support entity or redundancy is shown, so maintenance responsibility is 2.

Commands, SDK examples, diagnostics, dashboards, recovery handles, and structured HTTP errors make outputs directly actionable, so output usability earns 3. Compression, caching, recoverability, graph search, memory, and cost ledgers offer plausible value beyond ordinary agent tooling, but the supplied code evidence covers only Python clients and adapters rather than the core 79-tool implementation, so marginal value is 2. The source states 50–80% savings, approximately 13-token rereads, a benchmark workflow, and CPAO/Shadow Mode, but supplies no revision-specific benchmark report or raw results and does not quantify setup, governance, or compression-error costs; cost-benefit is therefore 2.

Many claims point to repository security material, reproducible demo tapes, reference documentation, CI, and benchmark commands, while tests concretely cover HTTP forwarding, error parsing, adapters, and manifest equality. This supports scores of 2 for traceability and cross-source corroboration. The supplied evidence lacks core implementation files, benchmark artifacts, lockfiles, and CI results, so broad features and percentage claims cannot be closed-loop verified statically. Fact/inference separation scores 1 because marketing statements such as “definitively a false positive,” “never discards,” “quality held,” and “zero config” are categorical and are not consistently distinguished nearby from measured results, design intentions, or roadmap projections.