ContextGuard

The linter for your AI configuration.

Each agent has config it may read on every request — Claude Code has CLAUDE.md, Cursor has .cursorrules, Copilot has its instruction files, MCP servers add tool schemas — and nothing reviews that layer. When an agent ignores a rule, you blame the model, not the 6,000-token CLAUDE.md where that rule is buried under contradictions and a duplicated style guide.

ContextGuard is ESLint for that layer. Deterministic rules catch oversized instruction files, unmeasured MCP overhead, secrets in AI-visible files, and token bloat — each with the monthly cost it quietly adds. It also exports clean, paste-ready context bundles for any web AI. Local-first: your code never leaves your machine during scans.

30 seconds to value: open a project. If it has AI instructions, the status bar shows the combined configuration footprint across detected tools; hover it for the monthly cost estimate. MCP configs are detected separately, and their file bytes are not counted as model context. Click the status bar to inspect it.

Screenshots use real projects where it matters: Cline examples are from the actual open-source Cline repo; secret-finding examples use a local test repo.

Quick Start

1. Install and open a project. The status bar (bottom right) shows your combined configuration footprint; hover it for cost and completeness details.
2. Click the ContextGuard icon in the Activity Bar.
3. Click Workspace to lint your AI config, or Tabs to see the current session's context.
4. Fix the warnings, or select files and export a clean bundle.

What drifts, and why it matters

Every AI tool brings its own project config, and that config rots:

• Instruction files grow until they tax every request, unnoticed
• CLAUDE.md and .cursorrules start contradicting each other once you use more than one tool
• MCP servers add schema overhead nobody has measured
• Secrets land in files agents happily read — even gitignored ones
• Handing context to a web AI means hand-picking files and stripping noise, again and again

ContextGuard handles all of it locally, with deterministic rules. No AI required to lint your AI.

Lint: ESLint for AI context

Scan your active file, open tabs, or workspace (Pro adds PR Review and Branch Diff). Every warning is a rule, not a guess:

One registry, every convention. ContextGuard detects 21+ conventions — Claude Code, AGENTS.md, Cursor, Copilot, Cline, Windsurf, Roo Code, Gemini, Codex CLI, Aider, Zed, Continue, JetBrains Junie, Amazon Q, Kilo Code, Goose, OpenHands, Amp, Augment Code, Firebase Studio, Trae — each mapped to its real paths (CLAUDE.md, .cursorrules, .github/copilot-instructions.md, .mcp.json, …). If a repo has Claude, Cursor, and Copilot config, ContextGuard shows all three so teams can see total exposure. Each tool still loads only its own files. Missing one is a bug — file it.

Instruction-file warnings also show up in the Problems panel on save, no manual scan needed.

Know what it costs

The status bar shows your combined configuration footprint: the sum of always-on instruction content ContextGuard found across detected conventions. Hover it for the modeled monthly cost. This is deliberately not yet a per-agent baseline; each agent loads only its own instructions. MCP config files are listed for audit, but their file bytes are not model context and are excluded. A 4k-token CLAUDE.md still isn't free.

Defaults are conservative (50 requests/day, Sonnet-class pricing). Point costModel.requestsPerDay and costModel.usdPerMillionInputTokens at your real usage and every "≈ $X/month" becomes your number. And the dollars are only half of it — those tokens take up context-window room and compete with your real instructions on every request, so trimming the baseline buys you a sharper agent and a cheaper one. The token count is true no matter how you're billed.

The footprint includes always-on project, parent, and consented global instruction files plus explicit @imports. An instruction file that contains a secret keeps its instruction identity, remains counted, and is flagged separately; Preview, Copy, and bundle rendering redact the secret. Conditional rules are listed outside the footprint until they apply.

Instruction files also get an inline CodeLens, so the cost is visible at the top of the file and at the section that is carrying the weight.

On-demand rules are counted only when they fire. Path/glob-scoped rules (Cursor globs, Claude paths:, Windsurf trigger: glob) and subdirectory CLAUDE.md/AGENTS.md files aren't in the every-request baseline. But scan a file one of them targets and it's counted and badged "✓ Applies here," because the agent really would inject it there. Rules that load on the agent's judgment or an @-mention can't be predicted, so they're listed but left uncounted.

Incomplete scans say so. If a plan, discovery, sensitive-file, deep-security, or per-convention safety cap is reached, the panel keeps a persistent warning and the CLI reports a lower bound through scanComplete / completenessReasons. Files use one shared 512 KiB UTF-8 read limit across editor and CLI surfaces.

See exactly what's injected

Preview Injected Context opens one document with the combined instruction footprint (@imports expanded), conditional rules, and a separate MCP configuration section. MCP config bytes are explicitly not counted as model context. Copy Injected Context copies only the always-on instruction content. Both redact detected secrets to [REDACTED] first; token totals still reflect the real, unredacted instruction size.

Reading config outside your project (global ~/, and parent directories on Pro) happens only after a one-time, machine-wide consent prompt — the first time a scan reaches outside the workspace. Turn it off anytime under Settings → Scan global & home config.

