AI agents forget. kontexta remembers.

On your machine. By default, data lands at ~/.local/share/kontexta (Linux), ~/Library/Application Support/kontexta (macOS), or %APPDATA%\kontexta (Windows) — no configuration needed. You can override this with KONTEXTA_DATA_DIR. Everything is indexed in a local SQLite database. Nothing is sent to a third-party service — no embeddings API, no telemetry, no cloud sync. Your only outbound traffic is the optional git push to a remote you configure yourself.

Kontexta uses SQLite FTS5 for deterministic keyword and regex retrieval — no embeddings, no semantic-similarity guesswork. The same query returns the same results, every time. You also get exact substring/regex search (catches URLs, identifiers, hyphenated terms that tokenisers miss).

Hands tools are declared per-project in kontexta.json — agents cannot invent commands. Each invocation runs with no shell interpreter, a locked working directory, and a scrubbed environment (only PATH, HOME, USER, LANG, TZ are forwarded). Output is capped via a ring buffer; timeouts kill the entire process group. Argv parameters are validated by re2 patterns (ReDoS-proof) with an 8 KB UTF-8 cap, and the default pattern blocks leading-dash argv injection.

No. The MCP server wraps every tool registration at boot, so every call writes a per-event line to the project's append-only event log automatically — fsynced per write, redacted for sensitive args, with git branch/commit context attached. Agents can enrich the log with journal_note (decisions) or journal_intent (topic pivots), but the durable capture happens with zero agent involvement. Periodic distillation (manual via distill_journal, or scheduled via the WebUI) turns the raw event log into per-topic markdown summaries indexed in the same FTS5 surface as the rest of the vault.

Yes. Mark a Hands tool as confirm-required and it returns a single-use, CSPRNG-bound token that expires in 60 seconds. The agent must call confirm_hand with that token to actually execute — the token is the auth, and it cannot be replayed.

The URL clipper performs DNS resolution and rejects every resolved address against a blocklist: loopback, private IPv4/IPv6, link-local, CGNAT, multicast, IPv4-mapped IPv6, and special hostnames (localhost, *.local, *.internal, *.lan). Cloud-metadata endpoints like 169.254.169.254 are blocked. Redirects are followed manually with per-hop re-validation (max 5 hops), so a public URL that 302s into the metadata service is still refused. Response bodies are streamed with a 10 MiB ceiling.

Every path is checked with assertPathInside before read or write — files cannot escape their project root or KB base. move_file validates both source and destination containment. Symlinks are skipped (lstatSync) so a loop under your vault cannot recurse forever. Writes are atomic (tmp file + rename) so a crash mid-write cannot corrupt a file. Download responses strip CR/LF from filenames and use RFC 5987 encoding to block HTTP response splitting.

Git error output is run through redactCredentials() before logging or returning to clients — user:pass@ patterns in URLs are stripped. Hands output is similarly capped and bounded so a runaway process cannot leak via log volume.

Fully. The MCP server, the web UI, and the SQLite index are all local. Git push for backup is optional and the only operation that touches the network.

Anything that speaks MCP: Claude Code, Cursor, Gemini CLI, Codex, Continue, Antigravity, Claude Desktop, Aider, Cline, and OpenClaw. The onboard_agent tool auto-detects and writes the right context file (CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules/*, .continue/rules/*, .aider/kontexta.md, .cline/kontexta.md, .openclaw/kontexta.md) so agents pick up the workflow automatically.

Apache-2.0. Use it commercially, fork it, embed it. No telemetry callback, no rug pull.