Fix: don't just flag (Pro)

Optimize Instruction File turns mechanically safe warnings into edits. Pick a file and ContextGuard proposes only duplicate rules within that same file. Cross-file duplicates and contradictions remain analysis-only because precedence differs by agent and convention. You approve every removal in a native diff preview, and the summary shows the payoff.

Bundle budgets count the rendered Markdown—not just source-file estimates—so task text, file maps, headings, fences, warnings, redaction notes, and part labels all contribute before a bundle is split.

Guard: catch secrets before the agent does

Secrets in your instruction files (CLAUDE.md, .cursorrules, AGENTS.md, …) are flagged in the Problems panel on every save, free — those files are auto-injected into every session, so a leaked key there is core safety, not a paid extra.

Live Secret Guard (Pro) extends that same on-save check to every other AI-visible file (.ts, .py, .json, …). The moment a key, token, JWT, or database URL lands in one, you get a status-bar alert and a Problems entry with the exact line. Detection covers real shapes: OpenAI/Anthropic, GitHub, GitLab, Slack, Stripe, AWS, Google, and npm, plus JWTs, private-key blocks, and credentialed DB URLs.

Workspace Security Audit sweeps the whole project on demand and shows the file and line of every finding — free, because paywalling where a secret is would defeat the point. Pro's secret value is the continuous every-save guard, not the locations.

Adopting on a legacy repo? (free) Bulk-accept the pile of pre-existing findings instead of drowning in them: the scan panel's Accept secrets button (or the bundled CLI: contextguard check --write-baseline) writes a committed .secrets.baseline of the current findings. Future scans suppress exactly those by file + value-hash, while any new secret still surfaces — and a finding stays suppressed even if its line moves. (Only a hash of each value is stored, never the secret itself.) For one-off lines, an inline contextguard:allow comment still works.

Secret redaction (free) replaces detected secrets with [REDACTED] in every exported bundle and in the Preview/Copy views (bundles say so in the preamble). Leaking a credential is irreversible, so it's never gated — paste into any web AI without wondering what rode along. Env-var references and placeholders are left alone; only real secret material is scrubbed. (PR review packs are Pro, so their redaction is Pro.)

Measure: real MCP overhead (Pro)

MCP configs only tell you a server exists. The real cost is the tool schemas it injects at runtime, and nothing shows that number. Measure MCP Overhead launches your configured stdio servers (with your confirmation, since these are commands from workspace config), performs the handshake, calls tools/list, and reports the actual schema tokens per server and their monthly cost.

Scope: ContextGuard measures repo-local MCP configs and stdio servers it can safely launch with your approval. Global, remote, client-managed, or built-in agent context may not be visible from the workspace.

Bundle: clean context for any AI

Pick what matters, cut what doesn't, and export a paste-ready Markdown bundle for Claude, ChatGPT, Copilot Chat, or any web AI:

• Token counts per file, with a budget bar
• Per-file allocation breakdown (Pro)
• Remove Noise deselects lockfiles, generated output, logs, and snapshots in one click
• A compact file map at the top so the AI sees your project structure
• Live selection tracking: highlight code, bundle just the selection
• Export to clipboard or to a Markdown file for CLI agents that read context from disk

PR Review (Pro)

PR Review scans your uncommitted changes, including untracked files that git diff silently misses. Each file shows diff and full-file token counts, toggleable per file. The export is a paste-ready review prompt in unified-diff format, with related test files included so the reviewer sees current coverage. Branch Diff Review packages all commits ahead of your base branch without touching git state — ideal for reviewing someone else's branch. Oversized packs split into labeled "Part X of N" pastes.

Free vs Pro

When a scan hits the file cap, sensitive-looking files (.env, keys, keystores, Terraform state) and files with detected secret content are prioritized first.

Early-access pricing is $5/month or $39/year. After purchase, activate with ContextGuard: Activate Pro License from the Command Palette.

.contextguardignore

Create a .contextguardignore at the project root to exclude files from scans:

# Logs and generated files
*.log
logs/
*.min.js
archive/

Workspace scans also respect your .gitignore, except for sensitive-looking files — a gitignored .env is still AI-visible, so it's still flagged.

Settings

Support

ContextGuard's free tier stands on its own — token baseline, lint rules, secret detection with exact locations, bundle redaction, and clean export, all local. If it's saved you tokens or caught a secret, Pro funds the work (and unlocks PR review, Live Secret Guard, Optimize, and more). Early-access pricing is $5/month or $39/year.

How it works

Deterministic rules over a data-driven registry of 21+ agent conventions, with a strict split between the pure detection core (shared with the CLI) and the VS Code layer. The full picture — module map, scan pipeline, and where the only network call lives — is in docs/ARCHITECTURE.md.

Privacy

Local-first. Scans, lints, and bundles run on your machine — no telemetry, no data collection. Reading AI config outside your project (global ~/, and parent directories on Pro) happens only after a one-time, machine-wide consent prompt; until you allow it, ContextGuard stays inside the workspace. The only outbound call is Pro license activation or validation — to the ContextGuard license server, which forwards to Lemon Squeezy — and only when you activate a key. Measure MCP Overhead launches workspace-configured MCP commands after your confirmation; those servers do whatever they normally do. Your code stays on your machine.

License

Proprietary. See LICENSE.